"""Authorization helpers for operations that control host processes."""
from functools import wraps

from flask import abort
from flask_login import current_user, login_required


def system_admin_required(view):
    """Restrict process-control operations to authenticated administrators."""
    @wraps(view)
    @login_required
    def wrapped(*args, **kwargs):
        if not current_user.is_admin():
            abort(403)
        return view(*args, **kwargs)

    return wrapped