(defn require-role! [required roles]
  (if-not (seq (clojure.set/intersection required roles))
    (ring.util.http-response/unauthorized! {:text "missing role", :required required, :roles roles})))
(defmethod compojure.api.meta/restructure-param :roles [_ roles acc]
  (update-in acc [:lets] into ['_ `(require-role! ~roles (:roles ~'+compojure-api-request+))]))

(GET "/admin" []
  :roles #{:admin}
  (ok {:message "welcome!"})))
(r {:request-method :get :uri "/admin"})                    
; => throws 401
(r {:request-method :get :uri "/admin" :roles #{:admin}})
; => ok

; normal case
(macroexpand-1
  `(GET "/admin" []
     (ok {:message "welcome!"})))
; (compojure.api.routes/create
;   "/admin"
;   :get
;   (compojure.api.meta/merge-parameters {})
;   nil
;   (compojure.core/make-route
;     :get
;     #clout.core.CompiledRoute{:source "/admin", :re #"/admin", :keys [], :absolute? false}
;     (clojure.core/fn [request__14718__auto__]
;       (compojure.core/let-request [[:as +compojure-api-request+] request__14718__auto__]
;         (do (ring.util.http-response/ok {:message "welcome!"}))))))
(macroexpand-1
  `(GET "/admin" []
    :roles #{:admin}
    (ok {:message "welcome!"})))
; (compojure.api.routes/create
;   "/admin"
;   :get
;   (compojure.api.meta/merge-parameters {})
;   nil
;   (compojure.core/make-route
;     :get
;     #clout.core.CompiledRoute{:source "/admin", :re #"/admin", :keys [], :absolute? false}
;     (clojure.core/fn [request__14718__auto__]
;       (compojure.core/let-request [[:as +compojure-api-request+] request__14718__auto__]
;         (clojure.core/let [_ (sampo.restructure/require-role! #{:admin} (:roles +compojure-api-request+))]
;           (do (ring.util.http-response/ok {:message "welcome!"})))))))