from django.http import HttpResponseForbidden

def role_required(role):
    def decorator(view_func):
        def wrapper(request, *args, **kwargs):
            if request.user.role != role:
                return HttpResponseForbidden("Unauthorized")
            return view_func(request, *args, **kwargs)
        return wrapper
    return decorator