06/15 Phase 4 + 5 codes

app/utils/__init__.py

@@ -1,21 +1,10 @@
-"""RBAC decorators and shared request utilities."""
+"""RBAC decorators. Never trust the client; gate on server side."""
 from functools import wraps
-from urllib.parse import urlparse
-from flask import abort, request
+from flask import abort
 from flask_login import current_user
 from app.models.enums import Role
 
 
-def safe_referrer(fallback: str) -> str:
-    """Return request.referrer only when it is same-origin; else fallback."""
-    ref = request.referrer
-    if ref:
-        parsed = urlparse(ref)
-        if parsed.netloc in ("", request.host):
-            return ref
-    return fallback
-
-
 def role_required(*roles):
     """Require the current user to hold one of the given roles."""
     def decorator(fn):