Access Control

Security and Access Control

• Applies to: Flask and FastAPI
• Best examples: examples/authentication/demo_auth.py, examples/authentication/demo_jwt.py, examples/mini_examples/ex16_perm.py
• Related pages: Endpoint Decorators, CORS, Input Validation

Security model overview

SAFRS does not impose a single security model. Instead, it gives you several control points:

• app-wide middleware or framework auth
• model-level decorators
• relationship-level controls
• permission hooks such as _s_check_perm

Model and relationship controls

Relevant mechanisms include:

• decorators
• custom_decorators
• relationship-level decorators
• relationship-level http_methods
• _s_check_perm

FastAPI note

For FastAPI, prefer dependencies and middleware rather than Flask-only decorator patterns.

Example files

• examples/authentication/demo_auth.py
• examples/authentication/demo_post_auth.py
• examples/authentication/demo_jwt.py
• examples/mini_examples/ex16_perm.py