Package: simple-rbac
This is a simple role based access control utility in Python.Quick Start1. Install Simple RBACpip install simple-rbac2. Create a Access Control Listimport rbac.acl

acl = rbac.acl.Registry()3. Register Roles and Resourcesacl.add_role("member")
acl.add_role("student", ["member"])
acl.add_role("teacher", ["member"])
acl.add_role("junior-student", ["student"])

acl.add_resource("course")
acl.add_resource("senior-course", ["course"])4. Add Rulesacl.allow("member", "view", "course")
acl.allow("student", "learn", "course")
acl.allow("teacher", "teach", "course")
acl.deny("junior-student", "learn", "senior-course")5. Use It to Check Permissionif acl.is_allowed("student", "view", "course"):
    print("Students chould view courses.")
else:
    print("Students chould not view courses.")

if acl.is_allowed("junior-student", "learn", "senior-course"):
    print("Junior students chould learn senior courses.")
else:
    print("Junior students chould not learn senior courses.")Custom Role and Resource ClassIt’s not necessary to use string as role object and resource object like
“Quick Start”. You could define role class and resource class of
yourself, such as a database mapped model in SQLAlchemy.Whatever which role class and resource class you will use, it must
implement__hash__method and__eq__method to behashable.Exampleclass Role(db.Model):
    """The role."""

    id = db.Column(db.Integer, primary_key=True)
    screen_name = db.Column(db.Unicode, nullable=False, unique=True)

    def __hash__(self):
        return hash("ROLE::%d" % self.id)

    def __eq__(self, other):
        return self.id == other.id


class Resource(db.Model):
    """The resource."""

    id = db.Column(db.Integer, primary_key=True)
    screen_name = db.Column(db.Unicode, nullable=False, unique=True)

    def __hash__(self):
        return hash("RESOURCE::%d" % self.id)

    def __eq__(self, other):
        return self.id == other.idOf course, You could use the built-in hashable types too, such as tuple,
namedtuple, frozenset and more.Use the Identity Context Check Your PermissionObviously, the work of checking permission is a cross-cutting concern.
The module namedrbac.context, ourIdentityContext, provide some
ways to make our work neater.1. Create the Context Manageracl = Registry()
context = IdentityContext(acl)2. Set a LoaderThe loader should load the roles of current user.from myapp import get_current_user

@context.set_roles_loader
def second_load_roles():
    user = get_current_user()
    yield "everyone"
    for role in user.roles:
        yield str(role)3. Protect Your ActionNow you could protect your action from unauthorized access. As you
please, you could choose many ways to check the permission, including
pythondecorator, pythonwith statementor simple method
calling.Decorator@context.check_permission("view", "article", message="can't view")
def article_page():
    return "your-article"With Statementdef article_page():
    with context.check_permission("view", "article", message="can't view"):
        return "your-article"Simple Method Callingdef article_page():
    context.check_permission("view", "article", message="can't view").check()
    return "your-article"Exception Handler and Non-Zero CheckingWhatever which way you choosen, a exceptionrbac.context.PermissionDeniedwill be raised while a unauthorized
access happening. The keyword arguments sent to thecontext.check_permissionwill be set into a attirbute namedkwargsof the exception. You could get those data in your exception
handler.@context.check_permission("view", "article", message="can not view")
def article_page():
    return "your-article"

try:
    print article_page()
except PermissionDenied as exception:
    print "The access has been denied, you %s" % exception.kwargs['message']If you don’t want to raise the exception but only check the access is
allowed or not, you could use the checking like a boolean value.if not context.check_permission("view", "article"):
    print "Oh! the access has been denied."

is_allowed = bool(context.check_permission("view", "article"))