fix: authorize note retrieve from the thread's encounter

[adarshx01]

Proposed Changes

• NoteThread / NoteMessage detail now checks view permission against the thread's encounter, instead of only looking at ?encounter= on the request.
• Encounter-scoped users can retrieve (and therefore update) a thread they can already list. Patient-level threads still require can_view_clinical_data.
• Pulled the duplicated list/detail check into one helper.

Associated Issue

get_object had a leftover TODO (Authorise Based on encounter and permission) and just called super().get_object(), which goes through get_queryset. That queryset only treats encounter access when ?encounter= is present, so it never is on /thread/{id}/ or /notes/{id}/.

List with ?encounter= already returned 200 for can_read_encounter_clinical_data; GET on the same thread returned 403.

Merge Checklist

• Tests added/fixed
• Update docs in /docs
• Linting Complete
• Any other necessary step

@ohcnetwork/care-backend-maintainers @ohcnetwork/care-backend-admins

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}