Add raise_exception arg to @group_required #10658

Allows raising a 403 PermissionDenied for API-style
requests, instead of a 302 redirect to nowhere.

arches/app/utils/decorators.py

@@ -59,7 +59,7 @@ def new_func(*args, **kwargs):
     return new_func
 
 
-def group_required(*group_names):
+def group_required(*group_names, raise_exception=False):
     """
     Requires user membership in at least one of the groups passed in.
 
@@ -69,6 +69,9 @@ def in_groups(u):
         if u.is_authenticated:
             if u.is_superuser or bool(u.groups.filter(name__in=group_names)):
                 return True
+        if raise_exception:
+            raise PermissionDenied
+        # else: user_passes_test() redirects to nowhere
         return False
 
     return user_passes_test(in_groups)