"""Authorization helpers for operations that control host processes."""
from functools import wraps

from flask import abort
from flask_login import current_user, login_required
from .authorization import has_permission


def system_admin_required(view):
    """Restrict process-control operations to authenticated administrators."""
    @wraps(view)
    @login_required
    def wrapped(*args, **kwargs):
        if not has_permission("system.configure", current_user):
            abort(403)
        return view(*args, **kwargs)

    return wrapped