Add new group for permanent config

config/dev.exs

@@ -84,5 +84,5 @@ config :screenplay,
 
 config :ueberauth, Ueberauth,
   providers: [
-    cognito: {Screenplay.Ueberauth.Strategy.Fake, [groups: ["screenplay"]]}
+    cognito: {Screenplay.Ueberauth.Strategy.Fake, [groups: ["screenplay-emergency-admin"]]}
   ]

lib/screenplay_web/auth_manager/auth_manager.ex

@@ -3,9 +3,10 @@ defmodule ScreenplayWeb.AuthManager do
 
   use Guardian, otp_app: :screenplay
 
-  @type access_level :: :none | :read_only | :admin
+  @type access_level :: :none | :read_only | :emergency_admin | :screens_config_admmin
 
-  @screenplay_admin_group "screenplay"
+  @screenplay_admin_group "screenplay-emergency-admin"
+  @screens_admin "screens-admin"
 
   @spec subject_for_token(
           resource :: Guardian.Token.resource(),
@@ -24,11 +25,16 @@ defmodule ScreenplayWeb.AuthManager do
   def resource_from_claims(_), do: {:error, :invalid_claims}
 
   @spec claims_access_level(Guardian.Token.claims()) :: access_level()
-  def claims_access_level(%{"groups" => groups}) do
-    if not is_nil(groups) and @screenplay_admin_group in groups do
-      :admin
-    else
-      :read_only
+  def claims_access_level(%{"groups" => groups}) when not is_nil(groups) do
+    cond do
+      @screenplay_admin_group in groups ->
+        :emergency_admin
+
+      @screens_admin in groups ->
+        :screens_config_admmin
+
+      true ->
+        :read_only
     end
   end
 

lib/screenplay_web/auth_manager/ensure_screenplay_admin_group.ex

@@ -11,7 +11,7 @@ defmodule ScreenplayWeb.EnsureScreenplayAdminGroup do
 
   def call(conn, _opts) do
     with claims <- Guardian.Plug.current_claims(conn),
-         true <- ScreenplayWeb.AuthManager.claims_access_level(claims) == :admin do
+         true <- ScreenplayWeb.AuthManager.claims_access_level(claims) == :emergency_admin do
       conn
     else
       _ ->

lib/screenplay_web/plugs/metadata.ex

@@ -40,6 +40,6 @@ defmodule ScreenplayWeb.Plugs.Metadata do
     claims = Guardian.Plug.current_claims(conn)
 
     not is_nil(claims) and
-      ScreenplayWeb.AuthManager.claims_access_level(claims) == :admin
+      ScreenplayWeb.AuthManager.claims_access_level(claims) == :emergency_admin
   end
 end

test/support/conn_case.ex

@@ -39,7 +39,7 @@ defmodule ScreenplayWeb.ConnCase do
             Phoenix.ConnTest.build_conn()
             |> Plug.Test.init_test_session(%{})
             |> Guardian.Plug.sign_in(ScreenplayWeb.AuthManager, user, %{
-              "groups" => ["screenplay"]
+              "groups" => ["screenplay-emergency-admin"]
             })
             |> Plug.Conn.put_session(:username, user)