Restricted the Admin Pages from users

[mdxabu]

Description of your changes:
This PR introduces a role-based access control (RBAC) mechanism for the app, ensuring that only users with the correct roles (i.e., "admin") are allowed to access certain routes and pages. The changes include the enhancement of the role_required decorator to check the user's role and redirect non-admin users to the 403.html page if they attempt to access admin-specific pages. Additionally, improvements were made to handle cases where the user session might be None, preventing AttributeError exceptions when accessing user data.

Changes:

• role_required Decorator:

  • The role_required decorator was modified to first check for the google_id in the session. If present, it checks whether the user is an admin via the is_admin function.
  • If the google_id is not in the session, the decorator checks for the regular user session (username) and verifies their role by fetching user data from the database.
  • If the user is found and their role matches the required role, they are allowed to access the page. Otherwise, they are redirected to the 403.html page.

• Session Handling:

  • Introduced error handling when the get_currentuser_from_session() function returns None (i.e., when no valid user data is found in the session). This prevents errors when accessing attributes like role of a non-existent user.
  • If no valid user or role is found, the app renders the 403.html page to indicate a forbidden access attempt.

• Improved Admin Access Flow:

  • Admin-specific pages now require the user to have the role admin to be accessed. Non-admin users will be redirected to a 403 page.
  • Admin login functionality with Google OAuth is integrated to ensure that only users with a valid admin email can access the admin panel.

Testing:

• Verified that only users with the role admin can access admin pages.
• Checked that non-admin users are redirected to the 403.html page when attempting to access restricted areas.
• Ensured that when no valid user is found in the session, the app gracefully handles the scenario and prevents errors like AttributeError: 'NoneType' object has no attribute 'get'.

Why this change is necessary:
This update ensures secure access to admin routes, preventing unauthorized users from accessing administrative functionality and resources. It also handles session inconsistencies more gracefully, improving the overall robustness and security of the app.

Checklist:

• You have signed off your commits
• The title for your pull request (PR) should follow our title convention. Learn more about the pull request title convention used in this repository

[pradeeban]

Looks good to me.