用户权限管理如何搭建

from flask import Flask, request, jsonify
from functools import wraps

app = Flask(__name__)

# 模拟用户数据库
users = {
    'user1': {'password': 'pass1', 'role': 'admin'},
    'user2': {'password': 'pass2', 'role': 'user'}
}

# 权限规则
roles = {
    'admin': ['read', 'write'],
    'user': ['read']
}

def require_role(role):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            username = request.authorization.username
            user = users.get(username)
            if user and user['role'] == role:
                return f(*args, **kwargs)
            else:
                return jsonify({'message': 'Unauthorized'}), 403
        return decorated_function
    return decorator

@app.route('/read')
@require_role('user')
def read():
    return jsonify({'message': 'Read successful'})

@app.route('/write')
@require_role('admin')
def write():
    return jsonify({'message': 'Write successful'})

if __name__ == '__main__':
    app.run(debug=True)