PEP 8

.gitignore

@@ -1,6 +1,8 @@
 .DS_Store
 *.pyc
 *.egg
+*.egg-info
 .project
 .pydevproject
 .settings
+dist

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "docs/_themes"]
+	path = docs/_themes
+	url = git://github.com/mitsuhiko/flask-sphinx-themes.git

CHANGES

@@ -0,0 +1,40 @@
+Flask-Security Changelog
+========================
+
+Here you can see the full list of changes between each Flask-Security release.
+
+Version 1.2.3
+-------------
+
+Released June 12th, 2012
+
+- Fixed a bug in the RoleMixin eq/ne functions
+
+Version 1.2.2
+-------------
+
+Released April 27th, 2012
+
+- Fixed bug where `roles_required` and `roles_accepted` did not pass the next
+  argument to the login view
+
+Version 1.2.1
+-------------
+
+Released March 28th, 2012
+
+- Added optional user model mixin parameter for datastores
+- Added CreateRoleCommand to available Flask-Script commands
+
+Version 1.2.0
+-------------
+
+Released March 12th, 2012
+
+- Added configuration option `SECURITY_FLASH_MESSAGES` which can be set to a 
+  boolean value to specify if Flask-Security should flash messages or not.
+  
+Version 1.1.0
+-------------
+
+Initial release

LICENSE

@@ -2,8 +2,19 @@ MIT License
 
 Copyright (C) 2012 by Matt Wright
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy of 
+this software and associated documentation files (the "Software"), to deal in 
+the Software without restriction, including without limitation the rights to 
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies 
+of the Software, and to permit persons to whom the Software is furnished to do 
+so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all 
+copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README

@@ -0,0 +1,11 @@
+Flask-Security
+==============
+
+Simple security for Flask applications combining Flask-Login, Flask-Principal, 
+Flask-WTF, passlib, and your choice of datastore. Currently SQLAlchemy via 
+Flask-SQLAlchemy and MongoEngine via Flask-MongoEngine are supported out of the 
+box. You will need to install the necessary Flask extensions that you'll be 
+using. Additionally, you may need to install an encryption library such as 
+py-bcrypt to support bcrypt passwords.
+
+Documentation: http://packages.python.org/Flask-Security/

README.md

@@ -1,120 +0,0 @@
-# Flask-Security
-
-Simple security for Flask applications combining [Flask-Login](http://packages.python.org/Flask-Login/), [Flask-Principal](http://packages.python.org/Flask-Principal/), [Flask-WTF](http://packages.python.org/Flask-WTF/), [passlib](http://packages.python.org/passlib/), and your choice of datastore. Currently [SQLAlchemy](http://www.sqlalchemy.org) via [Flask-SQLAlchemy](http://packages.python.org/Flask-SQLAlchemy/) and [MongoEngine](http://www.mongoengine.org) via [Flask-MongoEngine](https://github.com/sbook/flask-mongoengine) are supported out of the box. You will need to install the necessary Flask extensions that you'll be using. Additionally, you may need to install an encryption library such as [py-bcrypt](http://www.mindrot.org/projects/py-bcrypt/) to support bcrypt passwords.
-
-## Overview
-
-Flask-Security does a few things that Flask-Login and Flask-Principal don't provide out of the box. They are:
-
-1. Setting up login and logout endpoints
-2. Authenticating users based on username or email
-3. Limiting access based on user 'roles'
-4. User and role creation
-5. Password encryption
-
-That being said, you can still hook into things such as the Flask-Login and Flask-Principal signals if need be.
-
-
-## Getting Started
-
-First, install Flask-Security:
-
-    $ mkvirtualenv app-name
-    $ pip install https://github.com/mattupstate/flask-security/tarball/master
-    
-Then install your datastore requirement. 
-
-SQLAlchemy:
-
-    $ pip install Flask-SQLAlchemy
-    
-MongoEngine:
-
-    $ pip install https://github.com/sbook/flask-mongoengine/tarball/master
-
-Beyond this, the best place to get started at the moment is to look at the example application(s) and corresponding tests. The example apps are currently used to test Flask-Security as well so they are solid examples of most, if not all, features. Configuration options are illustrated in the tests as well. To run the example run do the following:
-
-    $ mkvirtualenv flask-security
-    $ git clone git://github.com/mattupstate/flask-security.git
-    $ cd flask-security
-    $ pip install Flask Flask-Login Flask-Principal Flask-SQLALchemy passlib
-    $ pip install https://github.com/sbook/flask-mongoengine/tarball/master
-    $ python example/app.py
-
-## Code Examples
-
-If you don't want to checkout the example quite yet, here are some hypothetical examples to give you a sense of how Flask-Security works:
-
-### Setup SQLAlchemy
-
-	from flask import Flask
-	from flask.ext.security import Security
-    from flask.ext.security.datastore.sqlalchemy import SQLAlchemyDatastore
-    from flask.ext.sqlalchemy import SQLAlchemy
-    
-    app = Flask(__name__)
-    app.config['SECRET_KEY'] = 'something'
-    app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///:memory:'
-    
-    db = SQLALchemy(app)
-    Security(app, SQLAlchemyDatastore(db))
-
-### Require a logged in user:
-    
-    from flask import render_template
-    from flask.ext.security import login_required
-    
-    … application setup …
-    
-    @app.route('/profile')
-    @login_required
-    def profile():
-    	return render_template('profile.html')
-    	
-### Require an admin:
-    
-    from flask import render_template
-    from flask.ext.security import roles_required
-    
-    … application setup …
-    
-    @app.route('/admin')
-    @roles_required('admin')
-    def admin():
-    	return render_template('admin/index.html')
-    	
-### Require any of the specified roles:
-    
-    from flask import render_template
-    from flask.ext.security import roles_accepted
-    
-    … application setup …
-    
-    @app.route('/admin')
-    @roles_accepted('admin', 'editor', 'author')
-    def admin():
-    	return render_template('admin/index.html')
-    	
-### Showing a link in a template only for an admin:
-
-    {% if current_user.has_role('admin') %}
-    <a href="{{ url_for('admin.index') }}">Admin Panel</a>
-    {$ endif %}
-    
-## Flask-Script Commands
-
-Flask-Security comes packed with a few Flask-Script commands. They are:
-
-* `flask.ext.security.script.CreateUserCommand`
-* `flask.ext.security.script.AddRoleCommand`
-* `flask.ext.security.script.RemoveRoleCommand`
-* `flask.ext.security.script.DeactivateUserCommand`
-* `flask.ext.security.script.ActivateUserCommand`
-
-Register these on your script manager for pure convenience.
-
-## Contributing
-
-Feel free to fork and contribute. If you decided to do so, just be sure to include relevant tests that you feel are necessary. To run the tests, please provide instructions for any requirements. For instance, if you write a new datastore implementation, please provide instructions on how best to setup a connection when testing.
-
-If you plan on running all the provided tests you'll need a local installation of MongoDB running on the standard port 27017 without username/password protection.

docs/.gitignore

@@ -0,0 +1 @@
+_build

docs/Makefile

@@ -0,0 +1,153 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+PAPER         =
+BUILDDIR      = _build
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+# the i18n builder cannot share the environment and doctrees with the others
+I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html       to make standalone HTML files"
+	@echo "  dirhtml    to make HTML files named index.html in directories"
+	@echo "  singlehtml to make a single large HTML file"
+	@echo "  pickle     to make pickle files"
+	@echo "  json       to make JSON files"
+	@echo "  htmlhelp   to make HTML files and a HTML help project"
+	@echo "  qthelp     to make HTML files and a qthelp project"
+	@echo "  devhelp    to make HTML files and a Devhelp project"
+	@echo "  epub       to make an epub"
+	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
+	@echo "  text       to make text files"
+	@echo "  man        to make manual pages"
+	@echo "  texinfo    to make Texinfo files"
+	@echo "  info       to make Texinfo files and run them through makeinfo"
+	@echo "  gettext    to make PO message catalogs"
+	@echo "  changes    to make an overview of all changed/added/deprecated items"
+	@echo "  linkcheck  to check all external links for integrity"
+	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
+
+clean:
+	-rm -rf $(BUILDDIR)/*
+
+html:
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+dirhtml:
+	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
+
+singlehtml:
+	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
+	@echo
+	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
+
+pickle:
+	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
+	@echo
+	@echo "Build finished; now you can process the pickle files."
+
+json:
+	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
+	@echo
+	@echo "Build finished; now you can process the JSON files."
+
+htmlhelp:
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in $(BUILDDIR)/htmlhelp."
+
+qthelp:
+	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
+	@echo
+	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
+	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
+	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/Flask-Security.qhcp"
+	@echo "To view the help file:"
+	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/Flask-Security.qhc"
+
+devhelp:
+	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
+	@echo
+	@echo "Build finished."
+	@echo "To view the help file:"
+	@echo "# mkdir -p $$HOME/.local/share/devhelp/Flask-Security"
+	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/Flask-Security"
+	@echo "# devhelp"
+
+epub:
+	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
+	@echo
+	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
+
+latex:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
+	@echo "Run \`make' in that directory to run these through (pdf)latex" \
+	      "(use \`make latexpdf' here to do that automatically)."
+
+latexpdf:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through pdflatex..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+text:
+	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
+	@echo
+	@echo "Build finished. The text files are in $(BUILDDIR)/text."
+
+man:
+	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
+	@echo
+	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
+
+texinfo:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo
+	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
+	@echo "Run \`make' in that directory to run these through makeinfo" \
+	      "(use \`make info' here to do that automatically)."
+
+info:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo "Running Texinfo files through makeinfo..."
+	make -C $(BUILDDIR)/texinfo info
+	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
+
+gettext:
+	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
+	@echo
+	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
+
+changes:
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
+	@echo
+	@echo "The overview file is in $(BUILDDIR)/changes."
+
+linkcheck:
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in $(BUILDDIR)/linkcheck/output.txt."
+
+doctest:
+	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
+	@echo "Testing of doctests in the sources finished, look at the " \
+	      "results in $(BUILDDIR)/doctest/output.txt."

