Add a staff_area_access permission

We'll eventually replace checks against the `StaffAreaAdministrator`
role with checks against this permission.

Author: StevenMaude

jobserver/authorization/permissions.py

@@ -10,6 +10,7 @@
 repo_sign_off_with_outputs = "repo_sign_off_with_outputs"
 snapshot_create = "snapshot_create"
 snapshot_publish = "snapshot_publish"
+staff_area_access = "staff_area_access"
 unreleased_outputs_view = "unreleased_outputs_view"
 user_manage = "user_manage"
 workspace_archive = "workspace_archive"

jobserver/authorization/roles.py

@@ -11,6 +11,7 @@
     repo_sign_off_with_outputs,
     snapshot_create,
     snapshot_publish,
+    staff_area_access,
     unreleased_outputs_view,
     user_manage,
     workspace_archive,
@@ -33,6 +34,7 @@ class StaffAreaAdministrator:
         backend_manage,
         org_create,
         user_manage,
+        staff_area_access,
     ]
 
 

tests/unit/jobserver/api/test_jobs.py

@@ -889,6 +889,7 @@ def test_userapidetail_success(api_rf, project_membership):
         "application_manage",
         "backend_manage",
         "org_create",
+        "staff_area_access",
         "user_manage",
     ]