From 7b814c565d0285be83254cd20b6f0544c9396465 Mon Sep 17 00:00:00 2001 From: "ion.dormenco" Date: Wed, 14 Oct 2026 10:38:34 +0300 Subject: [PATCH] Allow NGO staff to create, update and delete comments --- api/src/Feature.CitizenReports.Comments/Create/Endpoint.cs | 4 ++-- api/src/Feature.CitizenReports.Comments/Delete/Endpoint.cs | 4 ++-- api/src/Feature.CitizenReports.Comments/Update/Endpoint.cs | 4 ++-- api/src/Feature.Form.Submission.Comments/Create/Endpoint.cs | 2 +- api/src/Feature.Form.Submission.Comments/Delete/Endpoint.cs | 2 +- api/src/Feature.Form.Submission.Comments/Update/Endpoint.cs | 2 +- api/src/Feature.IncidentReports.Comments/Create/Endpoint.cs | 2 +- api/src/Feature.IncidentReports.Comments/Delete/Endpoint.cs | 2 +- api/src/Feature.IncidentReports.Comments/Update/Endpoint.cs | 2 +- api/src/Feature.QuickReports.Comments/Create/Endpoint.cs | 2 +- api/src/Feature.QuickReports.Comments/Delete/Endpoint.cs | 2 +- api/src/Feature.QuickReports.Comments/Update/Endpoint.cs | 2 +- 12 files changed, 15 insertions(+), 15 deletions(-) diff --git a/api/src/Feature.CitizenReports.Comments/Create/Endpoint.cs b/api/src/Feature.CitizenReports.Comments/Create/Endpoint.cs index d8766ebaf..3795158d8 100644 --- a/api/src/Feature.CitizenReports.Comments/Create/Endpoint.cs +++ b/api/src/Feature.CitizenReports.Comments/Create/Endpoint.cs @@ -16,7 +16,7 @@ public override void Configure() Options(x => x.WithTags("citizen-report-comments")); Summary(s => { s.Summary = "Creates a comment for a citizen report."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, @@ -24,7 +24,7 @@ public override async Task, NotFound>> Exe { var authorizationResult = await authorizationService.AuthorizeAsync(User, - new CitizenReportingNgoAdminRequirement(req.ElectionRoundId)); + new CitizenReportingNgoAdminOrStaffRequirement(req.ElectionRoundId)); if (!authorizationResult.Succeeded) { return TypedResults.NotFound(); diff --git a/api/src/Feature.CitizenReports.Comments/Delete/Endpoint.cs b/api/src/Feature.CitizenReports.Comments/Delete/Endpoint.cs index 1dbe1fbc2..453171f26 100644 --- a/api/src/Feature.CitizenReports.Comments/Delete/Endpoint.cs +++ b/api/src/Feature.CitizenReports.Comments/Delete/Endpoint.cs @@ -14,14 +14,14 @@ public override void Configure() Options(x => x.WithTags("citizen-report-comments")); Summary(s => { s.Summary = "Deletes a citizen report comment. Only the author can delete it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task> ExecuteAsync(Request req, CancellationToken ct) { var authorizationResult = await authorizationService.AuthorizeAsync(User, - new CitizenReportingNgoAdminRequirement(req.ElectionRoundId)); + new CitizenReportingNgoAdminOrStaffRequirement(req.ElectionRoundId)); if (!authorizationResult.Succeeded) { return TypedResults.NotFound(); diff --git a/api/src/Feature.CitizenReports.Comments/Update/Endpoint.cs b/api/src/Feature.CitizenReports.Comments/Update/Endpoint.cs index b8b33a3eb..711368bea 100644 --- a/api/src/Feature.CitizenReports.Comments/Update/Endpoint.cs +++ b/api/src/Feature.CitizenReports.Comments/Update/Endpoint.cs @@ -14,7 +14,7 @@ public override void Configure() Options(x => x.WithTags("citizen-report-comments")); Summary(s => { s.Summary = "Updates a citizen report comment. Only the author can update it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, @@ -22,7 +22,7 @@ public override async Task, NotFound>> Exe { var authorizationResult = await authorizationService.AuthorizeAsync(User, - new CitizenReportingNgoAdminRequirement(req.ElectionRoundId)); + new CitizenReportingNgoAdminOrStaffRequirement(req.ElectionRoundId)); if (!authorizationResult.Succeeded) { return TypedResults.NotFound(); diff --git a/api/src/Feature.Form.Submission.Comments/Create/Endpoint.cs b/api/src/Feature.Form.Submission.Comments/Create/Endpoint.cs index 3ffe66150..19d21e15e 100644 --- a/api/src/Feature.Form.Submission.Comments/Create/Endpoint.cs +++ b/api/src/Feature.Form.Submission.Comments/Create/Endpoint.cs @@ -18,7 +18,7 @@ public override void Configure() s.Summary = "Creates a comment for a form submission. Omit questionId for a submission-level comment."