python-flask-principal(1)

from flask import Flask, Response
from flask_principal import Principal, Permission, RoleNeed
app = Flask(__name__)
# load the extension
principals = Principal(app)
# Create a permission with a single Need, in this case a RoleNeed.
admin_permission = Permission(RoleNeed('admin'))
# protect a view with a principal for that need
@app.route('/admin')
@admin_permission.require()
def do_admin_index():
    return Response('Only if you are an admin')
# this time protect with a context manager
@app.route('/articles')
def do_articles():
    with admin_permission.require():
        return Response('Only if you are admin')

from flask import Flask, current_app, request, session, \
        render_template, redirect
from flask_login import LoginManager, login_user, logout_user, \
        login_required
from wtforms import StringField, PasswordField
from flask_wtf import FlaskForm
from flask_principal import Principal, Identity, AnonymousIdentity, \
        identity_changed
app = Flask(__name__)
app.config['SECRET_KEY'] = 'notsosecret'
Principal(app)
login_manager = LoginManager(app)
class User:
    def __init__(self, id='1', email=None, password=None):
        self.id = id
        self.email = email
        self.password = 'abcd'
        self.is_authenticated = False
        self.is_active = True
        self.is_anonymous = True
    def get_id(self):
        return self.id
class DB:
    def __init__(self):
        pass
    def find_user(self, id=None, email=None):
        example_user = User(id=id, email=email)
        return example_user
@login_manager.user_loader
def load_user(userid):
    # Return an instance of the User model
    datastore = DB()
    return datastore.find_user(id=userid)
class LoginForm(FlaskForm):
    email = StringField('email')
    password = PasswordField('password')
@app.route('/login', methods=['GET', 'POST'])
def login():
    # A hypothetical login form that uses Flask-WTF
    form = LoginForm()
    if request.method == 'POST':
        # Validate form input
        if form.validate_on_submit():
            # Retrieve the user from the hypothetical datastore
            datastore = DB()
            user = datastore.find_user(email=form.email.data)
            # Compare passwords (use password hashing production)
            if form.password.data == user.password:
                # Keep the user info in the session using Flask-Login
                login_user(user)
                # Tell Flask-Principal the identity changed
                identity_changed.send(current_app._get_current_object(),
                                        identity=Identity(user.id))
                print('logged in ')
                return redirect(request.args.get('next') or '/')
    return render_template('login.html', form=form)
@app.route('/logout')
@login_required
def logout():
    # Remove the user information from the session
    logout_user()
    # Remove session keys set by Flask-Principal
    for key in ('identity.name', 'identity.auth_type'):
        session.pop(key, None)
    # Tell Flask-Principal the user is anonymous
    identity_changed.send(current_app._get_current_object(),
                            identity=AnonymousIdentity())
    return redirect(request.args.get('next') or '/')
@app.route('/')
def home():
    return 'home page'
if __name__ == '__main__':
    app.run(debug=True)

</html>

from flask_login import current_user
from flask_principal import identity_loaded, RoleNeed, UserNeed
@identity_loaded.connect_via(app)
def on_identity_loaded(sender, identity):
    # Set the identity user object
    identity.user = current_user
    # Add the UserNeed to the identity
    if hasattr(current_user, 'id'):
        identity.provides.add(UserNeed(current_user.id))
    # Assuming the User model has a list of roles, update the
    # identity with the roles that the user provides
    if hasattr(current_user, 'roles'):
        for role in current_user.roles:
            identity.provides.add(RoleNeed(role.name))

from collections import namedtuple
from functools import partial
from flask_login import current_user
from flask_principal import identity_loaded, Permission, RoleNeed, \
     UserNeed
BlogPostNeed = namedtuple('blog_post', ['method', 'value'])
EditBlogPostNeed = partial(BlogPostNeed, 'edit')
class EditBlogPostPermission(Permission):
    def __init__(self, post_id):
        need = EditBlogPostNeed(unicode(post_id))
        super(EditBlogPostPermission, self).__init__(need)
@identity_loaded.connect_via(app)
def on_identity_loaded(sender, identity):
    # Set the identity user object
    identity.user = current_user
    # Add the UserNeed to the identity
    if hasattr(current_user, 'id'):
        identity.provides.add(UserNeed(current_user.id))
    # Assuming the User model has a list of roles, update the
    # identity with the roles that the user provides
    if hasattr(current_user, 'roles'):
        for role in current_user.roles:
            identity.provides.add(RoleNeed(role.name))
    # Assuming the User model has a list of posts the user
    # has authored, add the needs to the identity
    if hasattr(current_user, 'posts'):
        for post in current_user.posts:
            identity.provides.add(EditBlogPostNeed(unicode(post.id)))

@app.route('/posts/<post_id>', methods=['PUT', 'PATCH'])
def edit_post(post_id):
    permission = EditBlogPostPermission(post_id)
    if permission.can():
        # Save the edits ...
        return render_template('edit_post.html')
    abort(403)  # HTTP Forbidden

blog_admin = Permission(RoleNeed('blog_admin'))
blog_poster = Permission(RoleNeed('blog_poster'))
blog_reviewer = Permission(RoleNeed('blog_reviewer'))
under_probation = Permission(RoleNeed('under_probation'))
prize_permission = ((blog_poster | blog_reviewer) & ~under_probation)
@app.route('/blog/prizes')
@prize_permission.require()
def prize_redeem():
    # find out what prizes are available to blog users that are not
    # under probation
    return render_template('prize_redeem.html')

from flask.ext.principal import AndPermission, OrPermission
allperms = AndPermission(blog_poster, blog_reviewer, blog_admin)
anyperms = OrPermission(blog_poster, blog_reviewer, blog_admin)

from flask.ext.principal import BasePermission
class CustomPermission(BasePermission):
    def allows(self, identity):
        # Implement other conditions that allow this to pass
        return False