how to set permissions or roles to active @permission_required or @role_required?

[ockan]

how to set permissions or roles to active @permission_required or @role_required?

[cookesan]

The decorators read the values from the logged-in current_user object.

For roles, use the plural decorator roles_required(...). It checks current_user.roles first. If that is missing, it falls back to current_user.role and wraps that single value as a list.

For permissions, permission_required(...) checks current_user.permissions. That can be a list/set-like value, or a callable that returns the permissions.

Example:

from bustapi.auth import BaseUser, roles_required, permission_required

class User(BaseUser):
    def __init__(self, id):
        self.id = id
        self.role = "admin"
        self.permissions = ["posts:delete", "users:read"]

@app.get("/admin")
@roles_required("admin")
def admin():
    return {"ok": True}

@app.post("/posts/delete")
@permission_required("posts:delete")
def delete_post():
    return {"deleted": True}

The important part is that your user_loader returns a user object with those attributes after login.

[ockan]

this method perhaps cause the circular import

[GrandpaEJ]

I have tested cookesan's approach thoroughly — it works correctly. Here is a complete breakdown:

---

✅ How it works

1. Create a user class with role (or roles) and permissions

Extend BaseUser and set the attributes:

from bustapi.auth import BaseUser

class User(BaseUser):
    def __init__(self, id):
        self.id = id
        self.role = "admin"
        self.permissions = ["posts:delete", "users:read"]

2. Register a user_loader on LoginManager

from bustapi import BustAPI
from bustapi.auth import LoginManager

app = BustAPI()
app.secret_key = "your-secret"
login_manager = LoginManager(app)

@login_manager.user_loader
def load_user(user_id):
    return User(int(user_id))

3. Protect routes with decorators

from bustapi.auth import roles_required, permission_required

@app.get("/admin")
@roles_required("admin")
def admin():
    return {"ok": True}

@app.post("/posts/delete")
@permission_required("posts:delete")
def delete_post():
    return {"deleted": True}

---

🔬 Test results (all 9 passed)

Test	Result
roles_required with role (singular)	✅ Pass
roles_required role mismatch → 403	✅ Pass
roles_required with roles (plural list)	✅ Pass
permission_required has permission	✅ Pass
permission_required missing → 403	✅ Pass
permission_required multiple (ALL required)	✅ Pass
permission_required callable .permissions	✅ Pass
Unauthenticated → 401 first	✅ Pass
Real discussion #21 code example	✅ Pass

---

📝 Key notes

• roles_required checks current_user.roles first (as a list), then falls back to current_user.role (single string → wrapped in list). Uses any match logic.
• permission_required checks current_user.permissions — supports list and callable. Uses all match logic (every permission must be present).
• Both return 401 if not authenticated, 403 if role/permission missing.

Hope this helps!

[ockan]

thanks!
1.besides roles and permissions, what others information @login_manager.user_loader handler should return?
2.How to set roles and permissions for specific user dynamically ？this method perhaps cause the circular import when use blueprint

[GrandpaEJ]

1. Information returned by @login_manager.user_loader:
   The user loader must return a user object inheriting from BaseUser (or implementing its interface). By default, it needs to provide the following attributes/properties:

   • id: A unique identifier for the user session (string or integer).
   • is_authenticated: A boolean property indicating if the user is authenticated (returns True for active users, False for anonymous/inactive users).
   • is_active: A boolean property indicating if the user account is active.
   • is_anonymous: A boolean property indicating if this is an anonymous user (returns False for real users).

2. Dynamic Roles/Permissions and avoiding Circular Imports:

   • Dynamic determination: Implement them as @property attributes or methods on your User class to fetch/evaluate them dynamically at runtime from your database:

     class User(BaseUser):
         def __init__(self, user_id, role, permissions):
             self.id = user_id
             self._role = role
             self._permissions = permissions
     
         @property
         def roles(self):
             return [self._role]
     
         @property
         def permissions(self):
             return self._permissions

     During login/session loading, load these attributes from your database inside your user_loader:

     @login_manager.user_loader
     def load_user(user_id):
         db_user = db.query(UserTable).get(user_id)
         if db_user:
             return User(
                 user_id=db_user.id,
                 role=db_user.role.name,
                 permissions=[p.name for p in db_user.permissions]
             )
         return None

   • Avoiding Circular Imports:
     Use the deferred initialization pattern. Define LoginManager in a shared extensions.py file, import it in your routes/blueprints, and call init_app inside your application factory or main app.py:

     extensions.py:

     from bustapi.auth import LoginManager
     login_manager = LoginManager()

     routes/admin.py (Blueprint):

     from bustapi import Blueprint
     from bustapi.auth import roles_required
     
     admin_bp = Blueprint("admin")
     
     @admin_bp.route("/admin")
     @roles_required("admin")
     def admin_dashboard():
         return {"status": "ok"}

     app.py:

     from bustapi import BustAPI
     from .extensions import login_manager
     from .routes.admin import admin_bp
     
     app = BustAPI()
     app.secret_key = "your-secret"
     
     # Deferred initialization
     login_manager.init_app(app)
     app.register_blueprint(admin_bp)