fix: refer to permissions with program prefix

program/serializers.py

@@ -635,7 +635,7 @@ class ShowSerializer(serializers.HyperlinkedModelSerializer):
             raise exceptions.PermissionDenied(detail="You are not allowed to update this show.")
 
         # without the update_show permission, fields without edit permission are not allowed
-        if not user.has_perm("update_show") and (
+        if not user.has_perm("program.update_show") and (
             not_allowed := update_fields.difference(user_permissions)
         ):
             detail = {field: "You are not allowed to edit this field" for field in not_allowed}

program/views.py

@@ -724,7 +724,7 @@ class APINoteViewSet(
 
         user = self.request.user
 
-        if self.request.method in permissions.SAFE_METHODS or user.has_perm("update_note"):
+        if self.request.method in permissions.SAFE_METHODS or user.has_perm("program.update_note"):
             return Note.objects.all()
         else:
             return Note.objects.filter(timeslot__schedule__show__owners=user)