EZQMS-729: Restrict spaces operations (#5500)

models/tracker/src/actions.ts

@@ -97,6 +97,7 @@ export function createActions (builder: Builder, issuesId: string, componentsId:
       input: 'focus',
       category: tracker.category.Tracker,
       target: tracker.class.Project,
+      visibilityTester: view.function.CanEditSpace,
       query: {},
       context: {
         mode: ['context', 'browser'],
@@ -115,6 +116,7 @@ export function createActions (builder: Builder, issuesId: string, componentsId:
       input: 'focus',
       category: tracker.category.Tracker,
       target: tracker.class.Project,
+      visibilityTester: view.function.CanArchiveSpace,
       query: {
         archived: false
       },
@@ -135,6 +137,7 @@ export function createActions (builder: Builder, issuesId: string, componentsId:
       input: 'focus',
       category: tracker.category.Tracker,
       target: tracker.class.Project,
+      visibilityTester: view.function.CanDeleteSpace,
       query: {
         archived: true
       },
@@ -159,6 +162,7 @@ export function createActions (builder: Builder, issuesId: string, componentsId:
     },
     input: 'any',
     category: tracker.category.Tracker,
+    visibilityTester: view.function.CanArchiveSpace,
     query: {
       archived: true
     },

models/tracker/src/index.ts

@@ -721,7 +721,11 @@ function defineSpaceType (builder: Builder): void {
       description: tracker.string.ManageWorkflowStatuses,
       icon: task.icon.Task,
       baseClass: tracker.class.Project,
-      availablePermissions: [core.permission.ForbidDeleteObject],
+      availablePermissions: [
+        core.permission.UpdateSpace,
+        core.permission.ArchiveSpace,
+        core.permission.ForbidDeleteObject
+      ],
       allowedClassic: true,
       allowedTaskTypeDescriptors: [tracker.descriptors.Issue]
     },

models/tracker/src/migration.ts

@@ -21,7 +21,8 @@ import core, {
   toIdMap,
   DOMAIN_TX,
   type Status,
-  type Ref
+  type Ref,
+  AccountRole
 } from '@hcengineering/core'
 import {
   type ModelLogger,
@@ -46,7 +47,9 @@ import {
   type Project,
   classicIssueTaskStatuses
 } from '@hcengineering/tracker'
+
 import tracker from './plugin'
+import contact from '@hcengineering/model-contact'
 
 async function createDefaultProject (tx: TxOperations): Promise<void> {
   const current = await tx.findOne(tracker.class.Project, {
@@ -332,6 +335,24 @@ async function migrateDefaultTypeMixins (client: MigrationClient): Promise<void>
   )
 }
 
+async function migrateDefaultProjectOwners (client: MigrationClient): Promise<void> {
+  const workspaceOwners = await client.model.findAll(contact.class.PersonAccount, {
+    role: AccountRole.Owner
+  })
+
+  await client.update(
+    DOMAIN_SPACE,
+    {
+      _id: tracker.project.DefaultProject
+    },
+    {
+      $set: {
+        owners: workspaceOwners.map((it) => it._id)
+      }
+    }
+  )
+}
+
 export const trackerOperation: MigrateOperation = {
   async preMigrate (client: MigrationClient, logger: ModelLogger): Promise<void> {
     await tryMigrate(client, trackerId, [
@@ -358,6 +379,10 @@ export const trackerOperation: MigrateOperation = {
       {
         state: 'migrateDefaultTypeMixins',
         func: migrateDefaultTypeMixins
+      },
+      {
+        state: 'migrateDefaultProjectOwners',
+        func: migrateDefaultProjectOwners
       }
     ])
   },