def has_scope(scope, have_scopes, *, post_filter=False, db=None):
    """Boolean function for whether we have a given scope

    Args:
        scope (str): a single scope
        have_scopes: parsed_scopes dict or expanded_scopes set
        post_filter (bool):
            Allows returning true if _some_ access is granted,
            if not full access.
            Only allowed if scope has no filter
        db (optional): the db session
            Required to check group membership,
            unused otherwise
    Returns:
        True if access is allowed, False otherwise.
        If post_filer is True and have_scopes contains _filtered_ access,
        will return True, assuming filtered-access will be handled later
        (e.g. in the listing-users handler)
    """
    req_scope, _, full_filter = scope.partition("!")
    filter_, _, filter_value = full_filter.partition("=")
    if filter_ and not filter_value:
        raise ValueError(
            f"Unexpanded scope filter {scope} not allowed. Use expanded scopes."
        )

    if isinstance(have_scopes, dict):
        parsed_scopes = have_scopes
    else:
        parsed_scopes = parse_scopes(have_scopes)

    if req_scope not in parsed_scopes:
        return False
    have_scope_filters = parsed_scopes[req_scope]
    if have_scope_filters == Scope.ALL:
        # access to all resources
        return True

    if not filter_:
        if post_filter:
            # allow filtering after the fact
            return True
        else:
            return False

    if post_filter:
        raise ValueError("post_filter=True only allowed for unfiltered scopes")
    _db_used = False

    if filter_ in have_scope_filters and filter_value in have_scope_filters[filter_]:
        return True

    # server->user
    if filter_ == "server" and "user" in have_scope_filters:
        user_name = filter_value.partition("/")[0]
        if user_name in have_scope_filters["user"]:
            return True

    if db and _needs_group_expansion(filter_, filter_value, have_scope_filters):
        _db_used = True
        if filter_ == "user":
            user_name = filter_value
        elif filter_ == "server":
            user_name = filter_value.partition("/")[0]
        else:
            raise ValueError(
                f"filter_ should be 'user' or 'server' here, not {filter_!r}"
            )
        group_names = have_scope_filters['group']
        have_group_query = (
            db.query(orm.Group.name)
            .join(orm.User.groups)
            .filter(orm.User.name == user_name)
            .filter(orm.Group.name.in_(group_names))
        )
        if have_group_query.count() > 0:
            return DoNotCache(True)

    if _db_used:
        return DoNotCache(False)
    else:
        return False
Boolean function for whether we have a given scope

Args:
scope (str): a single scope
have_scopes: parsed_scopes dict or expanded_scopes set
post_filter (bool):
Allows returning true if _some_ access is granted,
if not full access.
Only allowed if scope has no filter
db (optional): the db session
Required to check group membership,
unused otherwise
Returns:
True if access is allowed, False otherwise.
If post_filer is True and have_scopes contains _filtered_ access,
will return True, assuming filtered-access will be handled later
(e.g. in the listing-users handler)
jupyterhub/scopes.py