53 lines
1.4 KiB
Python
53 lines
1.4 KiB
Python
"""RBAC decorators and shared request utilities."""
|
|
from functools import wraps
|
|
from urllib.parse import urlparse
|
|
from flask import abort, request
|
|
from flask_login import current_user
|
|
from app.models.enums import Role
|
|
|
|
|
|
def safe_referrer(fallback: str) -> str:
|
|
"""Return request.referrer only when it is same-origin; else fallback."""
|
|
ref = request.referrer
|
|
if ref:
|
|
parsed = urlparse(ref)
|
|
if parsed.netloc in ("", request.host):
|
|
return ref
|
|
return fallback
|
|
|
|
|
|
def role_required(*roles):
|
|
"""Require the current user to hold one of the given roles."""
|
|
def decorator(fn):
|
|
@wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
if not current_user.is_authenticated:
|
|
abort(401)
|
|
if current_user.role not in roles:
|
|
abort(403)
|
|
return fn(*args, **kwargs)
|
|
return wrapper
|
|
return decorator
|
|
|
|
|
|
def admin_required(fn):
|
|
@wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
if not current_user.is_authenticated:
|
|
abort(401)
|
|
if not current_user.is_admin:
|
|
abort(403)
|
|
return fn(*args, **kwargs)
|
|
return wrapper
|
|
|
|
|
|
def moderator_required(fn):
|
|
@wraps(fn)
|
|
def wrapper(*args, **kwargs):
|
|
if not current_user.is_authenticated:
|
|
abort(401)
|
|
if not current_user.is_moderator:
|
|
abort(403)
|
|
return fn(*args, **kwargs)
|
|
return wrapper
|