Admin user can't restore other user spaces

[amrita-shrestha]

Describe the bug

Admin user tries to restore other user disabled spaces.
Admin users can disable and delete other user spaces

Steps to reproduce

Steps to reproduce the behavior:

1. create user Aria with Space Admin role
2. Aria create space QA team
3. Admin user with admin role disable space QA team
4. Admin user tries to restore space using api request

curl --location --request PATCH 'https://localhost:9200/graph/v1.0/drives/2406b4ec-3469-4183-9a17-59d23cf2d067%240a6865f0-c82a-4367-8f87-375a34fcd03c' \
--header 'Restore: T' \
--data '{"name":"amy"}'

Expected behavior

If admins are allowed to disable and delete other spaces than they should also be allowed to restore other spaces

Actual behavior

Admin user can disable and delete other spaces but can't restore other spaces

[amrita-shrestha]

@ScharfViktor @micbar

[kobergj]

Needs clarification:

• Should an admin be allowed to enable/disable spaces or only a spaceadmin?
• Should a spaceadmin be allowed to delete project spaces?
• Should an admin be allowed to delete project spaces?

cc @micbar @tbsbdr

[ScharfViktor]

• TODO add api tests: [tests-only][full-ci]Extend tests coverage for different role capability for spaces #5853
• admin enable/disable/delete other user space
• space admin enable/disable/delete other user space

[micbar]

@kobergj
I think we have a bit of a dirty state on permissions in the settings service.

We discussed it already, we need to do a small refactoring.

[kobergj]

@micbar fine for me. Did we write down somewhere what we decided?

[micbar]

We should do at 13:30 today in the grooming.

[micbar]

Outcome

General

We will use drives.ReadWriteEnabled for the disable/enable actions

We will use delete-all-spaces only for the final deletion on the storage

Web

• Show the delete button on a disabled space when delete-all-spaces is present
• Show/hide space edit actions for name and description depending on Drive.ReadWrite
• Show/hide "enable/disable" actions depending on drives.ReadWriteEnabled

oCIS

• Refactor the delete-all-spaces permission.

[micbar]

@kobergj I updated the default roles in #6310

But the issue with the delete-all-spaces permission still exists.