Series: Building a Social Network with Flask & Stream – Part 3

Spencer P.
Spencer P.
Published January 24, 2020 Updated February 5, 2020

This is the third installment of a tutorial series focusing on how to create a full-stack application using Flask and Stream. Originally, this article was going to cover the creation of the initial database models for your app, as well as handling registration/login and other convenience functions for users, but given the sheer amount of content there is to cover, I’m going to split it into two parts.

This first part is going to cover setting up User models and permissions, and next week we will launch into creating the views and forms for registration and login! Check out the GitHub repo here to help you follow along!

Getting Started

As usual, we’re going to start by installing few packages to get us rolling:

Pip install flask-wtf flask-login flask-mail flask-migrate

Flask-WTF (What The Form) is a form and validation package to aid in the creation of forms, by adding in some extra features like CSRF tokens and alerts.

Flask-Login is a session management package that helps by handling user authentication, allowing us to verify users so that we can pass the correct information to them.

Flask-Mail is an email package that sends out emails to users; we will use it to send confirmations to users upon registration, as well as to aid with some of the convenience functions that I mentioned earlier, like changing a user’s email or password.

Finally, Flask-Migrate is a database versioning tool that lets us keep a record of changes made to our database tables, by handling additions and subtractions of columns from tables.

And By Extension

Since we’ve loaded in new libraries, the first thing we should do is go to the file and update it:

# …
from flask_moment import Moment
from flask_mail import Mail
from flask_login import LoginManager

# ...
moment = Moment()
mail = Mail()

login_manager = LoginManager()

In order to initialize the packages in a specific app context when it's created, we will need to include them in our create_app function in the file.

# …
from .extensions import bootstrap, db, moment, login_manager, mail
from config import config

def create_app(config_name):
# …

Configure It Out

Given the new packages we’ve installed, our next step will be to edit our file to set some of their options:

Class Config:
	# …
  MAIL_SERVER = os.environ.get('MAIL_SERVER', '')
  MAIL_PORT = int(os.environ.get('MAIL_PORT', '587'))
  MAIL_USE_TLS = os.environ.get('MAIL_USE_TLS', 'true').lower() in \
     ['true', 'on', '1']
  MAIL_USERNAME = os.environ.get('MAIL_USERNAME')
  MAIL_PASSWORD = os.environ.get('MAIL_PASSWORD')
  OFFBRAND_MAIL_SENDER = 'Offbrand Admin <>'

Now that we have our configuration up, we can put our packages to work!

Next Steps

Our first task is to establish our User and Permissions tables. This section will largely draw on Miguel Grinberg’s Flasky application; if you’re not familiar with its incredible awesomeness, you can check it out here.

Let’s start off by setting up the Users table:

from datetime import datetime
import hashlib
from import generate_password_hash, check_password_hash
from itsdangerous import TimedJSONWebSignatureSerializer as Serializer
from flask import current_app
from flask_login import UserMixin, AnonymousUserMixin
from . import db, login_manager

class User(db.Model, UserMixin):
    __tablename__ = 'users'
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(64), unique=True, index=True)
    username = db.Column(db.String(64), unique=True, index=True)
    role_id = db.Column(db.Integer, db.ForeignKey(''))
    password_hash = db.Column(db.String(128))

Better to Ask Permission

Now that we have a basic User class set up, our next step will be to set up Permissions, so that we can differentiate between our basic users, moderators and administrators. Doing so will let us segment parts of the site based on permission:

from . import db, login_manager

class Permission:
   	FOLLOW = 1
   	COMMENT = 2
    WRITE = 4
    MODERATE = 8
    ADMIN = 16

class Role(db.Model):
   __tablename__ = 'roles'
   id = db.Column(db.Integer, primary_key=True)
   name = db.Column(db.String(64), unique=True)

This table and its functions will provide the permissions assignment we need for our application, making sure that our users are only able to access the things they should have access to, and letting us build functions for our moderators and admins to edit questionable content and boot toxic users!