docs/changelog.rst

@@ -0,0 +1 @@
+.. include:: ../CHANGES

docs/conf.py

@@ -0,0 +1,311 @@
+# -*- coding: utf-8 -*-
+#
+# Flask-Security documentation build configuration file, created by
+# sphinx-quickstart on Mon Mar 12 15:35:21 2012.
+#
+# This file is execfile()d with the current directory set to its containing dir.
+#
+# Note that not all possible configuration values are present in this
+# autogenerated file.
+#
+# All configuration values have a default; values that are commented out
+# serve to show the default.
+
+import sys, os
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+sys.path.insert(0, os.path.abspath('..'))
+sys.path.append(os.path.abspath('_themes'))
+#from setup import __version__
+
+# -- General configuration -----------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+#needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be extensions
+# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
+extensions = ['sphinx.ext.autodoc', 'sphinx.ext.intersphinx']
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix of source filenames.
+source_suffix = '.rst'
+
+# The encoding of source files.
+#source_encoding = 'utf-8-sig'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = u'Flask-Security'
+copyright = u'2012, Matt Wright'
+
+# The version info for the project you're documenting, acts as replacement for
+# |version| and |release|, also used in various other places throughout the
+# built documents.
+#
+# The short X.Y version.
+version = '1.2.3'
+# The full version, including alpha/beta/rc tags.
+release = version
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+#language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+#today = ''
+# Else, today_fmt is used as the format for a strftime call.
+#today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+exclude_patterns = ['_build']
+
+# The reST default role (used for this markup: `text`) to use for all documents.
+#default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+#add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+#add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+#show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# A list of ignored prefixes for module index sorting.
+#modindex_common_prefix = []
+
+
+# -- Options for HTML output ---------------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  Major themes that come with
+# Sphinx are currently 'default' and 'sphinxdoc'.
+html_theme = 'flask_small'
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+html_theme_options = {
+    'github_fork': 'mattupstate/flask-security',
+    'index_logo': False
+}
+
+# Add any paths that contain custom themes here, relative to this directory.
+html_theme_path = ['_themes']
+
+# The name for this set of Sphinx documents.  If None, it defaults to
+# "<project> v<release> documentation".
+#html_title = None
+
+# A shorter title for the navigation bar.  Default is the same as html_title.
+#html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+#html_logo = None
+
+# The name of an image file (within the static path) to use as favicon of the
+# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+#html_favicon = None
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['_static']
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+#html_last_updated_fmt = '%b %d, %Y'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+#html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+#html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+#html_additional_pages = {}
+
+# If false, no module index is generated.
+#html_domain_indices = True
+
+# If false, no index is generated.
+#html_use_index = True
+
+# If true, the index is split into individual pages for each letter.
+#html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+#html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+#html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+#html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it.  The value of this option must be the
+# base URL from which the finished HTML is served.
+#html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+#html_file_suffix = None
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'Flask-Securitydoc'
+
+
+# -- Options for LaTeX output --------------------------------------------------
+
+latex_elements = {
+# The paper size ('letterpaper' or 'a4paper').
+#'papersize': 'letterpaper',
+
+# The font size ('10pt', '11pt' or '12pt').
+#'pointsize': '10pt',
+
+# Additional stuff for the LaTeX preamble.
+#'preamble': '',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title, author, documentclass [howto/manual]).
+latex_documents = [
+  ('index', 'Flask-Security.tex', u'Flask-Security Documentation',
+   u'Matt Wright', 'manual'),
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+#latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+#latex_use_parts = False
+
+# If true, show page references after internal links.
+#latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+#latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+#latex_appendices = []
+
+# If false, no module index is generated.
+#latex_domain_indices = True
+
+
+# -- Options for manual page output --------------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    ('index', 'flask-security', u'Flask-Security Documentation',
+     [u'Matt Wright'], 1)
+]
+
+# If true, show URL addresses after external links.
+#man_show_urls = False
+
+
+# -- Options for Texinfo output ------------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+  ('index', 'Flask-Security', u'Flask-Security Documentation',
+   u'Matt Wright', 'Flask-Security', 'One line description of project.',
+   'Miscellaneous'),
+]
+
+# Documents to append as an appendix to all manuals.
+#texinfo_appendices = []
+
+# If false, no module index is generated.
+#texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+#texinfo_show_urls = 'footnote'
+
+
+# -- Options for Epub output ---------------------------------------------------
+
+# Bibliographic Dublin Core info.
+epub_title = u'Flask-Security'
+epub_author = u'Matt Wright'
+epub_publisher = u'Matt Wright'
+epub_copyright = u'2012, Matt Wright'
+
+# The language of the text. It defaults to the language option
+# or en if the language is not set.
+#epub_language = ''
+
+# The scheme of the identifier. Typical schemes are ISBN or URL.
+#epub_scheme = ''
+
+# The unique identifier of the text. This can be a ISBN number
+# or the project homepage.
+#epub_identifier = ''
+
+# A unique identification for the text.
+#epub_uid = ''
+
+# A tuple containing the cover image and cover page html template filenames.
+#epub_cover = ()
+
+# HTML files that should be inserted before the pages created by sphinx.
+# The format is a list of tuples containing the path and title.
+#epub_pre_files = []
+
+# HTML files shat should be inserted after the pages created by sphinx.
+# The format is a list of tuples containing the path and title.
+#epub_post_files = []
+
+# A list of files that should not be packed into the epub file.
+#epub_exclude_files = []
+
+# The depth of the table of contents in toc.ncx.
+#epub_tocdepth = 3
+
+# Allow duplicate toc entries.
+#epub_tocdup = True
+
+
+# Example configuration for intersphinx: refer to the Python standard library.
+intersphinx_mapping = {'http://docs.python.org/': None}
+
+pygments_style = 'flask_theme_support.FlaskyStyle'
+
+# fall back if theme is not there
+try:
+    __import__('flask_theme_support')
+except ImportError, e:
+    print '-' * 74
+    print 'Warning: Flask themes unavailable.  Building with default theme'
+    print 'If you want the Flask themes, run this command and build again:'
+    print
+    print '  git submodule update --init'
+    print '-' * 74
+
+    pygments_style = 'tango'
+    html_theme = 'default'
+    html_theme_options = {}

