New check: Can create a resource-specific role.

1 files changed, 8 insertions, 0 deletions

diff --git a/gn_libs/privileges/resources.py b/gn_libs/privileges/resources.py
index 217a57d..2634357 100644
--- a/gn_libs/privileges/resources.py
+++ b/gn_libs/privileges/resources.py
@@ -27,6 +27,14 @@ can_edit = partial(
         "(OR "
         "  (AND system:system-wide:data:view system:system-wide:data:edit))"))
 
+can_create_resource_role = partial(
+    privileges_fulfill_specs,
+    resource_spec=(
+        "(AND group:resource:view-resource resource:role:create-role)"),
+    system_spec=(
+        "(OR "
+        "  (AND system:system-wide:data:view system:system-wide:resource:role:create))"))
+
 
 def can_batch_edit(queried_privileges: tuple[str, ...]) -> bool:
     """Check whether user has batch-editing privileges."""