How is the golden path for using can_edit based on the user logged in?

[Miguelme]

How is the golden path for using can_edit based on the user logged in? I'm asking which would be the equivalent of out-of-the-box implementation supporting Authentication where I can specify which users can edit and which ones can not? I've reviewed some samples but unable to find these kind of use cases

[aminalaee]

Hey,
I think the can_edit should not be used to control per-user permissions, this is just a general configuration for this model to be applied to all users.
I think one option is to customize the templates to hide it if user doesn't have the role. But I will think about it to see if there's an easier way, if you can also an equivalent flask-admin option, we can adopt.

[iagobalmeida]

One way you can achieve that is by extending the Admin class and modifying the list() method.

def get_role_by_token(token):
    return 5

class AdminApp(Admin):

    @login_required
    async def list(self, request: Request) -> Response:
        """List route to display paginated Model instances."""

        await self._list(request)

        access_token = request.headers.get('access-token')
        user_role = get_role_by_token(access_token)

        model_view = self._find_model_view(request.path_params["identity"])

        model_view.can_create = user_role > 1
        model_view.can_edit = user_role > 2
        model_view.can_delete = user_role > 3

        page = int(request.query_params.get("page", 1))
        page_size = int(request.query_params.get("pageSize", 0))
        search = request.query_params.get("search", None)
        sort_by = request.query_params.get("sortBy", None)
        sort = request.query_params.get("sort", "asc")

        pagination = await model_view.list(page, page_size, search, sort_by, sort)
        pagination.add_pagination_urls(request.url)

        context = {
            "request": request,
            "model_view": model_view,
            "pagination": pagination,
        }

        return self.templates.TemplateResponse(model_view.list_template, context)

You can modify the can_create, can_edit and can_delete values before rendering the list page, but as @aminalaee said, its better to create different keys to determinate if the buttons should render or not in order to keep everything work as it should.
To do that, you would need to also modify the template list.html so it can read your new keys to determinate if the buttons should render or not.

[aminalaee]

I'm also open to the option to allow def can_edit(self, request) to be overriden per request, so we keep backwards-compatibility and also if can_edit is callable we will call it and expect a boolean. PRs are welcome though :)