docs/index.rst

@@ -0,0 +1,347 @@
+.. Flask-Security documentation master file, created by
+   sphinx-quickstart on Mon Mar 12 15:35:21 2012.
+   You can adapt this file completely to your liking, but it should at least
+   contain the root `toctree` directive.
+
+Flask-Security
+==============
+
+.. module:: flask_security
+
+Simple security for Flask applications combining 
+`Flask-Login <http://packages.python.org/Flask-Login/>`_, 
+`Flask-Principal <http://packages.python.org/Flask-Principal/>`_, 
+`Flask-WTF <http://packages.python.org/Flask-WTF/>`_, 
+`passlib <http://packages.python.org/passlib/>`_, and your choice of datastore. 
+Currently `SQLAlchemy <http://www.sqlalchemy.org>`_ via 
+`Flask-SQLAlchemy <http://packages.python.org/Flask-SQLAlchemy/>`_ and 
+`MongoEngine <http://www.mongoengine.org/>`_ via 
+`Flask-MongoEngine <https://github.com/sbook/flask-mongoengine/>`_ are supported 
+out of the box. You will need to install the necessary Flask extensions that 
+you'll be using on your own. Additionally, you may need to install an encryption 
+library such as `py-bcrypt <http://www.mindrot.org/projects/py-bcrypt/>`_ (if 
+you plan to use bcrypt) for your desired encryption method.
+
+
+Contents
+=========
+* :ref:`overview`
+* :ref:`installation`
+* :ref:`getting-started`
+* :ref:`additional-user-fields`
+* :ref:`flask-script-commands`
+* :ref:`api`
+* :doc:`Changelog </changelog>`
+
+
+.. _overview:
+
+Overview
+========
+
+Flask-Security does a few things that Flask-Login and Flask-Principal don't 
+provide out of the box. They are:
+
+1. Setting up login and logout endpoints
+2. Authenticating users based on username or email
+3. Limiting access based on user 'roles'
+4. User and role creation
+5. Password encryption
+
+That being said, you can still hook into things such as the Flask-Login and 
+Flask-Principal signals if need be.
+
+
+.. _installation:
+
+Installation
+============
+
+First, install Flask-Security::
+
+    $ mkvirtualenv app-name
+    $ pip install Flask-Security
+    
+Then install your datastore requirement. 
+
+**SQLAlchemy**::
+
+    $ pip install Flask-SQLAlchemy
+    
+**MongoEngine**::
+
+    $ pip install https://github.com/sbook/flask-mongoengine/tarball/master
+
+
+.. _getting-started:
+
+Getting Started
+===============
+
+The following code samples will illustrate how to get started using SQLAlchemy. 
+First thing you'll want to do is setup your application and datastore::
+
+    from flask import Flask, render_template
+    from flask.ext.sqlalchemy import SQLAlchemy
+    from flask.ext.security import (User, Security, LoginForm,  login_required, 
+                                    roles_accepted, user_datastore)
+    from flask.ext.security.datastore.sqlalchemy import SQLAlchemyUserDatastore
+    
+    app = Flask(__name__)
+    app.config['SECRET_KEY'] = 'secret'
+    app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///:memory:'
+    
+    db = SQLAlchemy(app)
+    Security(app, SQLAlchemyUserDatastore(db))
+
+You'll probably want to at least one user to the database to test this out. 
+There are many ways to do this, but this is a quick and dirty way to do it::
+
+    @app.before_first_request
+    def before_first_request():
+        user_datastore.create_role(name='admin')
+        user_datastore.create_user(username='matt', email='matt@something.com',
+                                   password='password', roles=['admin'])
+        
+Next you'll want to setup your login screen. Setup your view::
+
+    @app.route("/login")
+    def login():
+        return render_template('login.html', form=LoginForm())
+    
+And corresponding template::
+
+    <form action="{{ url_for('auth.authenticate') }}" method="POST">
+      {{ form.hidden_tag() }}
+      {{ form.username.label }} {{ form.username }}<br/>
+      {{ form.password.label }} {{ form.password }}<br/>
+      {{ form.remember.label }} {{ form.remember }}<br/>
+      {{ form.submit }}
+    </form>
+    
+By default, Flask-Security will redirect a user to `/profile` after logging in. 
+You can set this page up yourself or set the `SECURITY_POST_LOGIN` config 
+value to change this behavior. Regardless, setup a protected view as such::
+
+    @app.route('/profile')
+    @login_required
+    def profile():
+        return render_template('profile.html')
+         
+Now you have an application with basic authentication. If you run the local 
+development server you can visit `http://localhost:5000/login <http://localhost:5000/login>`_ 
+to login.
+
+The last thing you'll want to do is add a logout link to your templates. This 
+can be achieved with::
+
+    <a href="{{ url_for('auth.logout') }}">Logout</a>
+    
+Now, for instance, say you want to protect an admin area to users that are 
+administrators. You can use the `roles_accepted` decorator to prevent access. 
+The corresponding view would look like such::
+
+    @app.route('/admin')
+    @roles_accepted('admin')
+    def admin():
+        return render_template('admin/index.html')
+        
+And lastly, maybe you only want to show something in a template if a user has a 
+specific role::
+
+    {% if current_user.has_role('admin') %}
+      <a href="{{ url_for('admin.index') }}">Admin Panel</a>
+    {$ endif %}
+
+
+.. _additional-user-fields:
+
+Additional User Fields
+----------------------
+If you'd like to add additional fields to the user model you can use a mixin
+class that specifies your additional fields. The following is an example of
+how you might do this::
+
+    db = SQLAlchemy(app)
+
+    class UserAccountMixin():
+        first_name = db.Column(db.String(120))
+        last_name = db.Column(db.String(120))
+
+    Security(app, SQLAlchemyUserDatastore(db, UserAccountMixin))
+
+.. _flask-script-commands:
+
+Flask-Script Commands
+---------------------
+Flask-Security comes packed with a few Flask-Script commands. They are:
+
+* :class:`flask.ext.security.script.CreateUserCommand`
+* :class:`flask.ext.security.script.CreateRoleCommand`
+* :class:`flask.ext.security.script.AddRoleCommand`
+* :class:`flask.ext.security.script.RemoveRoleCommand`
+* :class:`flask.ext.security.script.DeactivateUserCommand`
+* :class:`flask.ext.security.script.ActivateUserCommand`
+
+Register these on your script manager for pure convenience.
+        
+
+.. _configuration:
+
+Configuration Values
+====================
+
+* :attr:`SECURITY_URL_PREFIX`: Specifies the URL prefix for the Security 
+  blueprint
+* :attr:`SECURITY_AUTH_PROVIDER`: Specifies the class to use as the 
+  authentication provider. Such as `flask.ext.security.AuthenticationProvider`
+* :attr:`SECURITY_PASSWORD_HASH`: Specifies the encryption method to use. e.g.: 
+  plaintext, bcrypt, etc
+* :attr:`SECURITY_USER_DATASTORE`: Specifies the property name to use for the 
+  user datastore on the application instance
+* :attr:`SECURITY_LOGIN_FORM`: Specifies the form class to use when processing 
+  an authentication request
+* :attr:`SECURITY_AUTH_URL`: Specifies the URL to to handle authentication 
+* :attr:`SECURITY_LOGOUT_URL`: Specifies the URL to process a logout request
+* :attr:`SECURITY_LOGIN_VIEW`: Specifies the URL to redirect to when 
+  authentication is required
+* :attr:`SECURITY_POST_LOGIN`: Specifies the URL to redirect to after a user is 
+  authenticated
+* :attr:`SECURITY_POST_LOGOUT`: Specifies the URL to redirect to after a user 
+  logs out
+* :attr:`SECURITY_FLASH_MESSAGES`: Specifies wether or not to flash messages 
+  during authentication request
+
+
+.. _api:
+
+API
+===
+
+.. autoclass:: flask_security.Security
+    :members:
+
+.. data:: flask_security.current_user
+
+   A proxy for the current user.
+   
+
+Protecting Views
+----------------
+.. autofunction:: flask_security.login_required
+    
+.. autofunction:: flask_security.roles_required
+
+.. autofunction:: flask_security.roles_accepted
+
+
+User Object Helpers
+-------------------
+.. autoclass:: flask_security.UserMixin
+   :members:
+   
+.. autoclass:: flask_security.RoleMixin
+   :members:
+
+.. autoclass:: flask_security.AnonymousUser
+   :members:
+
+
+Datastores
+----------
+.. autoclass:: flask_security.datastore.UserDatastore
+    :members:
+    
+.. autoclass:: flask_security.datastore.sqlalchemy.SQLAlchemyUserDatastore
+    :members:
+    :inherited-members:
+    
+.. autoclass:: flask_security.datastore.mongoengine.MongoEngineUserDatastore
+    :members:
+    :inherited-members:
+
+
+Models
+------
+.. autoclass:: flask_security.User
+    
+    .. attribute:: id
+       
+       User ID
+       
+    .. attribute:: username
+       
+       Username
+       
+    .. attribute:: email
+       
+       Email address
+       
+    .. attribute:: password
+    
+       Password
+       
+    .. attribute:: active
+    
+       Active state
+       
+    .. attribute:: roles
+    
+       User roles
+       
+    .. attribute:: created_at
+    
+       Created date
+       
+    .. attribute:: modified_at
+    
+       Modified date
+        
+        
+.. autoclass:: flask_security.Role
+
+    .. attribute:: id
+    
+       Role ID
+       
+    .. attribute:: name
+    
+       Role name
+       
+    .. attribute:: description
+    
+       Role description
+       
+
+Exceptions
+----------    
+.. autoexception:: flask_security.BadCredentialsError
+
+.. autoexception:: flask_security.AuthenticationError
+
+.. autoexception:: flask_security.UserNotFoundError
+
+.. autoexception:: flask_security.RoleNotFoundError
+
+.. autoexception:: flask_security.UserIdNotFoundError
+
+.. autoexception:: flask_security.UserDatastoreError
+
+.. autoexception:: flask_security.UserCreationError
+
+.. autoexception:: flask_security.RoleCreationError
+
+
+Signals
+-------
+See the documentation for the signals provided by the Flask-Login and 
+Flask-Principal extensions. Flask-Security does not provide any additional 
+signals. 
+
+
+Changelog
+=========
+.. toctree::
+   :maxdepth: 2
+
+   changelog

example/app.py

@@ -84,7 +84,12 @@ def create_sqlalchemy_app(auth_config=None):
     app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:////tmp/flask_security_example.sqlite'
     
     db = SQLAlchemy(app)
-    Security(app, SQLAlchemyUserDatastore(db))
+
+    class UserAccountMixin():
+        first_name = db.Column(db.String(120))
+        last_name = db.Column(db.String(120))
+
+    Security(app, SQLAlchemyUserDatastore(db, UserAccountMixin))
     
