Restrict work item list to admin only

server/src/api/routes/WorkItemRoutes.js

@@ -107,6 +107,8 @@ export class WorkItemRoutes {
         "data._id": 1,
         "data.resolution": 1,
         "data.status": 1,
+        "data.createdAt": 1,
+        "data.team": 1,
       })
 
     const items = await aggregate.exec()