diff --git a/migrations/auth/20260331_01_FV1sL-add-privileges-to-role-systemwide-data-curator.py b/migrations/auth/20260331_01_FV1sL-add-privileges-to-role-systemwide-data-curator.py
new file mode 100644
index 0000000..22863ae
--- /dev/null
+++ b/migrations/auth/20260331_01_FV1sL-add-privileges-to-role-systemwide-data-curator.py
@@ -0,0 +1,69 @@
+"""
+Add privileges to role systemwide-data-curator
+"""
+import contextlib
+
+from yoyo import step
+
+__depends__ = {'20260311_03_vxBCX-restrict-access-to-resources-make-public-feature'}
+
+
+__new_privileges__ = (
+ ("system:system-wide:inbredset:view-case-attribute",
+ "Enable view of any and all inbredset case attributes system-wide."),
+ ("system:system-wide:inbredset:edit-case-attribute",
+ "Enable edit of any and all inbredset case attributes system-wide."),
+ ("system:system-wide:inbredset:delete-case-attribute",
+ "Enable deletion of any and all inbredset case attributes system-wide."),
+ ("system:system-wide:inbredset:apply-case-attribute-edit",
+ "Enable applying changes to any and all inbredset case attributes system-wide."),
+ ("system:system-wide:inbredset:reject-case-attribute-edit",
+ "Enable rejecting changes to any and all inbredset case attributes system-wide."))
+
+
+def fetch_systemwide_data_curator_role_id(cursor):
+ "Fetch the role's ID."
+ cursor.execute("SELECT role_id FROM roles "
+ "WHERE role_name='systemwide-data-curator'")
+ return cursor.fetchone()[0]
+
+
+def create_new_privileges(conn):
+ """Create new privileges for the system."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ cursor.executemany(
+ "INSERT INTO privileges(privilege_id, privilege_description) "
+ "VALUES (?, ?)",
+ __new_privileges__)
+
+
+def delete_new_privileges(conn):
+ """Delete these new privileges from the system."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ cursor.executemany("DELETE FROM privileges WHERE privilege_id=?",
+ tuple((priv[0],) for priv in __new_privileges__))
+
+
+def assign_new_privileges(conn):
+ """Assign the new privileges to the `systemwide-data-curator` role."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ role_id = fetch_systemwide_data_curator_role_id(cursor)
+ cursor.executemany(
+ "INSERT INTO role_privileges(role_id, privilege_id) VALUES (?, ?)",
+ tuple((role_id, privilege[0]) for privilege in __new_privileges__))
+
+
+def revoke_new_privileges(conn):
+ """Revoke the new privileges from the `systemwide-data-curator` role."""
+ with contextlib.closing(conn.cursor()) as cursor:
+ role_id = fetch_systemwide_data_curator_role_id(cursor)
+ cursor.executemany(
+ "DELETE FROM role_privileges WHERE role_id=? AND privilege_id=?",
+ tuple((role_id, privilege[0]) for privilege in __new_privileges__))
+
+
+
+steps = [
+ step(create_new_privileges, delete_new_privileges),
+ step(assign_new_privileges, revoke_new_privileges)
+]
|
