From 75f70a195b8141bc5258f6531eeea4d4224c0147 Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Thu, 27 Aug 2026 09:40:00 -0500
Subject: Check whether a user is allowed to assign privileges.

---
 gn_libs/privileges/resources.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/gn_libs/privileges/resources.py b/gn_libs/privileges/resources.py
index d2131e9..a605ea4 100644
--- a/gn_libs/privileges/resources.py
+++ b/gn_libs/privileges/resources.py
@@ -78,3 +78,9 @@ can_apply_or_reject_edit = partial(
         "     system:system-wide:inbredset:edit-case-attribute "
         "     system:system-wide:inbredset:apply-case-attribute-edit "
         "     system:system-wide:inbredset:reject-case-attribute-edit)"))
+
+
+def can_assign_role(resource_privileges: tuple[str, ...]) -> bool:
+    """Check whether the current user is allowed to assign roles to other users
+    on given resource."""
+    return check("(AND resource:user:assign-role)", resource_privileges)
-- 
cgit 1.4.1