Add ability to not register blueprint on app. Useful if combining apps such as an API layer and a frontend where the API is not concerned with rendering templates or handling traditional auth

flask_security/core.py

@@ -272,7 +272,7 @@ class Security(object):
         if app is not None and datastore is not None:
             self._state = self.init_app(app, datastore, **kwargs)
 
-    def init_app(self, app, datastore=None):
+    def init_app(self, app, datastore=None, register_blueprint=True):
         """Initializes the Flask-Security extension for the specified
         application and datastore implentation.
 
@@ -290,8 +290,11 @@ class Security(object):
         identity_loaded.connect_via(app)(_on_identity_loaded)
 
         state = _get_state(app, datastore)
-        app.register_blueprint(create_blueprint(state, __name__))
-        app.context_processor(_context_processor)
+
+        if register_blueprint:
+            app.register_blueprint(create_blueprint(state, __name__))
+            app.context_processor(_context_processor)
+
         app.extensions['security'] = state
 
         return state

tests/__init__.py

@@ -17,8 +17,8 @@ class SecurityTest(TestCase):
         self.app = app
         self.client = app.test_client()
 
-    def _create_app(self, auth_config):
-        return create_app(auth_config)
+    def _create_app(self, auth_config, register_blueprint=True):
+        return create_app(auth_config, register_blueprint)
 
     def _get(self, route, content_type=None, follow_redirects=None, headers=None):
         return self.client.get(route, follow_redirects=follow_redirects,

tests/functional_tests.py

@@ -622,3 +622,19 @@ class AsyncMailTaskTests(SecurityTest):
 
         self.client.post('/reset', data=dict(email='joe@lp.com'))
         self.assertTrue(self.mail_sent)
+
+
+class NoBlueprintTests(SecurityTest):
+
+    def _create_app(self, auth_config):
+        return super(NoBlueprintTests, self)._create_app(auth_config, False)
+
+    def test_login_endpoint_is_404(self):
+        r = self._get('/login')
+        self.assertEqual(404, r.status_code)
+
+    def test_http_auth_without_blueprint(self):
+        r = self._get('/http', headers={
+            'Authorization': 'Basic ' + base64.b64encode("joe@lp.com:password")
+        })
+        self.assertIn('HTTP Authentication', r.data)

tests/test_app/__init__.py

@@ -38,7 +38,7 @@ def create_app(config):
     @app.route('/http')
     @http_auth_required
     def http():
-        return render_template('index.html', content='HTTP Authentication')
+        return 'HTTP Authentication'
 
     @app.route('/http_custom_realm')
     @http_auth_required('My Realm')

tests/test_app/sqlalchemy.py

@@ -14,7 +14,7 @@ from flask.ext.security import Security, UserMixin, RoleMixin, \
 from tests.test_app import create_app as create_base_app, populate_data, \
      add_context_processors
 
-def create_app(config):
+def create_app(config, register_blueprint=True):
     app = create_base_app(config)
 
     app.config['SQLALCHEMY_DATABASE_URI'] = 'mysql://root@localhost/flask_security_test'
@@ -50,7 +50,8 @@ def create_app(config):
         db.create_all()
         populate_data()
 
-    app.security = Security(app, SQLAlchemyUserDatastore(db, User, Role))
+    app.security = Security(app, SQLAlchemyUserDatastore(db, User, Role),
+                            register_blueprint=register_blueprint)
 
     add_context_processors(app.security)