Decorator for role requirement in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Flask route with role check?

Consider this Flask route decorated with a role requirement decorator. What will be the HTTP response status code if the user role is 'guest'?

Flask

from flask import Flask, request, abort
app = Flask(__name__)

def role_required(role):
    def decorator(f):
        def wrapper(*args, **kwargs):
            user_role = request.headers.get('Role')
            if user_role != role:
                abort(403)
            return f(*args, **kwargs)
        return wrapper
    return decorator

@app.route('/admin')
@role_required('admin')
def admin_panel():
    return 'Welcome Admin!'

# Assume a request to /admin with header Role: guest

A 200 with body 'Welcome Admin!'

B 403 Forbidden error

C 404 Not Found error

D 500 Internal Server Error

💡 Hint

Think about what happens when the user role does not match the required role.

The decorator checks if the user role matches 'admin'. If not, it calls abort(403), which returns a 403 Forbidden HTTP response.

📝 Syntax

intermediate

Which decorator syntax correctly preserves function metadata?

You want to create a role_required decorator that preserves the original function's name and docstring. Which option correctly uses functools.wraps?

Flask

from functools import wraps

def role_required(role):
    def decorator(f):
        # Choose the correct wrapper implementation
        pass
    return decorator

A

def wrapper(*args, **kwargs):
    if user_role != role:
        abort(403)
    return f(*args, **kwargs)

return wrapper

B

def wrapper(*args, **kwargs):
    if user_role != role:
        abort(403)
    @wraps(f)
    return f(*args, **kwargs)

return wrapper

C

def wrapper(*args, **kwargs):
    @wraps(f)
    if user_role != role:
        abort(403)
    return f(*args, **kwargs)

return wrapper

D

@wraps(f)
def wrapper(*args, **kwargs):
    if user_role != role:
        abort(403)
    return f(*args, **kwargs)

return wrapper

💡 Hint

functools.wraps is used as a decorator on the wrapper function.

Option D correctly applies @wraps(f) above the wrapper function definition to preserve metadata.

🔧 Debug

advanced

Why does this role_required decorator cause a runtime error?

Examine this decorator code. What causes the runtime error when calling the decorated function?

Flask

def role_required(role):
    def decorator(f):
        def wrapper(*args, **kwargs):
            user_role = request.headers.get('Role')
            if user_role != role:
                abort(403)
            return f
        return wrapper
    return decorator

A The decorator does not accept *args and **kwargs, causing a TypeError.

B The abort function is called without importing it, causing a NameError.

C The wrapper returns the function object f instead of calling it, causing a TypeError later.

D The user_role variable is not defined, causing a NameError.

💡 Hint

Look at what the wrapper returns after the role check.

The wrapper returns the function f itself instead of calling it with arguments. This causes the caller to get a function object instead of the expected response, leading to errors.

🧠 Conceptual

advanced

What is the main purpose of using a decorator for role requirement in Flask?

Why do developers use decorators like role_required in Flask applications?

A To add reusable access control logic to routes without repeating code.

B To automatically generate HTML templates for different user roles.

C To improve database query performance by caching role data.

D To replace Flask's built-in routing system with custom routing.

💡 Hint

Think about how decorators help with code reuse and separation of concerns.

Decorators allow adding access control checks to routes cleanly and reuse the logic across many routes.

❓ state_output

expert

What is the output of this Flask app with nested role_required decorators?

Given this Flask app code, what will be the response body when a request with header Role: admin accesses /dashboard?

Flask

from flask import Flask, request, abort
app = Flask(__name__)

def role_required(role):
    def decorator(f):
        def wrapper(*args, **kwargs):
            user_role = request.headers.get('Role')
            if user_role != role:
                abort(403)
            return f(*args, **kwargs)
        return wrapper
    return decorator

@app.route('/dashboard')
@role_required('admin')
@role_required('user')
def dashboard():
    return 'Dashboard Accessed'

# Request header: Role: admin

A 403 Forbidden error

B 200 OK with body 'Dashboard Accessed'

C 500 Internal Server Error

D 404 Not Found error

💡 Hint

Consider the order decorators are applied and how role checks happen.

Decorators apply bottom-up. The inner role_required('user') checks if role is 'user'. The request has role 'admin', so it aborts with 403 before reaching the outer decorator.