Create notify? report policy

Right now the authorization logic is spread over several places.
Lets move it to a policy to avoid duplications and confusion.
The policy is meant to decide if a user should be notified about
a created report or not.

src/api/app/controllers/webui/users/notifications_controller.rb

@@ -39,7 +39,7 @@ def update
           notifications: paginated_notifications,
           selected_filter: selected_filter,
           show_read_all_button: show_read_all_button?,
-          show_reports: Flipper.enabled?(:content_moderation, User.session) && User.session.is_moderator?
+          show_reports: ReportPolicy.new(User.session, Report).notify?
         }
       end
     end

src/api/app/jobs/send_event_emails_job.rb

@@ -32,7 +32,7 @@ def send_email(subscribers, event)
 
   def event_subscribers(event:)
     if event.is_a?(Event::CreateReport)
-      event.subscribers.filter_map { |subscriber| subscriber if Flipper.enabled?(:content_moderation, subscriber) && subscriber.is_moderator? }
+      event.subscribers.filter_map { |subscriber| subscriber if ReportPolicy.new(subscriber, Report).notify? }
     else
       event.subscribers
     end

src/api/app/models/event_subscription/form.rb

@@ -45,8 +45,9 @@ def find_or_initialize_subscription(eventtype, receiver_role, channel)
 
     def show_form_for_create_report_event?(event_class:, subscriber:)
       if event_class.name == 'Event::CreateReport'
-        return false unless subscriber.try(:is_moderator?)
-        return false unless Flipper.enabled?(:content_moderation, subscriber)
+        # There is no subscriber for the global subscription configuration
+        return false if subscriber.blank?
+        return false unless ReportPolicy.new(subscriber, Report).notify?
       end
 
       true

src/api/app/policies/report_policy.rb

@@ -21,4 +21,12 @@ def create?
       !UserPolicy.new(user, record.reportable).update?
     end
   end
+
+  def notify?
+    return false unless Flipper.enabled?(:content_moderation, user)
+    return true if User.moderators.blank? && (user.is_admin? || user.is_staff?)
+    return true if user.is_moderator?
+
+    false
+  end
 end

src/api/app/services/notification_service/notifier.rb

@@ -61,6 +61,12 @@ def create_notification?(subscriber, channel)
       true
     end
 
+    def create_report_notification?(event:, subscriber:)
+      return false if event.is_a?(Event::CreateReport) && !ReportPolicy.new(subscriber, Report).notify?
+
+      true
+    end
+
     def notifiable_exists?
       # We need this check because the notification is created in a delayed job.
       # So the notifiable object could have been removed in the meantime.
@@ -70,14 +76,5 @@ def notifiable_exists?
       notifiable_id = @event.parameters_for_notification[:notifiable_id]
       notifiable_type.exists?(notifiable_id)
     end
-
-    def create_report_notification?(event:, subscriber:)
-      if event.is_a?(Event::CreateReport)
-        return false unless Flipper.enabled?(:content_moderation, subscriber)
-        return false unless subscriber.is_moderator?
-      end
-
-      true
-    end
   end
 end