restrict workspace information updates to owner and admins

atst/domain/workspaces/workspaces.py

@@ -38,9 +38,9 @@ class Workspaces(object):
     @classmethod
     def get_for_update_information(cls, user, workspace_id):
         workspace = WorkspacesQuery.get(workspace_id)
-        # Authorization.check_workspace_permission(
-        #     user, workspace, TBD, "update workspace information"
-        # )
+        Authorization.check_workspace_permission(
+            user, workspace, Permissions.EDIT_WORKSPACE_INFORMATION, "update workspace information"
+        )
 
         return workspace
 

atst/models/permissions.py

@@ -20,6 +20,7 @@ class Permissions(object):
     VIEW_ASSIGNED_ATAT_ROLE_CONFIGURATIONS = "view_assigned_atat_role_configurations"
     VIEW_ASSIGNED_CSP_ROLE_CONFIGURATIONS = "view_assigned_csp_role_configurations"
 
+    EDIT_WORKSPACE_INFORMATION = "edit_workspace_information"
     DEACTIVATE_WORKSPACE = "deactivate_workspace"
     VIEW_ATAT_PERMISSIONS = "view_atat_permissions"
     TRANSFER_OWNERSHIP_OF_WORKSPACE = "transfer_ownership_of_workspace"