delete option staff varizi

apps/payments/policies.py

@@ -1,5 +1,5 @@
 from django.db.models import Q
-from .models import PaymentAccessConfiguration
+from .models import PaymentAccessConfiguration, PaymentNotice
 
 
 def is_staff(user):
@@ -37,7 +37,29 @@ def can_manage_banks(user):
     return is_staff(user) and (user.is_superuser or getattr(profile, 'role', '') == 'CEO' or has_permission(user, 'manage_company_bankaccounts'))
 
 
+def may_delete_notice(user, notice):
+    role = getattr(getattr(user, 'staff_profile', None), 'role', '')
+    return is_staff(user) and (notice.created_by_id == user.pk or user.is_superuser or role in {'CEO', 'GENERAL_ADMIN'})
+
+
+def can_delete_notice(user, notice):
+    return may_delete_notice(user, notice) and not notice.deleted_at and not notice.receipts.exists()
+
+
+def notice_actions(queryset, user):
+    """Allow deletion actors to reach this notice without broadening other lists."""
+    queryset = queryset.filter(deleted_at__isnull=True)
+    if not is_staff(user):
+        return queryset.none()
+    role = getattr(getattr(user, 'staff_profile', None), 'role', '')
+    if user.is_superuser or role in {'CEO', 'GENERAL_ADMIN'}:
+        return queryset
+    return queryset.filter(Q(created_by=user) | Q(pk__in=visible(queryset, user).values('pk')))
+
+
 def visible(queryset, user):
+    if queryset.model == PaymentNotice:
+        queryset = queryset.filter(deleted_at__isnull=True)
     if not user.is_authenticated or not user.is_active:
         return queryset.none()
     if user.account_type == 'CUSTOMER':