Anon and On

Right now, if a permissions check is done on a user who doesn’t have an account, we’ll get a nasty little error. Our final step in setting permissions is to define a class for anonymous users:

Building your own app? Get early access to our Livestream or Video Calling API and launch in days!
class User(db.Model, UserMixin):

class AnonymousUser(AnonymousUserMixin):
	def can(self, permissions):
		return False

	def is_administrator(self):
		return False

login_manager.anonymous_user = AnonymousUser

def load_user(user_id): 

And, with that, this portion of our database modeling is finished (for now). Though, we’ll be back next week to set up user convenience functions, like changing your password or email!

Not Just For Decoration

Now that we have our Permissions table and functions set up, our next step will be to set up a decorator function that checks specific permissions for a route. For this, we will create a file in the app directory:

from functools import wraps
from flask import abort
from flask_login import current_user
from .models import Permission

def permission_required(permission):
   def decorator(f):
       def decorated_function(*args, **kwargs):
           if not current_user.can(permission):
           return f(*args, **kwargs)
       return decorated_function
   return decorator

def admin_required(f):
   return permission_required(Permission.ADMIN)(f)

The first decorator will allow you to set a specific level of permissions needed to access a route or function, while the second is used to verify that the user has admin-level permissions. I find that this helps to differentiate the look of admin-only resources, as well as to follow Python stylistic guidelines (explicit is better than implicit, etc).

Migration Patterns

Our tables are set, however, this won’t be the last time that we need to change our database; a frequently-used package, called flask-migrate, will help by versioning changes, allowing us to upgrade and downgrade through different versions, in order to apply or revert those changes. We already installed the package, itself, at the beginning; now we just have to bring it into the file:

from flask_migrate import flask-migrate

migrate = Migrate(app, db)

def make_shell_context():
    return dict(db=db, User=User, Role=Role,

def deploy():
    """Running all of our deployment operations."""
    # migrate database to latest revision

    # create or update user roles

While bringing flask-migrate into the file, I also took the liberty of updating the shell context to be able to reference the database and models that we have established in, so we don’t have to manually import them every time. To round it out, I created a handy little deploy tool for the command line that will let us quickly upgrade our database to the latest revision and create or update user roles.

Our next step is to initialize the migrate package for our project, as well as create our initial migration and upgrade the database:

flask db init
flask db migrate -m “initial migration”
flask db upgrade

Last but not least, we will go into the shell and insert all the roles for our users:

admin_role = Role.query.filter_by(name=’Administrator’).first()
default_role = Role.query.filter_by(default=True).first()
for u in User.query.all():
    if u.role is None:
      if == app.config[‘OFFBRAND_ADMIN’]:
        u.role = admin_role
        u.role = default_role


Time for an Upgrade!

Before we finish this tutorial, I wanted to take a minute to create a landing page for users to be wowed with when they first arrive! Right now, if you were to launch your app, it would still return your basic “Hello World!” text, so a basic html file would be a large upgrade. We’ll start by creating the index.htm file in app/templates:

{% block title %}Offbrand{% endblock %}

{% block page_content %}
<div class=”page-header”>
	<h1>Welcome to Offbrand!</h1>
{% endblock %}

Now that we have the template, we have to reference it in the route (in app/main/, to have the template rendered:

from flask import render_template

def index():
	return render_template(‘index.html’)

Flask uses a templating service called jinja2; if you have developed with Django before it may seem very similar. Jinja allows you to define blocks of code, like your title and page content, as well as import other files and variables from your app.

Sanity Check

To make sure everything is working as it should, we’ll boot up our development server (flask run) and navigate to localhost.

If you get an ugly error, you might have to set the Flask app, again, with:


Final Thoughts

With that, we have constructed our database model for users with automatic avatar construction, password setting, and a complete permissions system with anonymous users! Additionally, we have covered initializing Flask-Migrate to track changes to our models, and, in our next installment, we will get into generating and validating confirmation tokens that we will send in an email when users sign up, along with some new user routes for our authentication and some basic navigation.

Thanks for reading and happy coding!

Note: The next post in this series can be found here.

decorative lines
Integrating Video With Your App?
We've built a Video and Audio solution just for you. Check out our APIs and SDKs.
Learn more ->