1 files changed, 44 insertions, 0 deletions
diff --git a/gn_auth/migrations/auth/20260826_01_6Hzl8-add-system-user-create-user-privilege-to-system-administrator-role.py b/gn_auth/migrations/auth/20260826_01_6Hzl8-add-system-user-create-user-privilege-to-system-administrator-role.py
new file mode 100644
index 0000000..50e448f
--- /dev/null
+++ b/gn_auth/migrations/auth/20260826_01_6Hzl8-add-system-user-create-user-privilege-to-system-administrator-role.py
@@ -0,0 +1,44 @@
+"""
+Add 'system:user:create-user' privilege to 'system-administrator' role.
+"""
+import contextlib
+
+from yoyo import step
+
+__depends__ = {'20260825_01_4uVPR-add-privilege-system-user-list-to-the-resource-owner-role'}
+
+
+def fetch_system_admin_role_id(cursor):
+    cursor.execute("SELECT role_id FROM roles WHERE role_name='system-administrator'")
+    return cursor.fetchone()[0]
+
+
+def assign_system_user_create_user_to_sys_admin(conn):
+    """Assign the 'system:user:create-user' privilege to the 'system-administrator' role."""
+    with contextlib.closing(conn.cursor()) as cursor:
+        cursor.execute(
+            "INSERT INTO role_privileges(role_id, privilege_id) "
+            "VALUES (?, ?) "
+            "ON CONFLICT (role_id, privilege_id) DO NOTHING",
+            (fetch_system_admin_role_id(cursor), "system:user:create-user"))
+
+
+def revoke_system_user_create_user_from_sys_admin(conn):
+    """Revoke the 'system:user:create-user' privilege from the 'system-administrator' role."""
+    with contextlib.closing(conn.cursor()) as cursor:
+        cursor.execute(
+            "DELETE FROM role_privileges "
+            "WHERE role_id=? AND privilege_id=?",
+            (fetch_system_admin_role_id(cursor), "system:user:create-user"))
+
+
+steps = [
+    step(
+        """
+        INSERT INTO privileges(privilege_id, privilege_description)
+        VALUES('system:user:create-user', 'Create a user for the system')
+        """,
+        "DELETE FROM privileges WHERE privilege_id='system:user:create-user'"),
+    step(assign_system_user_create_user_to_sys_admin,
+         revoke_system_user_create_user_from_sys_admin)
+]