Implement Pulse Survey report permissions

[mkimberlin]

As a System Administrator, I want to define new permissions for accessing pulse survey data

Acceptance Criteria:

• A new permission named "CAN_VIEW_ALL_PULSE_RESPONSES" should be created.
• The PulseResponseController (and related service) should be altered so that users with this permission are allowed to access pulse survey responses from all team members and others are not.
• The PulseResponseController (and related service) should be altered so that users without this permission are allowed to see their own responses and those of people in their reporting heirarchy.
• Any existing pulse survey APIs should be reviewed and appropriate permissions added to ensure proper access control

[mkimberlin]

This story may need some additional grooming to define the needed permissions.

[timyates]

So I have implemented the described permission and added the hierarchy check for reading pulse reports.

This has been done in the Service layer...but I see now that the requirement says it should also be checked in the controller...do we need to check it twice?

Do we have an idea of other permissions we require? Currently I believe anyone authenticated could create a pulse response with another user's TeamMemberId. I guess we want to prevent this?

My current thoughts are:

1. New permissions CAN_CREATE_ALL_PULSE_RESPONSES, CAN_UPDATE_ALL_PULSE_RESPONSES
2. Checks when creating or updating to ensure that the permission is in the current user's role, or the teamMemberId field is set to that of the current user, or one of the users in the current user's hierarchy

Do these make sense?

Edit

I went with that in the PR 😎👍