def must_be_valid_project(func=None, retractions_valid=False):
 def must_be_valid_project_inner(func):
  @functools.wraps(func)
  def wrapped(*args, **kwargs):
   _inject_nodes(kwargs)
   if getattr(kwargs['node'], 'is_collection', True):
    raise HTTPError(http.NOT_FOUND)
   if ((not retractions_valid) and getattr(kwargs['node'].retraction, 'is_retracted', False)):
    raise HTTPError(http.BAD_REQUEST, data=dict(message_long='Viewing withdrawn registrations is not permitted'))
   else:
    return func(*args, **kwargs)
  return wrapped
 if func:
  return must_be_valid_project_inner(func)
 return must_be_valid_project_inner

def must_be_valid_project ( func = None , retractions_valid = False ) : def must_be_valid_project_inner ( func ) : @ functools . wraps ( func ) def wrapped ( * args , ** kwargs ) : _inject_nodes ( kwargs ) if getattr ( kwargs [ 'node' ] , 'is_collection' , True ) : raise HTTPError ( http . NOT_FOUND ) if ( ( not retractions_valid ) and getattr ( kwargs [ 'node' ] . retraction , 'is_retracted' , False ) ) : raise HTTPError ( http . BAD_REQUEST , data = dict ( message_long = 'Viewing withdrawn registrations is not permitted' ) ) else : return func ( * args , ** kwargs ) return wrapped if func : return must_be_valid_project_inner ( func ) return must_be_valid_project_inner
ensures permissions to retractions are never implicitly granted .