IULRDC-173 DataCORE remove edit work for non-admins on Work view page

[rdlebeau]

Only admins can see the Edit Work panel on the Work view page now. If the Work is "pending review" a non-admin user can edit or delete it from the dashboard. Non-admin users see a message now where the edit panel used to be unless the Work is Tombstoned.

[aploshay]

The main thing that catches my eye here is that if we're making functional changes to user permissions, I'd expect to see model/controller changes in addition to view changes.

We don't need that if we're retaining the user's ability to edit/delete their own submission that's still pending_review, but if we want to completely remove their edit/delete abilities then we should be updating the Ability model.

[aploshay]

Oh, wait -- I do see the story as written actually does retain the edit/delete ability, just removes those links from the Show page, but retains them on the Dashboard. So this does meet the story as written, I'm just surprised and confused that the story is written that way -- tagged POs in JIRA for confirmation.