docs: def require_flush(fun):
      """Decorator for methods that need to query security.
  
      It ensures all security related operations are flushed to DB, but
      avoids unneeded flushes.
      """
  
      @wraps(fun)
      def ensure_flushed(service, *args, **kwargs):
          if service.app_state.needs_db_flush:
              session = db.session()
              if not session._flushing and any(
                  isinstance(m, (RoleAssignment, SecurityAudit))
                  for models in (session.new, session.dirty, session.deleted)
                  for m in models
              ):
                  session.flush()
              service.app_state.needs_db_flush = False
  
          return fun(service, *args, **kwargs)
  
      return ensure_flushed