How to make sure all requests have permission?

Question

I have a flask application and I have created a custom decorator that checks some header information for permission on controllers.py.

app.py

app = Flask(__name__)

if __name__ == "__main__":
   app.run(host='0.0.0.0', port=80)

controllers.py

@route('/')
@custom_decorator
def get():
   pass


@route('/id')
def get_id():
   pass

On this case, see that I forgot to use my decorator on the second method. There is any way I can guarantee that If I forget my decorator a exception would be throw? In the case of a new dev in the team forget to use the decorator or something like that.
Is there any way I can do something with the request before it hit the controllers?

Why not make a decorator that merges functionality of `route` and `custom_decorator`? — matszwecja, Aug 22 '22 at 14:55
The route one is from `Blueprint`. Not sure If I can override it behavior. `from flask import Blueprint`. — RonanFelipe, Aug 22 '22 at 17:02
I did use the `before_request()` method from flask. [Docs here](https://flask.palletsprojects.com/en/2.2.x/api/#flask.Flask.before_request) — RonanFelipe, Aug 26 '22 at 17:31

Robin Uphoff · Answer 1 · 2022-08-23T07:20:06.607

You could merge the decorators and check if the name of some function is passed as an argument.

def composed(*decs):
    def deco(f):
        is_decorated = False
        for dec in decs:
            if 'custom_decorator' in dec.__qualname__.split('.'):
                is_decorated = True
            f = dec(f)
        if not is_decorated:
            raise SomeError
        return f
    return deco


@composed(blueprint.route('/'), custom_decorator)
def get():
   pass

For further reading you can check this question about how to merge decorators in python.

How to make sure all requests have permission?

1 Answers1