     @app.before_first_request
     def before_first_request():
@@ -101,7 +106,12 @@ def create_mongoengine_app(auth_config=None):
     app.config['MONGODB_PORT'] = 27017
     
     db = MongoEngine(app)
-    Security(app, MongoEngineUserDatastore(db))
+
+    class UserAccountMixin():
+        first_name = db.StringField(max_length=120)
+        last_name = db.StringField(max_length=120)
+
+    Security(app, MongoEngineUserDatastore(db, UserAccountMixin))
     
     @app.before_first_request
     def before_first_request():

example/templates/login.html

@@ -5,6 +5,7 @@
   {{ form.username.label }} {{ form.username }}<br/>
   {{ form.password.label }} {{ form.password }}<br/>
   {{ form.remember.label }} {{ form.remember }}<br/>
+  {{ form.next }}
   {{ form.submit }}
 </form>
 <p>{{ content }}</p>

flask_security/__init__.py

@@ -1,52 +1,53 @@
 # -*- coding: utf-8 -*-
 """
     flask.ext.security
-    ~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~
 
-    Flask-Security is a Flask extension module that aims to add quick and
-    simple security via Flask-Login and Flask-Principal.
+    Flask-Security is a Flask extension that aims to add quick and simple
+    security via Flask-Login, Flask-Principal, Flask-WTF, and passlib.
 
     :copyright: (c) 2012 by Matt Wright.
     :license: MIT, see LICENSE for more details.
 """
-from __future__ import absolute_import
-
-import sys
-
-from datetime import datetime
-from types import StringType
-
-from flask import (current_app, Blueprint, flash, redirect, request, 
-    session, _request_ctx_stack, url_for, abort, g)
-
-from flask.ext.login import (AnonymousUser as AnonymousUserBase, 
-    UserMixin as BaseUserMixin, LoginManager, login_required, login_user, 
-    logout_user, current_user, user_logged_in, user_logged_out)
-
-from flask.ext.principal import (Identity, Principal, RoleNeed, UserNeed,
-    Permission, AnonymousIdentity, identity_changed, identity_loaded)
-
-from flask.ext.wtf import (Form, TextField, PasswordField, SubmitField, 
-    HiddenField, Required, ValidationError, BooleanField, Email)
 
 from functools import wraps
+
+from flask import current_app, Blueprint, flash, redirect, request, \
+     session, url_for
+
+from flask.ext.login import AnonymousUser as AnonymousUserBase, \
+     UserMixin as BaseUserMixin, LoginManager, login_required, login_user, \
+     logout_user, current_user, login_url
+
+from flask.ext.principal import Identity, Principal, RoleNeed, UserNeed, \
+     Permission, AnonymousIdentity, identity_changed, identity_loaded
+
+from flask.ext.wtf import Form, TextField, PasswordField, SubmitField, \
+     HiddenField, Required, BooleanField
+
 from passlib.context import CryptContext
-from werkzeug.utils import import_string
+
 from werkzeug.local import LocalProxy
 
 
-User, Role = None, None
+class User(object):
+    """User model"""
 
-URL_PREFIX_KEY =     'SECURITY_URL_PREFIX'
-AUTH_PROVIDER_KEY =  'SECURITY_AUTH_PROVIDER'
-PASSWORD_HASH_KEY =  'SECURITY_PASSWORD_HASH'
+
+class Role(object):
+    """Role model"""
+
+URL_PREFIX_KEY = 'SECURITY_URL_PREFIX'
+AUTH_PROVIDER_KEY = 'SECURITY_AUTH_PROVIDER'
+PASSWORD_HASH_KEY = 'SECURITY_PASSWORD_HASH'
 USER_DATASTORE_KEY = 'SECURITY_USER_DATASTORE'
-LOGIN_FORM_KEY =     'SECURITY_LOGIN_FORM'
-AUTH_URL_KEY =       'SECURITY_AUTH_URL'
-LOGOUT_URL_KEY =     'SECURITY_LOGOUT_URL'
-LOGIN_VIEW_KEY =     'SECURITY_LOGIN_VIEW'
-POST_LOGIN_KEY =     'SECURITY_POST_LOGIN'
-POST_LOGOUT_KEY =    'SECURITY_POST_LOGOUT'
+LOGIN_FORM_KEY = 'SECURITY_LOGIN_FORM'
+AUTH_URL_KEY = 'SECURITY_AUTH_URL'
+LOGOUT_URL_KEY = 'SECURITY_LOGOUT_URL'
+LOGIN_VIEW_KEY = 'SECURITY_LOGIN_VIEW'
+POST_LOGIN_KEY = 'SECURITY_POST_LOGIN'
+POST_LOGOUT_KEY = 'SECURITY_POST_LOGOUT'
+FLASH_MESSAGES_KEY = 'SECURITY_FLASH_MESSAGES'
 
 DEBUG_LOGIN = 'User %s logged in. Redirecting to: %s'
 ERROR_LOGIN = 'Unsuccessful authentication attempt: %s. Redirecting to: %s'
@@ -54,8 +55,10 @@ DEBUG_LOGOUT = 'User logged out, redirecting to: %s'
 FLASH_INACTIVE = 'Inactive user'
 FLASH_PERMISSIONS = 'You do not have permission to view this resource.'
 
+#: Default Flask-Security configuration
 default_config = {
     URL_PREFIX_KEY:     None,
+    FLASH_MESSAGES_KEY: True,
     PASSWORD_HASH_KEY:  'plaintext',
     USER_DATASTORE_KEY: 'user_datastore',
     AUTH_PROVIDER_KEY:  'flask.ext.security.AuthenticationProvider',
@@ -72,40 +75,47 @@ class BadCredentialsError(Exception):
     """Raised when an authentication attempt fails due to an error with the
     provided credentials.
     """
-    
+
+
 class AuthenticationError(Exception):
     """Raised when an authentication attempt fails due to invalid configuration
     or an unknown reason.
-    """ 
-    
+    """
+
+
 class UserNotFoundError(Exception):
-    """Raised by a user datastore when there is an attempt to find a user by 
+    """Raised by a user datastore when there is an attempt to find a user by
     their identifier, often username or email, and the user is not found.
     """
-    
+
+
 class RoleNotFoundError(Exception):
     """Raised by a user datastore when there is an attempt to find a role and
     the role cannot be found.
     """
-    
+
+
 class UserIdNotFoundError(Exception):
-    """Raised by a user datastore when there is an attempt to find a user by 
+    """Raised by a user datastore when there is an attempt to find a user by
     ID and the user is not found.
     """
-     
+
+
 class UserDatastoreError(Exception):
-    """Raise when a user datastore experiences an unexpected error
+    """Raised when a user datastore experiences an unexpected error
     """
-    
+
+
 class UserCreationError(Exception):
-    """Raise when an error occurs when creating a user
+    """Raised when an error occurs when creating a user
     """
-    
+
+
 class RoleCreationError(Exception):
-    """Raise when an error occurs when creating a role
+    """Raised when an error occurs when creating a role
     """
-    
-         
+
+
 #: App logger for convenience
 logger = LocalProxy(lambda: current_app.logger)
 
@@ -118,73 +128,109 @@ login_manager = LocalProxy(lambda: current_app.login_manager)
 #: Password encyption context
 pwd_context = LocalProxy(lambda: current_app.pwd_context)
 
-# User service
-user_datastore = LocalProxy(lambda: getattr(current_app, 
+#: User datastore
+user_datastore = LocalProxy(lambda: getattr(current_app,
     current_app.config[USER_DATASTORE_KEY]))
 
