Flask-admin: differentiate accessability between views - flask

Question

I would like to differentiate accessability to the views (index, create, edit) in flask-admin. It can be done at the level of all views concerning particular model by overriding the method: is_accessible.
def is_accessible(self):
return current_user.is_authenticated # using flask-login
I need that some users will be able to browse data, but without permission to create new records. On the othe rhand other users should be able to create
and edit records. Any help will be appreciated.
Solution
I have overriden _handle_view method which is called before every view.
def _handle_view(self, name, **kwargs):
if not current_user.is_authenticated:
return self.unauthorized_access()
permissions = self.get_permissions(name)
if not current_user.can(permissions):
return self.forbidden_access()
return None #access granted

Answer 1

It isn't terribly well documented, but I think you can override the is_action_allowed method on a ModelView class to get the behavior you want. The API documentation doesn't say much about this, but I found a better example from the changenotes when it was introduced:
You can control which actions are available for current request by
overriding is_action_allowed method:
from flask.ext.admin.actions import action
class MyModelAdmin(ModelAdmin):
def is_action_allowed(self, name):
if name == 'merge' and not user.superadmin:
return False
if name == 'delete' and not user.admin:
return False
return super(MyModelAdmin, self).is_action_allowed(name)
I haven't tried this myself, so I can't attest to whether the example actually works without other changes.

Answer 2

Flask-User seems like what you want. You specify a UserRoles class, a Roles class, and a User class which you already have. You assign a UserRole to a User and then in your is_accessible method can differentiate what you want to do (read/write/edit) based on your role.
https://pythonhosted.org/Flask-User/
# Define User model
class User(db.Model, UserMixin):
id = db.Column(db.Integer, primary_key=True)
username = db.Column(db.String(50), nullable=True, unique=True)
...
roles = db.relationship('Role', secondary='user_roles',
backref=db.backref('users', lazy='dynamic'))
# Define Role model
class Role(db.Model):
id = db.Column(db.Integer(), primary_key=True)
name = db.Column(db.String(50), unique=True)
# Define UserRoles model
class UserRoles(db.Model):
id = db.Column(db.Integer(), primary_key=True)
user_id = db.Column(db.Integer(), db.ForeignKey('user.id', ondelete='CASCADE'))
role_id = db.Column(db.Integer(), db.ForeignKey('role.id', ondelete='CASCADE'))