auth.py

from functools import wraps
from flask import request, jsonify
from flask_jwt_extended import verify_jwt_in_request, get_jwt_identity, get_jwt
from models import User, UserRole

def require_auth(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        try:
            verify_jwt_in_request()
            return f(*args, **kwargs)
        except Exception as e:
            return jsonify({'error': 'Authentication required'}), 401
    return decorated_function

def require_role(required_role):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            try:
                verify_jwt_in_request()
                current_user_id = get_jwt_identity()
                user = User.query.get(current_user_id)
                
                if not user:
                    return jsonify({'error': 'User not found'}), 404
                
                if user.role != required_role:
                    return jsonify({'error': 'Insufficient permissions'}), 403
                
                return f(*args, **kwargs)
            except Exception as e:
                return jsonify({'error': 'Authentication required'}), 401
        return decorated_function
    return decorator

def get_current_user():
    try:
        verify_jwt_in_request()
        current_user_id = get_jwt_identity()
        return User.query.get(current_user_id)
    except:
        return None

def can_access_project(user, project):
    """Check if user can access a project"""
    if user.role == UserRole.ADMIN:
        return True
    if user.role == UserRole.PROJECT_MANAGER and project.owner_id == user.id:
        return True
    # Coordinators can access projects if they have tasks assigned
    if user.role == UserRole.COORDINATOR:
        return any(task.assignee_id == user.id for task in project.tasks)
    return False

def can_manage_users(user):
    """Check if user can manage other users"""
    return user.role == UserRole.ADMIN

def can_create_projects(user):
    """Check if user can create projects"""
    return user.role in [UserRole.ADMIN, UserRole.PROJECT_MANAGER]

def can_assign_tasks(user, project):
    """Check if user can assign tasks in a project"""
    if user.role == UserRole.ADMIN:
        return True
    return user.role == UserRole.PROJECT_MANAGER and project.owner_id == user.id