jfinkels/flask-restless — pull request #133 by glyphobet (2013-01-28 13:13:47+00:00)
Title: Should use custom query classes on model objects

There are many use cases where it is desirable to automatically add a few custom query parameters to all SQLAlchemy queries for that class. Perhaps the best example is if you want to limit all queries to `Model.deleted==False`, but this can also be used for authorization, by limiting with something like `Model.owner==current_user.get_id()`.

This automatic filtering can be done by defining a `query_class` class attribute on a model, or by defining a `query` property on the model. [An example of the latter pattern is here.](http://stackoverflow.com/questions/920724/the-right-way-to-auto-filter-sqlalchemy-queries) In both cases the query class that is attached to the model class should inherit from `sqlalchemy.orm.query.Query`, or, when using flask-sqlalchemy, from `flask_sqlalchemy.BaseQuery`.

For whatever reason, SQLAlchemy's `session.query(model)` bypasses this query class attached to the model. But if flask-restless instead builds the query starting from `model.query`, it *will* use this custom query class.

Both the query returned by `session.query(model)` and the one returned by `model.query` are attached to the same session object, as you can verify by looking at the query's `.session` attribute. So it is unlikely that this change will cause any problems with session handling.

If a model doesn't have a custom `query_property` or a `query` attribute defined, then this change does nothing: both `model.query` and `session.query(model)` return the same object in that case.

I am by no means an expert in the wild and mysterious world of SQLAlchemy query handling, but I have dug through the relevant code a bit and I believe this change is ok. If there's something wrong with it I would very much like to know what.

tl;dr: This is a simple one-line change that does nothing except allowing flask-restless to use any custom query classes defined on an object.