+
 def roles_required(*args):
+    """View decorator which specifies that a user must have all the specified
+    roles. Example::
+
+        @app.route('/dashboard')
+        @roles_required('admin', 'editor')
+        def dashboard():
+            return 'Dashboard'
+
+    The current user must have both the `admin` role and `editor` role in order
+    to view the page.
+
+    :param args: The required roles.
+    """
     roles = args
     perm = Permission(*[RoleNeed(role) for role in roles])
+
     def wrapper(fn):
         @wraps(fn)
         def decorated_view(*args, **kwargs):
             if not current_user.is_authenticated():
-                return redirect(current_app.config[LOGIN_VIEW_KEY])
-            
+                return redirect(
+                    login_url(current_app.config[LOGIN_VIEW_KEY], request.url))
+
             if perm.can():
                 return fn(*args, **kwargs)
-            
+
             logger.debug('Identity does not provide all of the '
                          'following roles: %s' % [r for r in roles])
-            
-            flash(FLASH_PERMISSIONS, 'error')
+
+            do_flash(FLASH_PERMISSIONS, 'error')
             return redirect(request.referrer or '/')
         return decorated_view
     return wrapper
 
 
 def roles_accepted(*args):
+    """View decorator which specifies that a user must have at least one of the
+    specified roles. Example::
+
+        @app.route('/create_post')
+        @roles_accepted('editor', 'author')
+        def create_post():
+            return 'Create Post'
+
+    The current user must have either the `editor` role or `author` role in
+    order to view the page.
+
+    :param args: The possible roles.
+    """
     roles = args
     perms = [Permission(RoleNeed(role)) for role in roles]
+
     def wrapper(fn):
         @wraps(fn)
         def decorated_view(*args, **kwargs):
             if not current_user.is_authenticated():
-                return redirect(current_app.config[LOGIN_VIEW_KEY])
-            
+                return redirect(
+                    login_url(current_app.config[LOGIN_VIEW_KEY], request.url))
+
             for perm in perms:
                 if perm.can():
                     return fn(*args, **kwargs)
-                
+
             logger.debug('Identity does not provide at least one of '
                          'the following roles: %s' % [r for r in roles])
-            
-            flash(FLASH_PERMISSIONS, 'error')
+
+            do_flash(FLASH_PERMISSIONS, 'error')
             return redirect(request.referrer or '/')
         return decorated_view
     return wrapper
 
 
 class RoleMixin(object):
+    """Mixin for `Role` model definitions"""
     def __eq__(self, other):
-        return self.name == other.name
-    
+        return self.name == other or self.name == getattr(other, 'name', None)
+
     def __ne__(self, other):
-        return self.name != other.name
-        
+        return self.name != other and self.name != getattr(other, 'name', None)
+
     def __str__(self):
         return '<Role name=%s, description=%s>' % (self.name, self.description)
 
 
 class UserMixin(BaseUserMixin):
+    """Mixin for `User` model definitions"""
+
     def is_active(self):
+        """Returns `True` if the user is active."""
         return self.active
-    
+
     def has_role(self, role):
-        if not isinstance(role, Role):
-            role = Role(name=role)
+        """Returns `True` if the user identifies with the specified role.
+
+        :param role: A role name or `Role` instance"""
         return role in self.roles
-    
+
     def __str__(self):
         ctx = (str(self.id), self.username, self.email)
         return '<User id=%s, username=%s, email=%s>' % ctx
@@ -193,82 +239,89 @@ class UserMixin(BaseUserMixin):
 class AnonymousUser(AnonymousUserBase):
     def __init__(self):
         super(AnonymousUser, self).__init__()
-        self.roles = [] # TODO: Make this immutable?
-        
+        self.roles = []  # TODO: Make this immutable?
+
     def has_role(self, *args):
+        """Returns `False`"""
         return False
 
 
 class Security(object):
+    """The :class:`Security` class initializes the Flask-Security extension.
+
+    :param app: The application.
+    :param datastore: An instance of a user datastore.
+    """
     def __init__(self, app=None, datastore=None):
         self.init_app(app, datastore)
-    
+
     def init_app(self, app, datastore):
-        """Initialize the application
-        
-        :param app: An instance of an application
-        :param datastore: An instance of a datastore for your users
+        """Initializes the Flask-Security extension for the specified
+        application and datastore implentation.
+
+        :param app: The application.
+        :param datastore: An instance of a user datastore.
         """
-        if app is None or datastore is None: return
-        
+        if app is None or datastore is None:
+            return
+
+        # TODO: change blueprint name
         blueprint = Blueprint('auth', __name__)
-        
+
         configured = {}
-        
+
         for key, value in default_config.items():
             configured[key] = app.config.get(key, value)
-        
+
         app.config.update(configured)
         config = app.config
-        #config = default_config.copy()
-        #config.update(app.config.get(AUTH_CONFIG_KEY, {}))
-        #app.config[AUTH_CONFIG_KEY] = config
-        
+
         # setup the login manager extension
         login_manager = LoginManager()
         login_manager.anonymous_user = AnonymousUser
         login_manager.login_view = config[LOGIN_VIEW_KEY]
         login_manager.setup_app(app)
         app.login_manager = login_manager
-        
+
         Provider = get_class_from_config(AUTH_PROVIDER_KEY, config)
         Form = get_class_from_config(LOGIN_FORM_KEY, config)
         pw_hash = config[PASSWORD_HASH_KEY]
-        
+
         app.pwd_context = CryptContext(schemes=[pw_hash], default=pw_hash)
         app.auth_provider = Provider(Form)
         app.principal = Principal(app)
-        
+
         from flask.ext import security as s
         s.User, s.Role = datastore.get_models()
-        
+
         setattr(app, config[USER_DATASTORE_KEY], datastore)
-        
+
         @identity_loaded.connect_via(app)
         def on_identity_loaded(sender, identity):
             if hasattr(current_user, 'id'):
                 identity.provides.add(UserNeed(current_user.id))
-                
+
             for role in current_user.roles:
                 identity.provides.add(RoleNeed(role.name))
-            
+
             identity.user = current_user
-        
+
         @login_manager.user_loader
         def load_user(user_id):
-            try: 
+            try:
                 return datastore.with_id(user_id)
             except Exception, e:
-                logger.error('Error getting user: %s' % e) 
+                logger.error('Error getting user: %s' % e)
                 return None
-            
+
         auth_url = config[AUTH_URL_KEY]
+
         @blueprint.route(auth_url, methods=['POST'], endpoint='authenticate')
         def authenticate():
             try:
                 form = Form()
                 user = auth_provider.authenticate(form)
-                
+
                 if login_user(user, remember=form.remember.data):
                     redirect_url = get_post_login_redirect()
                     identity_changed.send(app, identity=Identity(user.id))
@@ -276,66 +329,84 @@ class Security(object):
                     return redirect(redirect_url)
 
                 raise BadCredentialsError(FLASH_INACTIVE)
-                
+
             except BadCredentialsError, e:
                 message = '%s' % e
-                flash(message, 'error')
+                do_flash(message, 'error')
                 redirect_url = request.referrer or login_manager.login_view
                 logger.error(ERROR_LOGIN % (message, redirect_url))
                 return redirect(redirect_url)
-    
+
         @blueprint.route(config[LOGOUT_URL_KEY], endpoint='logout')
         @login_required
         def logout():
             for value in ('identity.name', 'identity.auth_type'):
                 session.pop(value, None)
-            
+
             identity_changed.send(app, identity=AnonymousIdentity())
             logout_user()
-            
+
             redirect_url = find_redirect(POST_LOGOUT_KEY)
             logger.debug(DEBUG_LOGOUT % redirect_url)
             return redirect(redirect_url)
-        
+
         app.register_blueprint(blueprint, url_prefix=config[URL_PREFIX_KEY])
-        
-        
+
+
 class LoginForm(Form):
-    """Default login form"""
-    
-    username = TextField("Username or Email", 
+    """The default login form"""
+
+    username = TextField("Username or Email",
         validators=[Required(message="Username not provided")])
-    password = PasswordField("Password", 
+    password = PasswordField("Password",
         validators=[Required(message="Password not provided")])
     remember = BooleanField("Remember Me")
     next = HiddenField()
     submit = SubmitField("Login")
-    
+
     def __init__(self, *args, **kwargs):
         super(LoginForm, self).__init__(*args, **kwargs)
         self.next.data = request.args.get('next', None)
-    
+
 
 class AuthenticationProvider(object):
-    """Default authentication provider"""
-    
+    """The default authentication provider implementation.
+
+    :param login_form_class: The login form class to use when authenticating a
+                             user
+    """
+
     def __init__(self, login_form_class=None):
         self.login_form_class = login_form_class or LoginForm
-        
+
     def login_form(self, formdata=None):
+        """Returns an instance of the login form with the provided form.
+
+        :param formdata: The incoming form data"""
         return self.login_form_class(formdata)
-    
+
     def authenticate(self, form):
-        # first some basic validation
+        """Processes an authentication request and returns a user instance if
+        authentication is successful.
+
+        :param form: An instance of a populated login form
+        """
         if not form.validate():
             if form.username.errors:
                 raise BadCredentialsError(form.username.errors[0])
             if form.password.errors:
                 raise BadCredentialsError(form.password.errors[0])
-        
+
         return self.do_authenticate(form.username.data, form.password.data)
-        
+
     def do_authenticate(self, user_identifier, password):
+        """Returns the authenticated user if authentication is successfull. If
+        authentication fails an appropriate error is raised
+
+        :param user_identifier: The user's identifier, either an email address
+                                or username
+        :param password: The user's unencrypted password
+        """
         try:
             user = user_datastore.find_user(user_identifier)
         except AttributeError, e:
@@ -346,51 +417,70 @@ class AuthenticationProvider(object):
             self.auth_error('Invalid user service: %s' % e)
         except Exception, e:
             self.auth_error('Unexpected authentication error: %s' % e)
-        
+
         # compare passwords
         if pwd_context.verify(password, user.password):
             return user
 
