decorators - Chirp

security.decorators

module

Route protection decorators — @login_required and @requires.

Content-negotiated responses:

Browser requests → redirect to login URL (302)
API requests → JSON error (401/403)

Detection heuristic: a request is considered an API request…

Route protection decorators — @login_required and @requires.

Content-negotiated responses:

Browser requests → redirect to login URL (302)
API requests → JSON error (401/403)

Detection heuristic: a request is considered an API request if it has anAuthorization header or its Acceptheader prefers JSON over HTML.

Usage::

from chirp.security import login_required, requires

@app.route("/dashboard")
@login_required
def dashboard():
    return Template("dashboard.html")

@app.route("/admin")
@requires("admin")
def admin_panel():
    return Template("admin.html")

security.decorators

Name	Type	Default	Description
`type`		—
`qualified_name`		—
`element_type`		—
`description`		—
`source_file`		—
`line_number`		—
`is_autodoc`		—
`autodoc_element`		—
`_autodoc_template`		—
`_autodoc_url_path`		—
`_autodoc_page_type`		—
`title`		—
`doc_content_hash`		—

Symbols on this page

function login_required

Require an authenticated user to access this route.

Browser requests are redirected to the login URL (fromAuthConfig). API requests receive a 401…

function requires

Require specific permissions to access this route.

Returns 401 if not authenticated, 403 if missing permissions.

Usage::

@app.route("/admin") @requires("admin") def admin_panel(): return Template("admin.html") @app.route("/edit")…

login_required

function

def login_required(handler: Callable) -> Callable

Require an authenticated user to access this route.

Browser requests are redirected to the login URL (fromAuthConfig). API requests receive a 401 response.

Usage::

@app.route("/dashboard")
@login_required
def dashboard():
    return Template("dashboard.html")

Parameters

Name	Type	Default	Description
`handler`	`Callable`	—

requires

function

def requires(*permissions: str, policy: Callable[[Any, Any], bool | Awaitable[bool]] | None = None) -> Callable

Require specific permissions to access this route.

Returns 401 if not authenticated, 403 if missing permissions.

Usage::

@app.route("/admin")
@requires("admin")
def admin_panel():
    return Template("admin.html")

@app.route("/edit")
@requires("editor", "moderator")  # needs ALL listed permissions
def edit_post():
    return Template("edit.html")

Parameters

Name	Type	Default	Description
`*permissions`	`str`	—
`policy`	`Callable[[Any, Any], bool \| Awaitable[bool]] \| None`	`None`

View source · /home/runner/work/chirp/chirp/site/../src/chirp/security/decorators.py:1