decorators

module wittgenstein_oidc_backend.decorators

The has_role decorator.

Usage

@has_role(["admin", "manager"])
def update_access(user: User):
    ...

Reads the current request's decoded token payload from context.get_current_payload() (populated by OidcMiddleware — see context.py) rather than re-parsing the token itself. Works on both sync and async route handlers.

Functions

• has_role — Require the caller's token to carry at least one of roles (checked against the Keycloak realm roles claim, see claims.get_roles). Raises 403 if the token is missing, invalid, or lacks all of the given roles — never a 500.

wittgenstein_oidc_backend.decorators.has_role

has_role(roles: list[str]) → Callable[[F], F]

Require the caller's token to carry at least one of roles (checked against the Keycloak realm roles claim, see claims.get_roles). Raises 403 if the token is missing, invalid, or lacks all of the given roles — never a 500.