         # bad match
         raise BadCredentialsError("Password does not match")
-    
+
     def auth_error(self, msg):
+        """Sends an error log message and raises an authentication error.
+
+        :param msg: An authentication error message"""
         logger.error(msg)
         raise AuthenticationError(msg)
 
 
+def do_flash(message, category):
+    if current_app.config[FLASH_MESSAGES_KEY]:
+        flash(message, category)
+
+
 def get_class_by_name(clazz):
+    """Get a reference to a class by its string representation."""
     parts = clazz.split('.')
     module = ".".join(parts[:-1])
-    m = __import__( module )
+    m = __import__(module)
     for comp in parts[1:]:
-        m = getattr(m, comp)            
+        m = getattr(m, comp)
     return m
 
+
 def get_class_from_config(key, config):
+    """Get a reference to a class by its configuration key name."""
     try:
         return get_class_by_name(config[key])
     except Exception, e:
         raise AttributeError(
-            "Could not get class '%s' for Auth setting '%s' >> %s" %  
-            (config[key], key, e)) 
+            "Could not get class '%s' for Auth setting '%s' >> %s" %
+            (config[key], key, e))
+
+
+def get_url(endpoint_or_url):
+    """Returns a URL if a valid endpoint is found. Otherwise, returns the
+    provided value."""
+    try:
+        return url_for(endpoint_or_url)
+    except:
+        return endpoint_or_url
 
-def get_url(value):
-    # try building the url or assume its a url already
-    try: return url_for(value)
-    except: return value
 
 def get_post_login_redirect():
-    return (get_url(request.args.get('next')) or 
-            get_url(request.form.get('next')) or 
+    """Returns the URL to redirect to after a user logs in successfully"""
+    return (get_url(request.args.get('next')) or
+            get_url(request.form.get('next')) or
             find_redirect(POST_LOGIN_KEY))
 
+
 def find_redirect(key):
-    # Look in the session first, and if not there go to the config, and
-    # if its not there either just go to the root url
-    result = (get_url(session.get(key.lower(), None)) or 
-              get_url(current_app.config[key] or None) or '/')
-    # Try and delete the session value if it was used
-    try: del session[key.lower()]
-    except: pass
+    """Returns the URL to redirect to after a user logs in successfully"""
+    result = (get_url(session.pop(key.lower(), None)) or
+              get_url(current_app.config[key.upper()] or None) or '/')
+
+    try:
+        del session[key.lower()]
+    except:
+        pass
     return result

flask_security/datastore/__init__.py

@@ -1,39 +1,67 @@
+# -*- coding: utf-8 -*-
+"""
+    flask.ext.security.datastore
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    This module contains an abstracted user datastore.
+
+    :copyright: (c) 2012 by Matt Wright.
+    :license: MIT, see LICENSE for more details.
+"""
+
 from datetime import datetime
 from flask.ext import security
 from flask.ext.security import UserCreationError, RoleCreationError, pwd_context
 
+
 class UserDatastore(object):
-    """Abstracted user datastore. Always extend this and implement
-    missing methods"""
-    
+    """Abstracted user datastore. Always extend this class and implement the
+    :attr:`get_models`, :attr:`_save_model`, :attr:`_do_with_id`,
+    :attr:`_do_find_user`,  and :attr:`_do_find_role` methods.
+
+    :param db: An instance of a configured databse manager from a Flask
+               extension such as Flask-SQLAlchemy or Flask-MongoEngine
+    :param user_account_mixin: An optional mixin class that specifies additional
+                               fields to be added to the user model
+    """
+    def __init__(self, db, user_account_mixin=None):
+        self.db = db
+        self.user_account_mixin = user_account_mixin or object
+
+    def get_models(self):
+        """Returns configured `User` and `Role` models for the datastore
+        implementation"""
+        raise NotImplementedError(
+            "User datastore does not implement get_models method")
+
     def _save_model(self, model, **kwargs):
         raise NotImplementedError(
             "User datastore does not implement _save_model method")
-    
+
     def _do_with_id(self, id):
         raise NotImplementedError(
             "User datastore does not implement _do_with_id method")
-    
+
     def _do_find_user(self):
         raise NotImplementedError(
             "User datastore does not implement _do_find_user method")
-    
+
     def _do_find_role(self):
         raise NotImplementedError(
             "User datastore does not implement _do_find_role method")
-        
+
     def _do_add_role(self, user, role):
         user, role = self._prepare_role_modify_args(user, role)
         if role not in user.roles:
             user.roles.append(role)
         return user
-        
+
     def _do_remove_role(self, user, role):
         user, role = self._prepare_role_modify_args(user, role)
         if role in user.roles:
             user.roles.remove(role)
         return user
-    
+
     def _do_toggle_active(self, user, active=None):
         user = self.find_user(user)
         if active is None:
@@ -41,91 +69,137 @@ class UserDatastore(object):
         elif active != user.active:
             user.active = active
         return user
-    
+
     def _do_deactive_user(self, user):
         return self._do_toggle_active(user, False)
-    
+
     def _do_active_user(self, user):
         return self._do_toggle_active(user, True)
-    
+
     def _prepare_role_modify_args(self, user, role):
         if isinstance(user, security.User):
             user = user.username or user.email
-        
+
         if isinstance(role, security.Role):
             role = role.name
-            
+
         return self.find_user(user), self.find_role(role)
-        
+
     def _prepare_create_role_args(self, kwargs):
         for key in ('name', 'description'):
             kwargs[key] = kwargs.get(key, None)
-        
+
         if kwargs['name'] is None:
             raise RoleCreationError("Missing name argument")
-        
+
         return kwargs
-    
+
     def _prepare_create_user_args(self, kwargs):
         username = kwargs.get('username', None)
         email = kwargs.get('email', None)
         password = kwargs.get('password', None)
-        
+
         if username is None and email is None:
             raise UserCreationError('Missing username and/or email arguments')
-            
+
         if password is None:
             raise UserCreationError('Missing password argument')
-            
+
         roles = kwargs.get('roles', [])
-        
+
         for i, role in enumerate(roles):
             rn = role.name if isinstance(role, security.Role) else role
             # see if the role exists
             roles[i] = self.find_role(rn)
-        
+
         kwargs['roles'] = roles
-        
+
         now = datetime.utcnow()
         kwargs['created_at'], kwargs['modified_at'] = now, now
-        
+
         pw = kwargs['password']
         if not pwd_context.identify(pw):
             kwargs['password'] = pwd_context.encrypt(pw)
-            
+
         return kwargs
-    
+
     def with_id(self, id):
+        """Returns a user with the specified ID.
+
+        :param id: User ID"""
         user = self._do_with_id(id)
-        if user: return user
+        if user:
+            return user
         raise security.UserIdNotFoundError()
-    
+
     def find_user(self, user):
+        """Returns a user based on the specified identifier.
+
+        :param user: User identifier, usually a username or email address
+        """
         user = self._do_find_user(user)
-        if user: return user
+        if user:
+            return user
         raise security.UserNotFoundError()
-    
+
     def find_role(self, role):
+        """Returns a role based on its name.
+
+        :param role: Role name
+        """
         role = self._do_find_role(role)
-        if role: return role
+        if role:
+            return role
         raise security.RoleNotFoundError()
-    
-    def create_role(self, commit=True, **kwargs):
+
+    def create_role(self, **kwargs):
+        """Creates and returns a new role.
+
+        :param name: Role name
+        :param description: Role description
+        """
         role = security.Role(**self._prepare_create_role_args(kwargs))
         return self._save_model(role)
-    
-    def create_user(self, commit=True, **kwargs):
+
+    def create_user(self, **kwargs):
+        """Creates and returns a new user.
+
+        :param username: Username
+        :param email: Email address
+        :param password: Unencrypted password
+        :param active: The optional active state
+        """
         user = security.User(**self._prepare_create_user_args(kwargs))
         return self._save_model(user)
-    
+
     def add_role_to_user(self, user, role):
+        """Adds a role to a user if the user does not have it already. Returns
+        the modified user.
+
+        :param user: A User instance or a user identifier
+        :param role: A Role instance or a role name
+        """
         return self._save_model(self._do_add_role(user, role))
-    
+
     def remove_role_from_user(self, user, role, commit=True):
+        """Removes a role from a user if the user has the role. Returns the
+        modified user.
+
+        :param user: A User instance or a user identifier
+        :param role: A Role instance or a role name
+        """
         return self._save_model(self._do_remove_role(user, role))
-    
+
     def deactivate_user(self, user):
+        """Deactivates a user and returns the modified user.
+
+        :param user: A User instance or a user identifier
+        """
         return self._save_model(self._do_deactive_user(user))
-    
+
     def activate_user(self, user, commit=True):
-        return self._save_model(self._do_active_user(user))
+        """Activates a user and returns the modified user.
+
+        :param user: A User instance or a user identifier
+        """
+        return self._save_model(self._do_active_user(user))

