Check whether a user is allowed to assign privileges. HEAD main

1 files changed, 6 insertions, 0 deletions

diff --git a/gn_libs/privileges/resources.py b/gn_libs/privileges/resources.py
index d2131e9..a605ea4 100644
--- a/gn_libs/privileges/resources.py
+++ b/gn_libs/privileges/resources.py
@@ -78,3 +78,9 @@ can_apply_or_reject_edit = partial(
         "     system:system-wide:inbredset:edit-case-attribute "
         "     system:system-wide:inbredset:apply-case-attribute-edit "
         "     system:system-wide:inbredset:reject-case-attribute-edit)"))
+
+
+def can_assign_role(resource_privileges: tuple[str, ...]) -> bool:
+    """Check whether the current user is allowed to assign roles to other users
+    on given resource."""
+    return check("(AND resource:user:assign-role)", resource_privileges)