librelist archives

« back to archive

authorization decorator

authorization decorator

From:
Alessio Civitillo
Date:
2012-01-31 @ 19:21
Hello,

I am trying to create a simple decorator for reserving some views to admin
users like this:

def authorization(role):
def decorator(f):
if not session.get('logged_in_as'):
abort(401)
elif session['logged_in_as']==role:
return f
else:
                        abort(401)
return decorator

@app.route('/')
@authorization(role='admin')
def index():
       return 'hello'

However, I keep getting: "Run Time Error: Working outstide request
context". I think the error is related to somehow improper use of the
*session* method, but I can't understand the issue. Any help would be
really appreciated.

Thanks,
Alessio Civitillo

Re: [flask] authorization decorator

From:
Steven Kryskalla
Date:
2012-02-01 @ 02:45
On Tue, Jan 31, 2012 at 11:21 AM, Alessio Civitillo
<alessiocivitillo@gmail.com> wrote:
> However, I keep getting: "Run Time Error: Working outstide request context".
> I think the error is related to somehow improper use of the *session*
> method, but I can't understand the issue. Any help would be really
> appreciated.

The execution of the "decorator" function is happening when the
decorator is applied to the function, not at runtime. Try adding a few
print statements inside and outside the definition of "decorator" and
see when they get run.

You need to delay the execution of what's inside "decorator" to
runtime. You can do this by nesting the decorator one level deeper:

http://paste.pocoo.org/show/543899/

-steve

Re: [flask] authorization decorator

From:
Alessio Civitillo
Date:
2012-02-01 @ 05:07
>
> The execution of the "decorator" function is happening when the
> decorator is applied to the function, not at runtime. Try adding a few
> print statements inside and outside the definition of "decorator" and
> see when they get run.
> You need to delay the execution of what's inside "decorator" to
> runtime. You can do this by nesting the decorator one level deeper:
> http://paste.pocoo.org/show/543899/
> -steve


The problem with this is that I get a quite strange error. If you look at:


https://github.com/kfk/sourcingzen/blob/master/sourcingzen/views/login.py<https://github.com/kfk/sourcingzen/blob/master/sourcingzen/views/login.py>

eveytime I try to use the authorization decorator, the route '/login_test' gets
called. For example, if I request '/admin/users' (in views.py), it prints
"hello" as that route now calls the same function as '/login_test'. I am
not sure why this is happening, somehow this decorator affects the
app.route decorator too and I can't understand why or how.

On Wed, Feb 1, 2012 at 3:45 AM, Steven Kryskalla <skryskalla@gmail.com>wrote:

> On Tue, Jan 31, 2012 at 11:21 AM, Alessio Civitillo
> <alessiocivitillo@gmail.com> wrote:
> > However, I keep getting: "Run Time Error: Working outstide request
> context".
> > I think the error is related to somehow improper use of the *session*
> > method, but I can't understand the issue. Any help would be really
> > appreciated.
>
> The execution of the "decorator" function is happening when the
> decorator is applied to the function, not at runtime. Try adding a few
> print statements inside and outside the definition of "decorator" and
> see when they get run.
>
> You need to delay the execution of what's inside "decorator" to
> runtime. You can do this by nesting the decorator one level deeper:
>
> http://paste.pocoo.org/show/543899/
>
> -steve
>



-- 
Regards,
------------------------------------
Alessio Civitillo
alessiocivitillo@gmail.com
Mobile: (0045) 52645608
Linkedin: http://it.linkedin.com/in/alessiocivitillo

Re: [flask] authorization decorator

From:
Steven Kryskalla
Date:
2012-02-01 @ 06:18
On Tue, Jan 31, 2012 at 9:07 PM, Alessio Civitillo
<alessiocivitillo@gmail.com> wrote:
> The problem with this is that I get a quite strange error. If you look at:
>
> https://github.com/kfk/sourcingzen/blob/master/sourcingzen/views/login.py
>
> eveytime I try to use the authorization decorator, the route '/login_test'
> gets called. For example, if I request '/admin/users' (in views.py), it
> prints "hello" as that route now calls the same function as '/login_test'. I
> am not sure why this is happening, somehow this decorator affects the
> app.route decorator too and I can't understand why or how.
>

That is because of the name of the function returned by the decorator.
Flask uses the name of the function to look up the view. If you use
functools.wraps it will work.

http://paste.pocoo.org/show/543954/

-steve

Re: [flask] authorization decorator

From:
Alessio Civitillo
Date:
2012-02-01 @ 13:08
> That is because of the name of the function returned by the decorator.
> Flask uses the name of the function to look up the view. If you use
> functools.wraps it will work.
>

Steve thanks. One last thing if you know it. If I look at Flask source code
in https://github.com/mitsuhiko/flask/blob/master/flask/app.py. Method
"route" has this line:

endpoint = options.pop('endpoint', None)

I think that is where the  function view name gets hooked up. Do you happen
to know why options has the "endpoint" key? I don't understand where that
endpoint info is coming from.