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, diff --git a/api/src/Feature.Form.Submission.Comments/Delete/Endpoint.cs b/api/src/Feature.Form.Submission.Comments/Delete/Endpoint.cs index e92c22928..04035eaa6 100644 --- a/api/src/Feature.Form.Submission.Comments/Delete/Endpoint.cs +++ b/api/src/Feature.Form.Submission.Comments/Delete/Endpoint.cs @@ -13,7 +13,7 @@ public override void Configure() Options(x => x.WithTags("form-submission-comments")); Summary(s => { s.Summary = "Deletes a form submission comment. Only the author can delete it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task> ExecuteAsync(Request req, CancellationToken ct) diff --git a/api/src/Feature.Form.Submission.Comments/Update/Endpoint.cs b/api/src/Feature.Form.Submission.Comments/Update/Endpoint.cs index 779d32e1f..84d03e35e 100644 --- a/api/src/Feature.Form.Submission.Comments/Update/Endpoint.cs +++ b/api/src/Feature.Form.Submission.Comments/Update/Endpoint.cs @@ -13,7 +13,7 @@ public override void Configure() Options(x => x.WithTags("form-submission-comments")); Summary(s => { s.Summary = "Updates a form submission comment. Only the author can update it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, diff --git a/api/src/Feature.IncidentReports.Comments/Create/Endpoint.cs b/api/src/Feature.IncidentReports.Comments/Create/Endpoint.cs index 698057382..6214bf999 100644 --- a/api/src/Feature.IncidentReports.Comments/Create/Endpoint.cs +++ b/api/src/Feature.IncidentReports.Comments/Create/Endpoint.cs @@ -15,7 +15,7 @@ public override void Configure() Options(x => x.WithTags("incident-report-comments")); Summary(s => { s.Summary = "Creates a comment for an incident report."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, diff --git a/api/src/Feature.IncidentReports.Comments/Delete/Endpoint.cs b/api/src/Feature.IncidentReports.Comments/Delete/Endpoint.cs index 784e1a6b4..78a162b05 100644 --- a/api/src/Feature.IncidentReports.Comments/Delete/Endpoint.cs +++ b/api/src/Feature.IncidentReports.Comments/Delete/Endpoint.cs @@ -13,7 +13,7 @@ public override void Configure() Options(x => x.WithTags("incident-report-comments")); Summary(s => { s.Summary = "Deletes an incident report comment. Only the author can delete it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task> ExecuteAsync(Request req, CancellationToken ct) diff --git a/api/src/Feature.IncidentReports.Comments/Update/Endpoint.cs b/api/src/Feature.IncidentReports.Comments/Update/Endpoint.cs index 314282ff2..a94f455d9 100644 --- a/api/src/Feature.IncidentReports.Comments/Update/Endpoint.cs +++ b/api/src/Feature.IncidentReports.Comments/Update/Endpoint.cs @@ -13,7 +13,7 @@ public override void Configure() Options(x => x.WithTags("incident-report-comments")); Summary(s => { s.Summary = "Updates an incident report comment. Only the author can update it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, diff --git a/api/src/Feature.QuickReports.Comments/Create/Endpoint.cs b/api/src/Feature.QuickReports.Comments/Create/Endpoint.cs index 620853c93..5b52ae755 100644 --- a/api/src/Feature.QuickReports.Comments/Create/Endpoint.cs +++ b/api/src/Feature.QuickReports.Comments/Create/Endpoint.cs @@ -15,7 +15,7 @@ public override void Configure() Options(x => x.WithTags("quick-report-comments")); Summary(s => { s.Summary = "Creates a comment for a quick report."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req, diff --git a/api/src/Feature.QuickReports.Comments/Delete/Endpoint.cs b/api/src/Feature.QuickReports.Comments/Delete/Endpoint.cs index 337ae44ba..c4d6ff8b8 100644 --- a/api/src/Feature.QuickReports.Comments/Delete/Endpoint.cs +++ b/api/src/Feature.QuickReports.Comments/Delete/Endpoint.cs @@ -13,7 +13,7 @@ public override void Configure() Options(x => x.WithTags("quick-report-comments")); Summary(s => { s.Summary = "Deletes a quick report comment. Only the author can delete it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task> ExecuteAsync(Request req, CancellationToken ct) diff --git a/api/src/Feature.QuickReports.Comments/Update/Endpoint.cs b/api/src/Feature.QuickReports.Comments/Update/Endpoint.cs index 7a870ad52..9e378f462 100644 --- a/api/src/Feature.QuickReports.Comments/Update/Endpoint.cs +++ b/api/src/Feature.QuickReports.Comments/Update/Endpoint.cs @@ -13,7 +13,7 @@ public override void Configure() Options(x => x.WithTags("quick-report-comments")); Summary(s => { s.Summary = "Updates a quick report comment. Only the author can update it."; }); - Policies(PolicyNames.NgoAdminsOnly); + Policies(PolicyNames.NgoAdminOrStaff); } public override async Task, NotFound>> ExecuteAsync(Request req,