diff --git a/migrations/auth/20260428_02_L6zIV-add-privileges-to-batch-editors-role.py b/migrations/auth/20260428_02_L6zIV-add-privileges-to-batch-editors-role.py
new file mode 100644
index 0000000..537bf9b
--- /dev/null
+++ b/migrations/auth/20260428_02_L6zIV-add-privileges-to-batch-editors-role.py
@@ -0,0 +1,62 @@
+"""
+Add privileges to batch-editors role
+"""
+import contextlib
+
+from yoyo import step
+
+__depends__ = {'20260428_01_Tak6O-new-privilege-system-system-wide-data-view'}
+
+
+def fetch_batch_editors_role_id(cursor):
+ """Fetch the ID of the batch-editors role."""
+ cursor.execute("SELECT role_id FROM roles WHERE role_name='Batch Editors'")
+ res = cursor.fetchone()
+ if not bool(res):
+ cursor.execute(
+ "SELECT role_id FROM roles WHERE role_name='batch-editors'")
+ res = cursor.fetchone()
+
+ return res[0] if bool(res) else None
+
+
+def rename_role(conn):
+ """Rename role from 'Batch Editors' to 'batch-editors'."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ cursor.execute(
+ "UPDATE roles SET role_name='batch-editors' WHERE role_id=?",
+ (fetch_batch_editors_role_id(cursor),))
+
+
+def restore_old_role_name(conn):
+ """Rename role from 'batch-editors' to 'Batch Editors'."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ cursor.execute(
+ "UPDATE roles SET role_name='Batch Editors' WHERE role_id=?",
+ (fetch_batch_editors_role_id(cursor),))
+
+
+def add_new_privileges(conn):
+ """Add new privileges to 'batch-editors' role."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ role_id = fetch_batch_editors_role_id(cursor)
+ cursor.executemany(
+ "INSERT INTO role_privileges(role_id, privilege_id) VALUES(?, ?)",
+ tuple((role_id, priv) for priv in (
+ "system:system-wide:data:view",
+ "system:system-wide:data:edit")))
+
+
+def remove_new_privileges(conn):
+ """Remove new privileges from 'batch-editors' role."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ cursor.execute(
+ "DELETE FROM role_privileges WHERE role_id=? AND privilege_id IN "
+ "('system:system-wide:data:view', 'system:system-wide:data:edit')",
+ (fetch_batch_editors_role_id(cursor),))
+
+
+steps = [
+ step(rename_role, restore_old_role_name),
+ step(add_new_privileges, remove_new_privileges)
+]
|
