Sales Trainer v0.1: corporate sales-training simulator (Flask+Vue, 15 personas, chat simulator, judge, analytics)

- Auth/roles (no self-reg), admin user provision, JWT
- Analyze: sales kit + initial pain-fit from form/upload
- Persona generator: 15 personas (5/tier) w/ pain variety, negotiation, init mode, channel, latent/revealable, wrong_text special
- Chat simulator: per-mode initiation, one-shot, hidden signals, judge-LLM debrief+coaching
- Trainee loop: win/lose board, weak-areas, user-generated personas
- Admin analytics; EN+TH Vue SPA served by Flask
- Deploy: Dockerfile, docker-compose, README, eng-log + HANDOFF
- Tests (mock LLM): m0/m1/routes/e2e all pass

backend/app/api/helpers.py

@@ -0,0 +1,73 @@
+"""JWT auth decorators + role guards + shared API helpers."""
+from __future__ import annotations
+
+import functools
+from typing import Any, Callable
+
+from flask import g, jsonify, request
+
+from ..auth.users import AuthError
+from ..config import Config
+
+
+class ApiError(Exception):
+    def __init__(self, message: str, status: int = 400):
+        super().__init__(message)
+        self.message = message
+        self.status = status
+
+
+def _get_store():
+    from flask import current_app
+
+    return current_app.extensions["user_store"]
+
+
+def current_user() -> dict[str, Any]:
+    return g.user
+
+
+def require_auth(fn: Callable) -> Callable:
+    @functools.wraps(fn)
+    def wrapper(*args, **kwargs):
+        header = request.headers.get("Authorization", "")
+        scheme, _, token = header.partition(" ")
+        if scheme.lower() != "bearer" or not token:
+            raise ApiError("authentication required", 401)
+        try:
+            payload = _get_store().decode_token(token)
+        except AuthError as exc:
+            raise ApiError(str(exc), 401)
+        user = _get_store().get_user_or_none(payload.get("sub", ""))
+        if not user or not user.get("active", True):
+            raise ApiError("account is inactive", 401)
+        g.user = user
+        g.token_payload = payload
+        return fn(*args, **kwargs)
+
+    return wrapper
+
+
+def require_roles(*roles: str) -> Callable:
+    def deco(fn: Callable) -> Callable:
+        @functools.wraps(fn)
+        def wrapper(*args, **kwargs):
+            role = g.user.get("role")
+            # super_admin passes any role gate
+            allowed = {"super_admin", *roles}
+            if role not in allowed:
+                raise ApiError("permission denied", 403)
+            return fn(*args, **kwargs)
+
+        return wrapper
+
+    return deco
+
+
+def api_error_handler(err: ApiError):
+    return jsonify({"error": err.message}), err.status
+
+
+def register_error_handlers(app) -> None:
+    app.register_error_handler(ApiError, api_error_handler)
+    app.register_error_handler(ValueError, lambda e: (jsonify({"error": str(e)}), 400))