Check authorization in requires role guard decorator

backend/utils/auth.py

@@ -37,8 +37,9 @@ def requires_role(roles=None):
     def decorator(f):
         @wraps(f)
         def decorated_function(*args, **kwargs):
+            if g.get('is_authed', False) is False:
+                return jsonify({'error': 'Unauthorized'})
             if g.current_user.role in roles:
                 return f(*args, **kwargs)
-            return jsonify({'error': 'Not authorized'}), 403
         return decorated_function
     return decorator