06/15 Phase 1 + 2 codes

app/utils/__init__.py

@@ -0,0 +1,41 @@
+"""RBAC decorators. Never trust the client; gate on server side."""
+from functools import wraps
+from flask import abort
+from flask_login import current_user
+from app.models.enums import Role
+
+
+def role_required(*roles):
+    """Require the current user to hold one of the given roles."""
+    def decorator(fn):
+        @wraps(fn)
+        def wrapper(*args, **kwargs):
+            if not current_user.is_authenticated:
+                abort(401)
+            if current_user.role not in roles:
+                abort(403)
+            return fn(*args, **kwargs)
+        return wrapper
+    return decorator
+
+
+def admin_required(fn):
+    @wraps(fn)
+    def wrapper(*args, **kwargs):
+        if not current_user.is_authenticated:
+            abort(401)
+        if not current_user.is_admin:
+            abort(403)
+        return fn(*args, **kwargs)
+    return wrapper
+
+
+def moderator_required(fn):
+    @wraps(fn)
+    def wrapper(*args, **kwargs):
+        if not current_user.is_authenticated:
+            abort(401)
+        if not current_user.is_moderator:
+            abort(403)
+        return fn(*args, **kwargs)
+    return wrapper