From 3444a161b91ae4d364ff57083cc51a87c0e01d15 Mon Sep 17 00:00:00 2001
From: Robin Ward <robin.ward@gmail.com>
Date: Wed, 16 Mar 2016 15:16:18 -0400
Subject: [PATCH] FEATURE: Option to disallow moderators from removing staff
 notes

---
 .../discourse/controllers/staff-notes.js.es6    |  2 +-
 .../discourse/templates/modal/staff-notes.hbs   | 17 +++++++++--------
 config/locales/server.en.yml                    |  1 +
 config/settings.yml                             |  3 +++
 plugin.rb                                       | 12 +++++++++++-
 5 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/assets/javascripts/discourse/controllers/staff-notes.js.es6 b/assets/javascripts/discourse/controllers/staff-notes.js.es6
index babb823..be1e0ec 100644
--- a/assets/javascripts/discourse/controllers/staff-notes.js.es6
+++ b/assets/javascripts/discourse/controllers/staff-notes.js.es6
@@ -41,7 +41,7 @@ export default Ember.Controller.extend({
         const notes = this.get('model');
         notes.removeObject(note);
         this._refreshCount();
-      });
+      }).catch(popupAjaxError);
     }
   }
 });
diff --git a/assets/javascripts/discourse/templates/modal/staff-notes.hbs b/assets/javascripts/discourse/templates/modal/staff-notes.hbs
index e76d127..86c5eb3 100644
--- a/assets/javascripts/discourse/templates/modal/staff-notes.hbs
+++ b/assets/javascripts/discourse/templates/modal/staff-notes.hbs
@@ -12,14 +12,15 @@
           <span class='username'>{{n.created_by.username}}</span>
           <span class='post-date'>{{age-with-tooltip n.created_at}}</span>
 
-          <span class='controls'>
-            {{d-button action="removeNote"
-                       actionParam=n
-                       icon="times"
-                       class="btn-small btn-danger"
-                       title="staff_notes.remove"}}
-          </span>
-
+          {{#if n.can_delete}}
+            <span class='controls'>
+              {{d-button action="removeNote"
+                         actionParam=n
+                         icon="times"
+                         class="btn-small btn-danger"
+                         title="staff_notes.remove"}}
+            </span>
+          {{/if}}
         </div>
 
         <div class='cooked'>
diff --git a/config/locales/server.en.yml b/config/locales/server.en.yml
index 092ad31..18ef2a3 100644
--- a/config/locales/server.en.yml
+++ b/config/locales/server.en.yml
@@ -1,3 +1,4 @@
 en:
   site_settings:
     staff_notes_enabled: "Allow staff users to attach notes to users"
+    staff_notes_moderators_delete: "Allow moderators to delete staff notes"
diff --git a/config/settings.yml b/config/settings.yml
index d2603f0..300502e 100644
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -2,3 +2,6 @@ plugins:
   staff_notes_enabled:
     default: false
     client: true
+  staff_notes_moderators_delete:
+    default: true
+    client: false
diff --git a/plugin.rb b/plugin.rb
index 573a19a..6464fcf 100644
--- a/plugin.rb
+++ b/plugin.rb
@@ -56,7 +56,7 @@ after_initialize do
 
   require_dependency 'application_serializer'
   class ::StaffNoteSerializer < ApplicationSerializer
-    attributes :id, :user_id, :raw, :created_by, :created_at
+    attributes :id, :user_id, :raw, :created_by, :created_at, :can_delete
 
     def id
       object[:id]
@@ -77,6 +77,10 @@ after_initialize do
     def created_at
       object[:created_at]
     end
+
+    def can_delete
+      scope.can_delete_staff_notes?
+    end
   end
 
   require_dependency 'application_controller'
@@ -107,6 +111,8 @@ after_initialize do
       user = User.where(id: params[:user_id]).first
       raise Discourse::NotFound if user.blank?
 
+      raise Discourse::InvalidAccess.new unless guardian.can_delete_staff_notes?
+
       ::DiscourseStaffNotes.remove_note(user, params[:id])
       render json: success_json
     end
@@ -131,6 +137,10 @@ after_initialize do
 
   whitelist_staff_user_custom_field(STAFF_NOTE_COUNT_FIELD)
 
+  add_to_class(Guardian, :can_delete_staff_notes?) do
+    (SiteSetting.staff_notes_moderators_delete? && user.staff?) || user.admin?
+  end
+
   DiscourseStaffNotes::Engine.routes.draw do
     get '/' => 'staff_notes#index'
     post '/' => 'staff_notes#create'