"""Administration authorization helpers.

Every admin route must be restricted to Super Admin accounts. The
:func:`admin_required` decorator composes with (and assumes) an authenticated
session; use it together with ``login_required``.
"""

from __future__ import annotations

from functools import wraps

from flask import abort
from flask_login import current_user

from app.models.enums import UserRole


def admin_required(view):
    """Allow only authenticated Super Admin users; otherwise abort with 403."""

    @wraps(view)
    def wrapped(*args, **kwargs):
        if not current_user.is_authenticated:
            abort(401)
        if current_user.role != UserRole.SUPER_ADMIN:
            abort(403)
        return view(*args, **kwargs)

    return wrapped