Initialize clean CSR inventory repository

inventory/permissions.py

@@ -0,0 +1,37 @@
+from functools import wraps
+from django.contrib.auth.views import redirect_to_login
+from django.core.exceptions import PermissionDenied
+
+from .models import UserProfile
+
+
+def user_role(user) -> str | None:
+    if not getattr(user, "is_authenticated", False):
+        return None
+    if user.is_superuser:
+        return UserProfile.Role.ADMIN
+    profile, _ = UserProfile.objects.get_or_create(user=user)
+    return profile.role
+
+
+def role_required(*roles: str):
+    def decorator(view):
+        @wraps(view)
+        def wrapped(request, *args, **kwargs):
+            if not request.user.is_authenticated:
+                return redirect_to_login(request.get_full_path())
+            if user_role(request.user) not in roles:
+                raise PermissionDenied
+            return view(request, *args, **kwargs)
+
+        return wrapped
+
+    return decorator
+
+
+def can_edit(user) -> bool:
+    return user_role(user) in {UserProfile.Role.ADMIN, UserProfile.Role.EDITOR}
+
+
+def is_admin(user) -> bool:
+    return user_role(user) == UserProfile.Role.ADMIN