decorators.py

from google.appengine.api import users
from webapp2 import redirect_to, redirect

def admin_required(handler):
    def _check_login(self, *args, **kwargs):
        user = users.get_current_user()
        if user:
            if not users.is_current_user_admin():
                return redirect_to("forbidden")
            else:
                return handler(self, *args, **kwargs)
        else:
            return self.redirect(users.create_login_url(self.request.uri))
    return _check_login