flask_security/datastore/mongoengine.py

@@ -1,43 +1,73 @@
+# -*- coding: utf-8 -*-
+"""
+    flask.ext.security.datastore.mongoengine
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    This module contains a Flask-Security MongoEngine datastore implementation
+
+    :copyright: (c) 2012 by Matt Wright.
+    :license: MIT, see LICENSE for more details.
+"""
+
 from flask.ext import security
 from flask.ext.security import UserMixin, RoleMixin
 from flask.ext.security.datastore import UserDatastore
-    
+
+
 class MongoEngineUserDatastore(UserDatastore):
-    """MongoEngine datastore"""
-    
-    def __init__(self, db):
-        self.db = db
-        
+    """A MongoEngine datastore implementation for Flask-Security.
+    Example usage::
+
+        from flask import Flask
+        from flask.ext.mongoengine import MongoEngine
+        from flask.ext.security import Security
+        from flask.ext.security.datastore.mongoengine import MongoEngineUserDatastore
+
+        app = Flask(__name__)
+        app.config['SECRET_KEY'] = 'secret'
+        app.config['MONGODB_DB'] = 'flask_security_example'
+        app.config['MONGODB_HOST'] = 'localhost'
+        app.config['MONGODB_PORT'] = 27017
+
+        db = MongoEngine(app)
+        Security(app, MongoEngineUserDatastore(db))
+    """
+
     def get_models(self):
         db = self.db
-        
+
         class Role(db.Document, RoleMixin):
+            """MongoEngine Role model"""
+
             name = db.StringField(required=True, unique=True, max_length=80)
             description = db.StringField(max_length=255)
-              
-        class User(db.Document, UserMixin):
+
+        class User(db.Document, UserMixin, self.user_account_mixin):
+            """MongoEngine User model"""
+
             username = db.StringField(unique=True, max_length=255)
             email = db.StringField(unique=True, max_length=255)
             password = db.StringField(required=True, max_length=120)
             active = db.BooleanField(default=True)
-            roles= db.ListField(db.ReferenceField(Role), default=[])
+            roles = db.ListField(db.ReferenceField(Role), default=[])
             created_at = db.DateTimeField()
             modified_at = db.DateTimeField()
-            
+
         return User, Role
-    
+
     def _save_model(self, model):
         model.save()
         return model
-        
+
     def _do_with_id(self, id):
-        try: return security.User.objects.get(id=id)
-        except: return None
-    
+        try:
+            return security.User.objects.get(id=id)
+        except:
+            return None
+
     def _do_find_user(self, user):
         return security.User.objects(username=user).first() or \
                security.User.objects(email=user).first()
-    
+
     def _do_find_role(self, role):
         return security.Role.objects(name=role).first()
-    

flask_security/datastore/sqlalchemy.py

@@ -1,30 +1,57 @@
+# -*- coding: utf-8 -*-
+"""
+    flask.ext.security.datastore.sqlalchemy
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    This module contains a Flask-Security SQLAlchemy datastore implementation
+
+    :copyright: (c) 2012 by Matt Wright.
+    :license: MIT, see LICENSE for more details.
+"""
+
 from flask.ext import security
 from flask.ext.security import UserMixin, RoleMixin
 from flask.ext.security.datastore import UserDatastore
-    
+
+
 class SQLAlchemyUserDatastore(UserDatastore):
-    """SQLAlchemy datastore"""
-    
-    def __init__(self, db):
-        self.db = db
-        
+    """A SQLAlchemy datastore implementation for Flask-Security.
+    Example usage::
+
+        from flask import Flask
+        from flask.ext.security import Security
+        from flask.ext.security.datastore.sqlalchemy import SQLAlchemyUserDatastore
+        from flask.ext.sqlalchemy import SQLAlchemy
+
+        app = Flask(__name__)
+        app.config['SECRET_KEY'] = 'secret'
+        app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:////tmp/flask_security_example.sqlite'
+
+        db = SQLAlchemy(app)
+        Security(app, SQLAlchemyUserDatastore(db))
+    """
+
     def get_models(self):
         db = self.db
-        
+
         roles_users = db.Table('roles_users',
             db.Column('user_id', db.Integer(), db.ForeignKey('role.id')),
             db.Column('role_id', db.Integer(), db.ForeignKey('user.id')))
-        
+
         class Role(db.Model, RoleMixin):
+            """SQLAlchemy Role model"""
+
             id = db.Column(db.Integer(), primary_key=True)
             name = db.Column(db.String(80), unique=True)
             description = db.Column(db.String(255))
-            
+
             def __init__(self, name=None, description=None):
                 self.name = name
                 self.description = description
-              
-        class User(db.Model, UserMixin):
+
+        class User(db.Model, UserMixin, self.user_account_mixin):
+            """SQLAlchemy User model"""
+
             id = db.Column(db.Integer, primary_key=True)
             username = db.Column(db.String(255), unique=True)
             email = db.Column(db.String(255), unique=True)
@@ -32,12 +59,12 @@ class SQLAlchemyUserDatastore(UserDatastore):
             active = db.Column(db.Boolean())
             created_at = db.Column(db.DateTime())
             modified_at = db.Column(db.DateTime())
-            
-            roles= db.relationship('Role', secondary=roles_users,
+
+            roles = db.relationship('Role', secondary=roles_users,
                                     backref=db.backref('users', lazy='dynamic'))
-            
-            def __init__(self, username=None, email=None, password=None, 
-                         active=True, roles=None, 
+
+            def __init__(self, username=None, email=None, password=None,
+                         active=True, roles=None,
                          created_at=None, modified_at=None):
                 self.username = username
                 self.email = email
@@ -46,21 +73,20 @@ class SQLAlchemyUserDatastore(UserDatastore):
                 self.roles = roles or []
                 self.created_at = created_at
                 self.modified_at = modified_at
-            
+
         return User, Role
-    
+
     def _save_model(self, model):
         self.db.session.add(model)
         self.db.session.commit()
         return model
-    
+
     def _do_with_id(self, id):
         return security.User.query.get(id)
-    
+
     def _do_find_user(self, user):
         return security.User.query.filter_by(username=user).first() or \
                security.User.query.filter_by(email=user).first()
-    
+
     def _do_find_role(self, role):
         return security.Role.query.filter_by(name=role).first()
-    

flask_security/script.py

@@ -1,8 +1,21 @@
+# -*- coding: utf-8 -*-
+"""
+    flask.ext.security.script
+    ~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    This module contains commands for use with the Flask-Script extension
+
+    :copyright: (c) 2012 by Matt Wright.
+    :license: MIT, see LICENSE for more details.
+"""
+
 import json
 import re
+
 from flask.ext.script import Command, Option
-from flask.ext.security import (UserCreationError, UserNotFoundError, 
-                                RoleNotFoundError, user_datastore) 
+
+from flask.ext.security import user_datastore
+
 
 def pprint(obj):
     print json.dumps(obj, sort_keys=True, indent=4)
@@ -10,7 +23,7 @@ def pprint(obj):
 
 class CreateUserCommand(Command):
     """Create a user"""
-    
+
     option_list = (
         Option('-u', '--username', dest='username', default=None),
         Option('-e', '--email',    dest='email',    default=None),
@@ -22,20 +35,33 @@ class CreateUserCommand(Command):
     def run(self, **kwargs):
         # sanitize active input
         ai = re.sub(r'\s', '', str(kwargs['active']))
-        kwargs['active'] = ai.lower() in ['', 'y','yes', '1', 'active']
-        
+        kwargs['active'] = ai.lower() in ['', 'y', 'yes', '1', 'active']
+
         # sanitize role input a bit
         ri = re.sub(r'\s', '', kwargs['roles'])
         kwargs['roles'] = [] if ri == '' else ri.split(',')
-        
+
         user_datastore.create_user(**kwargs)
-        
+
         print 'User created successfully.'
         kwargs['password'] = '****'
         pprint(kwargs)
 
