def protect(allow_browser_login=False):
def _protect(f):<EOL><INDENT>if hasattr(f, '<STR_LIT>'):<EOL><INDENT>permission_str = f._permission_name<EOL><DEDENT>else:<EOL><INDENT>permission_str = f.__name__<EOL><DEDENT>def wraps(self, *args, **kwargs):<EOL><INDENT>permission_str = "<STR_LIT>".format(PERMISSION_PREFIX, f._permission_name)<EOL>class_permission_name = self.__class__.__name__<EOL>if current_app.appbuilder.sm.is_item_public(<EOL>permission_str,<EOL>class_permission_name<EOL>):<EOL><INDENT>return f(self, *args, **kwargs)<EOL><DEDENT>if not (self.allow_browser_login or allow_browser_login):<EOL><INDENT>verify_jwt_in_request()<EOL><DEDENT>if current_app.appbuilder.sm.has_access(<EOL>permission_str,<EOL>class_permission_name<EOL>):<EOL><INDENT>return f(self, *args, **kwargs)<EOL><DEDENT>elif (self.allow_browser_login or allow_browser_login):<EOL><INDENT>verify_jwt_in_request()<EOL>if current_app.appbuilder.sm.has_access(<EOL>permission_str,<EOL>class_permission_name<EOL>):<EOL><INDENT>return f(self, *args, **kwargs)<EOL><DEDENT><DEDENT>log.warning(<EOL>LOGMSG_ERR_SEC_ACCESS_DENIED.format(<EOL>permission_str,<EOL>class_permission_name<EOL>)<EOL>)<EOL>return self.response_401()<EOL><DEDENT>f._permission_name = permission_str<EOL>return functools.update_wrapper(wraps, f)<EOL><DEDENT>return _protect<EOL>
Use this decorator to enable granular security permissions
to your API methods (BaseApi and child classes).
Permissions will be associated to a role, and roles are associated to users.

allow_browser_login will accept signed cookies obtained from the normal MVC app::

    class MyApi(BaseApi):
        @expose('/dosonmething', methods=['GET'])
        @protect(allow_browser_login=True)
        @safe
        def do_something(self):
            ....

        @expose('/dosonmethingelse', methods=['GET'])
        @protect()
        @safe
        def do_something_else(self):
            ....

By default the permission's name is the methods name.