py app init + zitadel doku

app/auth.py

@@ -0,0 +1,56 @@
+"""
+OIDC-Authentifizierung via Authlib und Zitadel.
+
+Konfiguriert den OAuth2-Client und stellt ``login_required`` sowie
+``role_required`` als Route-Guard-Dekoratoren bereit.
+
+:author:  <Vorname Nachname>
+:date:    2026-06-17
+:version: 0.1
+"""
+
+import logging
+from functools import wraps
+from authlib.integrations.flask_client import OAuth
+from flask import session, redirect, url_for
+
+logger = logging.getLogger(__name__)
+oauth = OAuth()
+
+
+def init_oauth(app):
+    oauth.init_app(app)
+    oauth.register(
+        name="zitadel",
+        server_metadata_url=app.config["ZITADEL_SERVER_METADATA_URL"],
+        client_id=app.config["ZITADEL_CLIENT_ID"],
+        client_secret=app.config["ZITADEL_CLIENT_SECRET"],
+        client_kwargs={"scope": "openid profile email"},
+    )
+
+
+def get_current_user():
+    return session.get("user")
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if not session.get("user"):
+            return redirect(url_for("main.login"))
+        return f(*args, **kwargs)
+    return decorated
+
+
+def role_required(*roles):
+    def decorator(f):
+        @wraps(f)
+        def decorated(*args, **kwargs):
+            user = session.get("user")
+            if not user:
+                return redirect(url_for("main.login"))
+            if user.get("role") not in roles:
+                return redirect(url_for("main.error"))
+            return f(*args, **kwargs)
+        return decorated
+    return decorator