Read workspace settings for a teamless scope, not a permissive constant

Isaiah's ruling for this stack is that falling back to workspace settings
when the scope has no team is the intended behaviour. A hardcoded
`UNRESTRICTED` was not that: on a sharing control it was potentially more
permissive than the workspace's own policy. Drop the `has_teams()` guard
so a teamless scope reads `current_workspace().settings` directly, and
delete the constant, returning `workspace.rs` to master.

The no-workspace arm stays permissive, preserving the `unwrap_or(true)`
these getters had before they took a scope; there is no workspace policy
to read there, and denying would newly hide the share UI while workspaces
load.

Author: warp-agent-staging[bot]

app/src/workspaces/user_workspaces.rs

@@ -1951,12 +1951,12 @@ impl UserWorkspaces {
     /// The link-sharing policy that governs `scope`.
     ///
     /// A scope that resolves to a team reads that team's effective policy, so two windows on
-    /// different teams disagree exactly as their admins configured them.
+    /// different teams disagree exactly as their admins configured them. A scope with no team
+    /// falls back to the workspace's own settings, which never lets another team's policy
+    /// stand in for a team the scope does not have.
     ///
-    /// A scope with no team is not on a team, and no team's policy may stand in for that.
-    /// [`Self::current_workspace`]'s settings are only genuine workspace-level data while the
-    /// workspace has no teams; once it has any, the server resolved them for one arbitrarily
-    /// chosen team, so a teamless scope gets [`LinkSharingSettings::UNRESTRICTED`] instead.
+    /// With no workspace either there is nothing to govern the read, and both channels are
+    /// permitted -- the behaviour this getter had before it took a scope.
     fn link_sharing_settings(&self, scope: &impl TeamScope) -> LinkSharingSettings {
         if let Some(team) = self.team_from_scope(scope) {
             let link_sharing = &team.settings.link_sharing;
@@ -1968,17 +1968,12 @@ impl UserWorkspaces {
             };
         }
 
-        // No window reaches this today: one is only registered teamless while the user has no
-        // teams, and `reconcile_window_team_assignments` moves it onto a team the moment any
-        // appear. It stops being dead the first time a caller reads a
-        // [`TeamContextForOperation`] captured before its window had a team.
-        if self.has_teams() {
-            return LinkSharingSettings::UNRESTRICTED;
-        }
-
         self.current_workspace()
             .map(|workspace| workspace.settings.link_sharing_settings.clone())
-            .unwrap_or(LinkSharingSettings::UNRESTRICTED)
+            .unwrap_or(LinkSharingSettings {
+                anyone_with_link_sharing_enabled: true,
+                direct_link_sharing_enabled: true,
+            })
     }
 
     /// Whether `scope` may share an object with anyone who holds its link.

app/src/workspaces/user_workspaces_tests.rs

@@ -1353,10 +1353,16 @@ fn test_link_sharing_resolves_each_windows_own_team() {
 }
 
 #[test]
-fn test_link_sharing_for_a_teamless_window_ignores_the_users_other_teams() {
-    let (_, restricted_team) = a_sharing_team_and_a_restricted_team();
-    let mut workspace = workspace_for_test(&restricted_team);
-    workspace.settings.link_sharing_settings = LinkSharingSettings::default();
+fn test_link_sharing_for_a_teamless_window_reads_the_workspace_not_another_team() {
+    let mut team = team_for_test();
+    // Deliberately the mirror image of the workspace's policy, so reading the wrong one of the
+    // two is visible in both channels rather than only one.
+    team.settings.link_sharing = team_link_sharing(false, true);
+    let mut workspace = workspace_for_test(&team);
+    workspace.settings.link_sharing_settings = LinkSharingSettings {
+        anyone_with_link_sharing_enabled: true,
+        direct_link_sharing_enabled: false,
+    };
 
     App::test((), |mut app| async move {
         initialize_window_team_test_app(&mut app, vec![workspace]);
@@ -1376,10 +1382,12 @@ fn test_link_sharing_for_a_teamless_window_ignores_the_users_other_teams() {
 
             assert!(
                 user_workspaces.is_anyone_with_link_sharing_enabled(&scope),
-                "a window with no team is not on a team, so neither the restricting team's \
-                 policy nor the workspace's teams[0] settings may govern it"
+                "a window with no team should read the workspace's own policy"
+            );
+            assert!(
+                !user_workspaces.is_direct_link_sharing_enabled(&scope),
+                "and must not pick up the policy of a team it is not on"
             );
-            assert!(user_workspaces.is_direct_link_sharing_enabled(&scope));
         });
     })
 }

app/src/workspaces/workspace.rs

@@ -977,15 +977,6 @@ pub struct LinkSharingSettings {
     pub direct_link_sharing_enabled: bool,
 }
 
-impl LinkSharingSettings {
-    /// The policy in force when neither a team nor a workspace governs link sharing: both
-    /// channels are permitted. Deliberately not `Default`, which is all-`false`.
-    pub(crate) const UNRESTRICTED: Self = Self {
-        anyone_with_link_sharing_enabled: true,
-        direct_link_sharing_enabled: true,
-    };
-}
-
 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct EnterpriseSecretRegex {
     pub pattern: String,