"""Flask route decorators for authentication."""

from functools import wraps

from flask import g, jsonify


def require_auth(f):
    """Decorator for routes that require an authenticated user.

    Use this when init_auth() is not applied globally, or as an
    explicit marker on routes that need auth.

    Usage:
        @app.route("/api/projects")
        @require_auth
        def list_projects():
            user = get_current_user()
            ...
    """

    @wraps(f)
    def decorated(*args, **kwargs):
        user = getattr(g, "user", None)
        if user is None:
            return jsonify({"error": "Not authenticated"}), 401
        return f(*args, **kwargs)

    return decorated
