42 lines
1.1 KiB
Python
42 lines
1.1 KiB
Python
"""RBAC decorators. Never trust the client; gate on server side."""
|
|
from functools import wraps
|
|
from flask import abort
|
|
from flask_login import current_user
|
|
from app.models.enums import Role
|
|
|
|
|
|
def role_required(*roles):
|
|
"""Require the current user to hold one of the given roles."""
|
|
def decorator(fn):
|
|
@wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
if not current_user.is_authenticated:
|
|
abort(401)
|
|
if current_user.role not in roles:
|
|
abort(403)
|
|
return fn(*args, **kwargs)
|
|
return wrapper
|
|
return decorator
|
|
|
|
|
|
def admin_required(fn):
|
|
@wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
if not current_user.is_authenticated:
|
|
abort(401)
|
|
if not current_user.is_admin:
|
|
abort(403)
|
|
return fn(*args, **kwargs)
|
|
return wrapper
|
|
|
|
|
|
def moderator_required(fn):
|
|
@wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
if not current_user.is_authenticated:
|
|
abort(401)
|
|
if not current_user.is_moderator:
|
|
abort(403)
|
|
return fn(*args, **kwargs)
|
|
return wrapper
|