From 7fceaa61ddc2e42a4772d7979e6ff570e12091f1 Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Thu, 20 Aug 2026 09:18:43 -0500
Subject: New check: Can create a resource-specific role.

---
 gn_libs/privileges/resources.py | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'gn_libs')

diff --git a/gn_libs/privileges/resources.py b/gn_libs/privileges/resources.py
index 217a57d..2634357 100644
--- a/gn_libs/privileges/resources.py
+++ b/gn_libs/privileges/resources.py
@@ -27,6 +27,14 @@ can_edit = partial(
         "(OR "
         "  (AND system:system-wide:data:view system:system-wide:data:edit))"))
 
+can_create_resource_role = partial(
+    privileges_fulfill_specs,
+    resource_spec=(
+        "(AND group:resource:view-resource resource:role:create-role)"),
+    system_spec=(
+        "(OR "
+        "  (AND system:system-wide:data:view system:system-wide:resource:role:create))"))
+
 
 def can_batch_edit(queried_privileges: tuple[str, ...]) -> bool:
     """Check whether user has batch-editing privileges."""
-- 
cgit 1.4.1