如何在Flask中实现基于角色的访问控制？

# 示例：定义角色和权限
roles = {
    'admin': ['create', 'read', 'update', 'delete'],
    'editor': ['read', 'update'],
    'viewer': ['read']
}

from functools import wraps
from flask import Flask, request, jsonify

app = Flask(__name__)

def requires_permission(permission):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            user_role = get_user_role()  # 需要实现这个函数来获取当前用户的角色
            if permission in roles.get(user_role, []):
                return f(*args, **kwargs)
            else:
                return jsonify({"error": "Permission denied"}), 403
        return decorated_function
    return decorator

@app.route('/create', methods=['POST'])
@requires_permission('create')
def create_resource():
    # 创建资源的逻辑
    return jsonify({"message": "Resource created"})

def get_user_role():
    # 这里应该包含从会话或数据库中获取用户角色的逻辑
    # 示例：假设我们从请求头中获取角色信息
    return request.headers.get('User-Role', 'viewer')