posix. Space viewer can restore resources

[ScharfViktor]

Describe the bug

A clear and concise description of what the bug is.

Steps to reproduce

1. admin creates project space and shares to alan with Spaces viewer role
2. admin creates folder inside the space and deletes folder
3. alan tries to restore folder using API

curl --location --request MOVE 'https://opencloud-server:9200/remote.php/dav/spaces/trash-bin/4fd4f2ef-48df-4ff6-8a87-1bbb38aa8552$20c1ded3-455e-42a0-a678-5a3c8a024227/327fe9f2-2d0e-4b8f-a36b-9c42f37e09fc' \
--header 'Destination: https://opencloud-server:9200/remote.php/dav/spaces/4fd4f2ef-48df-4ff6-8a87-1bbb38aa8552%2420c1ded3-455e-42a0-a678-5a3c8a024227/f1' \
--header 'Overwrite: T' \
--header 'Authorization: Basic ZGVubmlzOmRlbW8='

case 2. space viewer and space editor can purge trash bin of project space

make test-acceptance-api \
   TEST_SERVER_URL=https://opencloud-server:9200 \
   BEHAT_FEATURE=tests/acceptance/features/apiSpaces/trashBin.feature:77

Expected behavior

403 no permissions to restore recources

Actual behavior

201 folder is restored

How to test:

make test-acceptance-api \
   TEST_SERVER_URL=https://opencloud-server:9200 \
   BEHAT_FEATURE=tests/acceptance/features/apiSpaces/trashBin.feature:74

Setup

Please describe how you started the server and provide a list of relevant environment variables or configuration files.

Details

OC_XXX=somevalue
OC_YYY=somevalue
PROXY_XXX=somevalue

Additional context

Add any other context about the problem here.

[butonic]

all closed:

❯ make test-acceptance-api \
   TEST_SERVER_URL=https://opencloud-server:9200 \
   BEHAT_FEATURE=tests/acceptance/features/apiSpaces/trashBin.feature
[...]
18 scenarios (18 passed)
215 steps (215 passed)
0m24.43s (19.83Mb)

The following tests were skipped because they are tagged @skip:
runsh: Total 18 scenarios (18 passed, 0 failed)
runsh: There were no unexpected failures.
runsh: There were no unexpected success.