 
-class _RoleCommand(Command):  
+class CreateRoleCommand(Command):
+    """Create a role"""
+
+    option_list = (
+        Option('-n', '--name', dest='name', default=None),
+        Option('-d', '--desc', dest='description', default=None),
+    )
+
+    def run(self, **kwargs):
+        user_datastore.create_role(**kwargs)
+        print 'Role "%(name)s" created successfully.' % kwargs
+
+
+class _RoleCommand(Command):
     option_list = (
         Option('-u', '--user', dest='user_identifier'),
         Option('-r', '--role', dest='role_name'),
@@ -44,7 +70,7 @@ class _RoleCommand(Command):
 
 class AddRoleCommand(_RoleCommand):
     """Add a role to a user"""
-    
+
     def run(self, user_identifier, role_name):
         user_datastore.add_role_to_user(user_identifier, role_name)
         print "Role '%s' added to user '%s' successfully" % (role_name, user_identifier)
@@ -52,27 +78,29 @@ class AddRoleCommand(_RoleCommand):
 
 class RemoveRoleCommand(_RoleCommand):
     """Add a role to a user"""
-    
+
     def run(self, user_identifier, role_name):
         user_datastore.remove_role_from_user(user_identifier, role_name)
         print "Role '%s' removed from user '%s' successfully" % (role_name, user_identifier)
 
-    
+
 class _ToggleActiveCommand(Command):
     option_list = (
         Option('-u', '--user', dest='user_identifier'),
     )
-    
+
+
 class DeactivateUserCommand(_ToggleActiveCommand):
     """Deactive a user"""
-    
+
     def run(self, user_identifier):
         user_datastore.deactivate_user(user_identifier)
         print "User '%s' has been deactivated" % user_identifier
-        
+
+
 class ActivateUserCommand(_ToggleActiveCommand):
     """Deactive a user"""
-    
+
     def run(self, user_identifier):
         user_datastore.activate_user(user_identifier)
-        print "User '%s' has been activated" % user_identifier
+        print "User '%s' has been activated" % user_identifier

requirements.txt

@@ -0,0 +1,6 @@
+Flask==0.8
+Flask-Login==0.1
+Flask-Principal==0.2
+Flask-Script==0.3.2
+Flask-WTF==0.5.4
+passlib=1.5.3

setup.py

@@ -2,7 +2,8 @@
 Flask-Security
 --------------
 
-Simple security for Flask apps
+Flask-Security is a Flask extension that aims to add quick and simple security
+via Flask-Login, Flask-Principal, Flask-WTF, and passlib.
 
 Links
 `````
@@ -11,11 +12,12 @@ Links
   <https://github.com/mattupstate/flask-security/raw/develop#egg=Flask-Security-dev>`_
 
 """
+
 from setuptools import setup
 
 setup(
     name='Flask-Security',
-    version='1.1.0',
+    version='1.2.3',
     url='https://github.com/mattupstate/flask-security',
     license='MIT',
     author='Matthew Wright',

tests/functional_tests.py

@@ -1,108 +1,113 @@
 import unittest
 from example import app
 
+
 class SecurityTest(unittest.TestCase):
-    
+
     AUTH_CONFIG = None
-    
+
     def setUp(self):
         super(SecurityTest, self).setUp()
-        
+
         self.app = self._create_app(self.AUTH_CONFIG or None)
         self.app.debug = False
         self.app.config['TESTING'] = True
-        
+
         self.client = self.app.test_client()
-        
+
     def _create_app(self, auth_config):
         return app.create_sqlalchemy_app(auth_config)
-    
+
     def _get(self, route, content_type=None, follow_redirects=None):
         return self.client.get(route, follow_redirects=follow_redirects,
                 content_type=content_type or 'text/html')
-        
+
     def _post(self, route, data=None, content_type=None, follow_redirects=True):
-        return self.client.post(route, data=data, 
+        return self.client.post(route, data=data,
                 follow_redirects=follow_redirects,
                 content_type=content_type or 'text/html')
-        
-    
+
     def authenticate(self, username, password, endpoint=None):
         data = dict(username=username, password=password)
-        return self._post(endpoint or '/auth', data=data, 
+        return self._post(endpoint or '/auth', data=data,
                 content_type='application/x-www-form-urlencoded')
-    
+
     def logout(self, endpoint=None):
         return self._get(endpoint or '/logout', follow_redirects=True)
 
+
 class DefaultSecurityTests(SecurityTest):
-    
+
     def test_login_view(self):
         r = self._get('/login')
         assert 'Login Page' in r.data
-        
+
     def test_authenticate(self):
         r = self.authenticate("matt", "password")
         assert 'Home Page' in r.data
-        
+
     def test_unprovided_username(self):
         r = self.authenticate("", "password")
         assert "Username not provided" in r.data
-        
+
     def test_unprovided_password(self):
         r = self.authenticate("matt", "")
         assert "Password not provided" in r.data
-    
+
     def test_invalid_user(self):
         r = self.authenticate("bogus", "password")
         assert "Specified user does not exist" in r.data
-        
+
     def test_bad_password(self):
         r = self.authenticate("matt", "bogus")
         assert "Password does not match" in r.data
-        
+
     def test_inactive_user(self):
         r = self.authenticate("tiya", "password")
         assert "Inactive user" in r.data
-        
+
     def test_logout(self):
         self.authenticate("matt", "password")
         r = self.logout()
         assert 'Home Page' in r.data
-        
+
     def test_unauthorized_access(self):
         r = self._get('/profile', follow_redirects=True)
         assert 'Please log in to access this page' in r.data
-        
+
     def test_authorized_access(self):
         self.authenticate("matt", "password")
         r = self._get("/profile")
         assert 'profile' in r.data
-        
+
     def test_valid_admin_role(self):
         self.authenticate("matt", "password")
         r = self._get("/admin")
         assert 'Admin Page' in r.data
-        
+
     def test_invalid_admin_role(self):
         self.authenticate("joe", "password")
         r = self._get("/admin", follow_redirects=True)
         assert 'Home Page' in r.data
-        
+
     def test_roles_accepted(self):
         for user in ("matt", "joe"):
             self.authenticate(user, "password")
             r = self._get("/admin_or_editor")
             self.assertIn('Admin or Editor Page', r.data)
             self.logout()
-            
+
         self.authenticate("jill", "password")
         r = self._get("/admin_or_editor", follow_redirects=True)
         self.assertIn('Home Page', r.data)
 
+    def test_unauthenticated_role_required(self):
+        r = self._get('/admin', follow_redirects=True)
+        self.assertIn('<input id="next"', r.data)
+
+
+class ConfiguredSecurityTests(SecurityTest):
 
-class ConfiguredSecurityTests(SecurityTest):    
-    
     AUTH_CONFIG = {
         'SECURITY_PASSWORD_HASH': 'bcrypt',
         'SECURITY_USER_DATASTORE': 'custom_datastore_name',
@@ -112,22 +117,22 @@ class ConfiguredSecurityTests(SecurityTest):
         'SECURITY_POST_LOGIN': '/post_login',
         'SECURITY_POST_LOGOUT': '/post_logout'
     }
-    
+
     def test_login_view(self):
         r = self._get('/custom_login')
         assert "Custom Login Page" in r.data
-    
+
     def test_authenticate(self):
         r = self.authenticate("matt", "password", endpoint="/custom_auth")
         assert 'Post Login' in r.data
-        
+
     def test_logout(self):
         self.authenticate("matt", "password", endpoint="/custom_auth")
         r = self.logout(endpoint="/custom_logout")
         assert 'Post Logout' in r.data
 
-        
+
 class MongoEngineSecurityTests(DefaultSecurityTests):
-    
+
     def _create_app(self, auth_config):
-        return app.create_mongoengine_app(auth_config)        
+        return app.create_mongoengine_app(auth_config)

tests/unit_tests.py

@@ -2,6 +2,7 @@ import unittest
 import flask_security
 from flask_security import RoleMixin, UserMixin, AnonymousUser
 
+
 class Role(RoleMixin):
     def __init__(self, name, description=None):
         self.name = name
@@ -13,32 +14,33 @@ class User(UserMixin):
         self.username = username
         self.email = email
         self.roles = roles
-    
+
 # set the models or we'll get errors
 flask_security.User = User
 flask_security.Role = Role
-    
+
 admin = Role('admin')
 admin2 = Role('admin')
 editor = Role('editor')
 
 user = User('matt', 'matt@lp.com', [admin, editor])
 
+
 class SecurityEntityTests(unittest.TestCase):
-    
-    def test_role_mixin_equal(self):        
+
+    def test_role_mixin_equal(self):
         self.assertEqual(admin, admin2)
-    
-    def test_role_mixin_not_equal(self):        
+
+    def test_role_mixin_not_equal(self):
         self.assertNotEqual(admin, editor)
-        
+
     def test_user_mixin_has_role_with_string(self):
         self.assertTrue(user.has_role('admin'))
-        
+
     def test_user_mixin_has_role_with_role_obj(self):
         self.assertTrue(user.has_role(Role('admin')))
-        
+
     def test_anonymous_user_has_no_roles(self):
         au = AnonymousUser()
         self.assertEqual(0, len(au.roles))
-        self.assertFalse(au.has_role('admin'))
+        self.assertFalse(au.has_role('admin'))