it is necessary to enhance the @roles_required and @permission_required by adding an AND operator?

[ockan]

Now, @roles_required and @permission_required let sb. pass when any ONE role or any ONE permission satisfy.
that is OR operator.
could enhance the @roles_required and @permission_required by adding an AND operator to force all role or permission must be satisfied?
for example:

def roles_required(*roles: str, *, operator : or|and = or) -> Callable:

[GrandpaEJ]

This is an excellent idea, and thank you for pointing out the inconsistency!

I've just added a require_all flag to both @roles_required and @permission_required.

To ensure backward compatibility:

• @roles_required still defaults to require_all=False (OR logic).
• @permission_required still defaults to require_all=True (AND logic).

You can now explicitly override this behavior whenever you need:

# User must have BOTH admin AND editor roles
@roles_required("admin", "editor", require_all=True)

# User must have ANY of the permissions (read OR write)
@permission_required("read", "write", require_all=False)

Additionally, while reviewing the code for this, I noticed that both of these decorators previously failed to support async def routes. I have fully rewritten both decorators to properly support asynchronous route handlers!

These improvements have been committed to the main branch and bumped in the 0.13.8 release. Thanks again for your contribution!

[GrandpaEJ]

By the way, you have some really great ideas for the framework!

Next time you spot an inconsistency like this or have a feature idea, we would absolutely love to invite you to open a Pull Request (PR) directly. We really appreciate community contributions, and it would be awesome to have you formally contribute to the codebase!

Thanks again for helping improve BustAPI! 🚀