from functools import wraps
from flask import session, redirect, url_for, abort
from .config import ROLE_ADMIN, ROLE_DBA, ROLE_CLIENT

def login_required(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        if not session.get("user_id"):
            return redirect(url_for("auth.login"))
        return f(*args, **kwargs)
    return decorated

def role_required(*roles):
    def decorator(f):
        @wraps(f)
        def decorated(*args, **kwargs):
            if session.get("role_id") not in roles:
                return abort(403)
            return f(*args, **kwargs)
        return login_required(decorated)
    return decorator

def admin_required(f):
    return role_required(ROLE_ADMIN)(f)

def client_required(f):
    return role_required(ROLE_CLIENT)(f)

def dba_required(f):
    return role_required(ROLE_DBA)(f)