{
  "context": "Tests whether the response implements a correct parameterized Python decorator for role-based auth.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Decorator accepts role parameter",
      "description": "Uses a decorator factory pattern — @require_role('admin') returns a decorator (nested function structure)",
      "max_score": 12
    },
    {
      "name": "Extracts and decodes JWT",
      "description": "Reads the Authorization header, extracts the Bearer token, and decodes the JWT",
      "max_score": 12
    },
    {
      "name": "Returns 401 for missing/invalid token",
      "description": "Returns HTTP 401 when the token is missing, malformed, or expired",
      "max_score": 10
    },
    {
      "name": "Returns 403 for wrong role",
      "description": "Returns HTTP 403 when the token is valid but the user lacks the required role",
      "max_score": 10
    },
    {
      "name": "Uses functools.wraps",
      "description": "Applies @functools.wraps(f) to preserve the wrapped function's name and docstring",
      "max_score": 8
    },
    {
      "name": "No incorrect information",
      "description": "Python code is syntactically valid and Flask/JWT usage is correct",
      "max_score": 10
    }
  ]
}