1 files changed, 40 insertions, 0 deletions
diff --git a/gn_auth/migrations/auth/20260825_01_4uVPR-add-privilege-system-user-list-to-the-resource-owner-role.py b/gn_auth/migrations/auth/20260825_01_4uVPR-add-privilege-system-user-list-to-the-resource-owner-role.py
new file mode 100644
index 0000000..89d2d0d
--- /dev/null
+++ b/gn_auth/migrations/auth/20260825_01_4uVPR-add-privilege-system-user-list-to-the-resource-owner-role.py
@@ -0,0 +1,40 @@
+"""
+Add privilege `system:user:list` to the `resource-owner` role.
+
+The resource-owner needs to be able to list the users in the system in order to
+actually select which user they want to assign a particular role to.
+"""
+import contextlib
+
+from yoyo import step
+
+__depends__ = {'20260428_02_L6zIV-add-privileges-to-batch-editors-role'}
+
+
+def fetch_resource_owner_role_id(cursor):
+    cursor.execute("SELECT role_id FROM roles WHERE role_name='resource-owner'")
+    return cursor.fetchone()[0]
+
+
+def assign_system_user_list_to_resource_owner(conn):
+    """Assign the 'system:user:list' privilege to the 'resource-owner' role."""
+    with contextlib.closing(conn.cursor()) as cursor:
+        cursor.execute(
+            "INSERT INTO role_privileges(role_id, privilege_id) "
+            "VALUES (?, ?) "
+            "ON CONFLICT (role_id, privilege_id) DO NOTHING",
+            (fetch_resource_owner_role_id(cursor), "system:user:list"))
+
+
+def revoke_system_user_list_from_resource_owner(conn):
+    """Revoke the 'system:user:list' privilege from the 'resource-owner' role."""
+    with contextlib.closing(conn.cursor()) as cursor:
+        cursor.execute(
+            "DELETE FROM role_privileges "
+            "WHERE role_id=? AND privilege_id=?",
+            (fetch_resource_owner_role_id(cursor), "system:user:list"))
+
+steps = [
+    step(assign_system_user_list_to_resource_owner,
+         revoke_system_user_list_from_resource_owner)
+]