Add service_has_permission decorator

Similar to how we can restrict routes to only users with a given
permission, this new decorator lets us restrict routes to services that
have a given permission.

Having this is a decorator is cleaner than putting if statements inside
the endpoint code.

app/utils.py

@@ -82,6 +82,18 @@ def user_has_permissions(*permissions, **permission_kwargs):
     return wrap
 
 
+def service_has_permission(permission):
+    from app import current_service
+    def wrap(func):
+        @wraps(func)
+        def wrap_func(*args, **kwargs):
+            if not current_service or not current_service.has_permission(permission):
+                abort(403)
+            return func(*args, **kwargs)
+        return wrap_func
+    return wrap
+
+
 def user_is_gov_user(f):
     @wraps(f)
     def wrapped(*args, **kwargs):