How do you implement role-based access control (RBAC) using FastAPI dependencies?

from fastapi import FastAPI, Depends, HTTPException, status
from typing import Annotated
from enum import Enum

app = FastAPI()

class Role(str, Enum):
    user  = "user"
    admin = "admin"

class User:
    def __init__(self, username: str, role: Role):
        self.username = username
        self.role = role

# Simulated auth — in reality decode a JWT
def get_current_user() -> User:
    return User(username="alice", role=Role.user)

# Higher-order dependency factory — creates a role checker
def require_role(role: Role):
    def checker(user: Annotated[User, Depends(get_current_user)]) -> User:
        if user.role != role:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail=f"Requires {role} role",
            )
        return user
    return checker

# Public route — any authenticated user
@app.get("/profile")
def profile(user: Annotated[User, Depends(get_current_user)]):
    return {"username": user.username, "role": user.role}

# Admin-only route
@app.delete("/users/{user_id}")
def delete_user(
    user_id: int,
    _: Annotated[User, Depends(require_role(Role.admin))],
):
    return {"deleted": user_id}

# Router-level dependency — apply to all routes in a router
from fastapi import APIRouter
admin_router = APIRouter(
    prefix="/admin",
    dependencies=[Depends(require_role(Role.admin))],
)

@admin_router.get("/stats")
def admin_stats():
    return {"total_users": 42}