msg permissions issue

Hi all,

I have my tracker set up so that users only see issues they create or
assigned to them by doing this:

def user_issue(db, userid, itemid):
    return userid == db.issue.get(itemid, 'assignedto') or userid ==
db.issue.get(itemid, 'creator')

p = db.security.addPermission(name='View', klass='issue',
    check=user_issue,description="User is allowed to access this")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Edit', klass='issue',
    check=user_issue,description="User is allowed to edit this")
db.security.addPermissionToRole('User', p)
db.security.addPermissionToRole('User', 'Create', 'issue')

for cl in 'file', 'msg':
    db.security.addPermissionToRole('User', 'View', cl)
    db.security.addPermissionToRole('User', 'Edit', cl)
    db.security.addPermissionToRole('User', 'Create', cl)

I then wanted to make it so that users also see issues for which they
are on the nosy list:

def user_nosy_issue(db, userid, itemid):
    nosy = db.issue.get(itemid, 'nosy')
    # check if userid is in the list and return 1 if yes, 0 otherwise
    return nosy.count(userid)

# add permission for issue view and edit for people on nosy list

                                               p =
db.security.addPermission(name='View', klass='issue',
    check=user_nosy_issue,description="User is allowed to access this")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Edit', klass='issue',
    check=user_nosy_issue,description="User is allowed to edit this")
db.security.addPermissionToRole('User', p)

This works great except people on the nosy list can't reply (and
create a 'msg')..I know there is something I need to do to the
permissions for messages, but can't figure it out.  Any pointers much
appreciated.

Charles