+
+def require_admin_or_moderator_login(controller):
+ """
+ Require a login from an administrator or a moderator.
+ """
+ @wraps(controller)
+ def new_controller_func(request, *args, **kwargs):
+ if request.user and \
+ not (request.user.has_privilege(u'admin')
+ or request.user.has_privilege(u'moderator')):
+
+ raise Forbidden()
+ elif not request.user:
+ next_url = urljoin(
+ request.urlgen('mediagoblin.auth.login',
+ qualified=True),
+ request.url)
+
+ return redirect(request, 'mediagoblin.auth.login',
+ next=next_url)
+
+ return controller(request, *args, **kwargs)
+
+ return new_controller_func
+
+
+
+def oauth_required(controller):
+ """ Used to wrap API endpoints where oauth is required """
+ @wraps(controller)
+ def wrapper(request, *args, **kwargs):
+ data = request.headers
+ authorization = decode_authorization_header(data)
+
+ if authorization == dict():
+ error = "Missing required parameter."
+ return json_response({"error": error}, status=400)
+
+
+ request_validator = GMGRequestValidator()
+ resource_endpoint = ResourceEndpoint(request_validator)
+ valid, r = resource_endpoint.validate_protected_resource_request(
+ uri=request.url,
+ http_method=request.method,
+ body=request.data,
+ headers=dict(request.headers),
+ )
+
+ if not valid:
+ error = "Invalid oauth parameter."
+ return json_response({"error": error}, status=400)
+
+ # Fill user if not already
+ token = authorization[u"oauth_token"]
+ request.access_token = AccessToken.query.filter_by(token=token).first()
+ if request.access_token is not None and request.user is None:
+ user_id = request.access_token.actor
+ request.user = LocalUser.query.filter_by(id=user_id).first()
+
+ return controller(request, *args, **kwargs)
+
+ return wrapper