from collections.abc import Callable
from functools import wraps
from typing import Any

from flask import abort
from flask_login import current_user


TASK_EDITOR_ROLES = ("user", "admin", "coach")


def roles_required(*allowed_roles: str):
    """Require an authenticated user's role to match an explicit allow-list."""

    def decorator(view: Callable[..., Any]) -> Callable[..., Any]:
        @wraps(view)
        def wrapped(*args: Any, **kwargs: Any):
            if current_user.role not in allowed_roles:
                abort(403)
            return view(*args, **kwargs)

        return wrapped

    return decorator