fix: remove "All" permission for Workspace

[barredterra]

Before:

• All can access Workspace list and form view (but not do anything there)

After:

• Only Workspace Manager can access Workspace list and form view

Everything else should remain unchanged.

---

"All" users were able to open the workspace list and see everyone else's workspace and, by extension, their email id's. This becomes a problem in big systems where users cannot, for legal reasons, see everybody's email ids.

We had some get_list calls that workspace.py uses internally, which I had to change to get_all. From a security perspective, this changes nothing (before, everyone had permissions, now they get ignored).

Internal reference: LAN-619

[codecov]

Codecov Report

Merging #19496 (033c6b3) into develop (efeed5c) will increase coverage by 0.08%.
The diff coverage is 83.33%.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #19496      +/-   ##
===========================================
+ Coverage    65.41%   65.49%   +0.08%     
===========================================
  Files          755      755              
  Lines        74475    73895     -580     
  Branches      6126     6133       +7     
===========================================
- Hits         48715    48398     -317     
+ Misses       22266    21921     -345     
- Partials      3494     3576      +82     

Flag	Coverage Δ
server	68.59% <0.00%> (-0.02%)	⬇️
server-ui	31.77% <100.00%> (+0.04%)	⬆️
ui-tests	51.12% <100.00%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[shariquerik]

This will not work, since the user doesn't have access to Workspace he/she cannot use get_all or get_list

[barredterra]

Did you test it? It does work 😅

get_list, which was previously used, will check permissions, hence wouldn't work. But get_all ignores permissions, hence works.

[shariquerik]

Did you test it? It does work 😅

get_list, which was previously used, will check permissions, hence wouldn't work. But get_all ignores permissions, hence works.

My bad, I works 😅
LGTM