On Wed, Feb 1, 2012 at 7:18 AM, Steven Kryskalla <skryskalla@gmail.com>wrote:

> On Tue, Jan 31, 2012 at 9:07 PM, Alessio Civitillo
> <alessiocivitillo@gmail.com> wrote:
> > The problem with this is that I get a quite strange error. If you look
> at:
> >
> >
> https://github.com/kfk/sourcingzen/blob/master/sourcingzen/views/login.py
> >
> > eveytime I try to use the authorization decorator, the
> route '/login_test'
> > gets called. For example, if I request '/admin/users' (in views.py), it
> > prints "hello" as that route now calls the same function
> as '/login_test'. I
> > am not sure why this is happening, somehow this decorator affects the
> > app.route decorator too and I can't understand why or how.
> >
>
> That is because of the name of the function returned by the decorator.
> Flask uses the name of the function to look up the view. If you use
> functools.wraps it will work.
>
> http://paste.pocoo.org/show/543954/
>
> -steve
>



-- 
Regards,
------------------------------------
Alessio Civitillo
alessiocivitillo@gmail.com
Mobile: (0045) 52645608
Linkedin: http://it.linkedin.com/in/alessiocivitillo

Re: [flask] authorization decorator

From:
Ron DuPlain
Date:
2012-02-01 @ 14:12
Hi,

On Wed, Feb 1, 2012 at 8:08 AM, Alessio Civitillo
<alessiocivitillo@gmail.com> wrote:
>
>> That is because of the name of the function returned by the decorator.
>> Flask uses the name of the function to look up the view. If you use
>> functools.wraps it will work.
>
>
> Steve thanks. One last thing if you know it. If I look at Flask source code
> in https://github.com/mitsuhiko/flask/blob/master/flask/app.py. Method
> "route" has this line:
>
> endpoint = options.pop('endpoint', None)
>
> I think that is where the  function view name gets hooked up. Do you happen
> to know why options has the "endpoint" key? I don't understand where that
> endpoint info is coming from.
>

Flask defaults to the name of the function as the name of the
endpoint. You can pass an endpoint argument to route or add_url_rule
explicitly name the endpoint.

http://flask.pocoo.org/docs/api/#flask.Flask.route

-Ron


> On Wed, Feb 1, 2012 at 7:18 AM, Steven Kryskalla <skryskalla@gmail.com>
> wrote:
>>
>> On Tue, Jan 31, 2012 at 9:07 PM, Alessio Civitillo
>> <alessiocivitillo@gmail.com> wrote:
>> > The problem with this is that I get a quite strange error. If you look
>> > at:
>> >
>> >
>> > https://github.com/kfk/sourcingzen/blob/master/sourcingzen/views/login.py
>> >
>> > eveytime I try to use the authorization decorator, the
>> > route '/login_test'
>> > gets called. For example, if I request '/admin/users' (in views.py), it
>> > prints "hello" as that route now calls the same function
>> > as '/login_test'. I
>> > am not sure why this is happening, somehow this decorator affects the
>> > app.route decorator too and I can't understand why or how.
>> >
>>
>> That is because of the name of the function returned by the decorator.
>> Flask uses the name of the function to look up the view. If you use
>> functools.wraps it will work.
>>
>> http://paste.pocoo.org/show/543954/
>>
>> -steve
>
>
>
>
> --
> Regards,
> ------------------------------------
> Alessio Civitillo
> alessiocivitillo@gmail.com
> Mobile: (0045) 52645608
> Linkedin: http://it.linkedin.com/in/alessiocivitillo

Re: [flask] authorization decorator

From:
Cao Yin
Date:
2012-02-01 @ 02:17
Hello

I find an example in docs about how to get *session* object in request 
context stack and I hope it would help you:

from flask import _request_ctx_stack
def get_session():
    ctx = _request_ctx_stack.top
    if ctx is not None:
        return ctx.session


在 2012-2-1,上午3:21, Alessio Civitillo 写道:

> Hello,
> 
> I am trying to create a simple decorator for reserving some views to 
admin users like this:
> 
> def authorization(role):
> 	def decorator(f):
> 		if not session.get('logged_in_as'):
> 			abort(401)
> 		elif session['logged_in_as']==role:
> 			return f
> 		else:
>                         abort(401)
> 	return decorator
> 
> @app.route('/')
> @authorization(role='admin')
> def index():
>        return 'hello'
> 
> However, I keep getting: "Run Time Error: Working outstide request 
context". I think the error is related to somehow improper use of the 
*session* method, but I can't understand the issue. Any help would be 
really appreciated.
> 
> Thanks,
> Alessio Civitillo