feat: check for permissions insted of is_superuser

program/views.py

@@ -724,7 +724,7 @@ class APINoteViewSet(
 
         user = self.request.user
 
-        if self.request.method in permissions.SAFE_METHODS or user.is_superuser:
+        if self.request.method in permissions.SAFE_METHODS or user.has_perm("update_note"):
             return Note.objects.all()
         else:
             return Note.objects.filter(timeslot__schedule__show__owners=user)