from flask_sqlalchemy import SQLAlchemy
<p>db = SQLAlchemy()</p><p>class Role(db.Model):
id = db.Column(db.Integer, primary_key=True)
name = db.Column(db.String(50), unique=True)
permissions = db.relationship('Permission', secondary='role_permissions')</p><p>class Permission(db.Model):
id = db.Column(db.Integer, primary_key=True)
name = db.Column(db.String(50), unique=True)  # 如 'delete_post'</p><p>role_permissions = db.Table('role_permissions',
db.Column('role_id', db.Integer, db.ForeignKey('role.id')),
db.Column('permission_id', db.Integer, db.ForeignKey('permission.id'))
)</p><p>class User(db.Model):
id = db.Column(db.Integer, primary_key=True)
username = db.Column(db.String(80), unique=True)
role_id = db.Column(db.Integer, db.ForeignKey('role.id'))
role = db.relationship('Role')</p>

from functools import wraps
from flask import abort, session
<p>def require_permission(permission_name):
def decorator(f):
@wraps(f)
def decorated_function(*args, *<em>kwargs):
user_id = session.get("user_id")
if not user_id:
return abort(401)
user = User.query.get(user_id)
if not user:
return abort(401)
if not any(p.name == permission_name for p in user.role.permissions):
return abort(403)
return f(</em>args, **kwargs)
return decorated_function
return decorator</p>

@app.route('/delete/<int:post_id>', methods=['POST'])
@require_permission('delete_post')
def delete_post(post_id):
    # 删除逻辑
    return "删除成功"