from django.http import HttpResponseForbidden
from functools import wraps

# ✅ For single-role protection
def role_required(required_role):
    def decorator(view_func):
        @wraps(view_func)
        def _wrapped_view(request, *args, **kwargs):
            if not request.user.is_authenticated:
                return HttpResponseForbidden("Login required.")
            if request.user.role != required_role:
                return HttpResponseForbidden("Access denied.")
            return view_func(request, *args, **kwargs)
        return _wrapped_view
    return decorator

# ✅ For multi-role protection
def roles_required(*allowed_roles):
    def decorator(view_func):
        @wraps(view_func)
        def _wrapped_view(request, *args, **kwargs):
            if not request.user.is_authenticated:
                return HttpResponseForbidden("Login required.")
            if request.user.role not in allowed_roles:
                return HttpResponseForbidden("Access denied.")
            return view_func(request, *args, **kwargs)
        return _wrapped_view
    return decorator