fix(permissions): restrict deletes and admin member management

apps/clients/api/permissions.py

@@ -6,6 +6,7 @@ from apps.workspaces.services import (
     CLIENTS_DELETE,
     CLIENTS_EDIT,
     CLIENTS_VIEW,
+    can_delete_workspace_object,
     has_workspace_capability,
 )
 
@@ -43,4 +44,6 @@ class IsClientWorkspaceMember(permissions.BasePermission):
             "partial_update": CLIENTS_EDIT,
             "destroy": CLIENTS_DELETE,
         }.get(view.action, CLIENTS_VIEW)
+        if view.action == "destroy":
+            return can_delete_workspace_object(request.user, obj, CLIENTS_DELETE)
         return has_workspace_capability(request.user, obj.workspace, capability)