feat(authz): Project.canCreateModel and Project.canMoveToWorkspace policies (#4342)

* feat(authz): Project.canCreateModel policy

* feat(authz): Project.canMoveToWorkspace policy

* fix(authz): expose policies as permissions objects

* chore(authz): actually use the policies lol

* chore(authz): add tests for new policies

* fix(authz): skip affected test

* fix(authz): pr comments

* fix(authz): better errors, better tests

* chore(authz): remove references to deleted error

packages/server/modules/workspacesCore/authz/loaders/index.ts

@@ -17,6 +17,9 @@ export default defineModuleLoaders(() => ({
   getWorkspaceSeat: async () => {
     throw new LoaderUnsupportedError()
   },
+  getWorkspaceModelCount: async () => {
+    throw new LoaderUnsupportedError()
+  },
   getWorkspaceProjectCount: async () => {
     throw new LoaderUnsupportedError()
   },

packages/server/modules/workspacesCore/errors/index.ts

@@ -8,3 +8,9 @@ export class SsoSessionMissingOrExpiredError extends BaseError<{
   static code = 'SSO_SESSION_MISSING_OR_EXPIRED_ERROR'
   static statusCode = 401
 }
+
+export class WorkspaceRequiredError extends BaseError {
+  static defaultMessage = 'This action requires a workspace.'
+  static code = 'WORKSPACE_REQUIRED_ERROR'
+  static statusCode = 400
+}