title: How to make a python decorator function in Flask with arguments (for authorization)
body: <p>I used a flask snippet for my flask-login that checks that a user is logged in:</p>
  
  <pre><code>from functools import wraps
  
  def logged_in(f):
      @wraps(f)
      def decorated_function(*args, **kwargs):
          if session.get('logged_in') is not None:
              return f(*args, **kwargs)
          else:
              flash('Please log in first.', 'error')
              return redirect(url_for('login'))
      return decorated_function
  </code></pre>
  
  <p>And I decorate views like so:</p>
  
  <pre><code>@app.route('/secrets', methods=['GET', 'POST'])
  @logged_in
  def secrets():
      error = None
  </code></pre>
  
  <p>I'd like to do something similar for authorization, too.  Right now, I have many views to check that a user owns a resource, let's say the <code>hotdogs</code> resource.</p>
  
  <p>If the logged_in user is the owner of that particular hotdog, he can edit and manage his hotdogs.  If he isn't, I kick him out to the unauthorized screen.</p>
  
  <pre><code>@app.route('/&lt;hotdog&gt;/addmustard/',methods=["GET"])
  @logged_in
  def addmustard(hotdog):
      if not (authorizeowner(hotdog)):
          return redirect(url_for('unauthorized'))
      do_stuff()
  </code></pre>
  
  <p><code>authorizeowner()</code> takes a hotdog as input and checks that the recorded hotdog owner matches the owner name listed in the session variable.</p>
  
  <p>I tried making a owns_hotdog wrapper/decorator function similar to my logged in one, but it complained that it didn't accept arguments.  How can I achieve something similar?  Something like...</p>
  
  <pre><code>def owns_hotdog(f):
      @wraps(f)
      def decorated_function(*args, **kwargs):
          if not authorizeowner(hotdog):
              return f(*args, **kwargs)
          else:
              flash('Please log in first.', 'error')
              return redirect(url_for('login'))
      return decorated_function
  </code></pre>
  
  <p>From the error message, decorator seems not to be receiving the hotdog argument that Flask views have access to from the  variable in the route.  My hope is for something like...</p>
  
  <pre><code>@app.route('/&lt;hotdog&gt;/addmustard/',methods=["GET"])
  @logged_in
  @owns_hotdog(hotdog)
  def addmustard(hotdog):
      do_stuff()
  </code></pre>
  
  <p>Everything works with my current authorizeowner(hotdog) function, but it just seems cleaner to have this in place as a wrapper on top of my route, rather than as the first line inside the route.</p>
  
  <p>Some other notes:</p>
  
  <ul>
  <li>I know that Flask-Security and Flask-Principal can manage
  authorization for me.  Unfortunately, I'm using an unsupported
  database back-end and am unable to use these extensions.  So, I'm
  forced to do authentication without them. </li>
  <li>If you see any glaring holes in doing authorization this way, please let me know!</li>
  </ul>