code: def get_roles_for_permission(permission, brain_or_object):
      
      obj = api.get_object(brain_or_object)
      valid_roles = get_valid_roles_for(obj)
      for item in obj.ac_inherited_permissions(1):
          name, value = item[:2]
          # found the requested permission
          if name == permission:
              # Permission maps a named permission to a set of attribute names
              permission = Permission(name, value, obj)
              roles = permission.getRoles()
              # return only valid roles that have the permission granted
              return filter(lambda r: r in valid_roles, roles)
      # Raise an error if the permission is invalid
      raise ValueError("The permission {} is invalid.".format(permission))
docs: Return the roles of the permission that is granted on the object
  
      Code extracted from `IRoleManager.rolesOfPermission`
  
      :param permission: The permission to get the roles
      :param brain_or_object: Catalog brain or object
      :returns: List of roles having the permission