[Projects] Cannot access prebuild logs if not project owner

[AlexTugarev]

Bug description

When trying to access prebuild logs of a project where I'm not the installation owner, I see the following error missing get permissions on workspace. The error does not appear on projects which I installed.

The API operations we are using in PrebuildLog.tsx are getWorkspace, watchWorkspaceImageBuildLogs, and getHeadlessLog(instanceId), all of which compare the workspace owner with the current user and block on mismatch.

Proposed solution

PrebuildLog.tsx would call a dedicated getPrebuildLog(prebuildId) which would map from prebuildId to the underlying instance and also check for team permissions. This way, we would only relax the access guard within a team, and only for the necessary operation.

[gtsiolis]

Could not easily reproduce but sounds something we need to fix before shipping Teams & Projects. Adding this to the crew proejct board for now. Thanks @AlexTugarev!

[svenefftinge]

I think we need to be more fine_grained with our accesscontrol and allow team members read access (get) to workspace and instance and workspacelogs (do we need that or is this data that belongs to the instance?) if a workspace is a team's workspace (i.e. a prebuild associated with a project under a team).

[geropl]

@svenefftinge @AlexTugarev FYI: WorkspaceLogs already has a RessourceAccessGuard which allows everyone with "read" permission to repo to access the logs. Maybe we can re-use that for other stuff as well.

But I wonder if we should lift the permissions for getWorkspace in general. Maybe it'd be better to ask why we need it on the PrebuildLogs.tsx and replace it with (guarded) substitutes.