admin / Syanpse-Vanguard

"""RBAC guard used on every protected endpoint. Usage:

    @app.get("/v1/search")
    async def search(user: User = Depends(requires(Permission.LOG_READ))): ...
"""
from __future__ import annotations

from fastapi import Depends, HTTPException, status

from sv.auth.rbac import Permission, can
from sv.auth.session import User, current_user


def requires(permission: Permission):
    async def _dep(user: User = Depends(current_user)) -> User:
        if not can(user.role, permission):
            raise HTTPException(
                status.HTTP_403_FORBIDDEN,
                f"role {user.role.value} lacks {permission.value}",
            )
        return user

    return _dep