Jun 27 MT-4

control/panel/decorators.py

@@ -0,0 +1,30 @@
+"""
+control/panel/decorators.py
+----------------------------
+Access-control decorator for the superadmin control panel (MT-4).
+"""
+
+from functools import wraps
+from flask import session, redirect, url_for, request, flash
+
+from control.base import control_session
+from control.models import Superadmin
+
+
+def superadmin_required(f):
+    """Redirect to /login if the session has no valid superadmin."""
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        sa_id = session.get('sa_id')
+        if not sa_id:
+            flash('Please log in.', 'warning')
+            return redirect(url_for('auth.login', next=request.path))
+        # Re-validate: account might have been deactivated since login.
+        with control_session() as s:
+            sa = s.get(Superadmin, sa_id)
+            if sa is None or not sa.active:
+                session.clear()
+                flash('Your superadmin account is no longer active.', 'danger')
+                return redirect(url_for('auth.login'))
+        return f(*args, **kwargs)
+    return decorated