bump project

app/services/security.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from functools import wraps
+from typing import TypeVar
+
+from flask import abort
+from flask_login import current_user, login_required
+
+from app.models import Role
+
+F = TypeVar("F", bound=Callable)
+
+
+def roles_required(*roles: str | Role) -> Callable[[F], F]:
+    allowed_roles = {role.value if isinstance(role, Role) else role for role in roles}
+
+    def decorator(view: F) -> F:
+        @wraps(view)
+        @login_required
+        def wrapped(*args, **kwargs):
+            if not current_user.is_authenticated or current_user.role not in allowed_roles:
+                abort(403)
+            return view(*args, **kwargs)
+
+        return wrapped  # type: ignore[return-value]
+
+    return decorator