**Course Title:** Mastering Flask Framework: Building Modern Web Applications **Section Title:** User Authentication and Authorization **Topic:** Create a user authentication system with registration, login, and role-based access control.(Lab topic) In this lab topic, we will create a user authentication system with registration, login, and role-based access control using Flask. This will help you apply the concepts learned in the previous topics on user authentication and authorization. **Learning Objectives:** * Create a registration form to register new users * Implement user registration functionality with password hashing and storage * Create a login form to authenticate users * Implement login functionality with secure password verification * Implement role-based access control for different routes **Let's Start** To start, create a new Flask application or clone the repository from the previous topic. Create a new model for the User entity using SQLAlchemy. ```python # models.py from flask_sqlalchemy import SQLAlchemy from werkzeug.security import generate_password_hash, check_password_hash db = SQLAlchemy() class User(db.Model): id = db.Column(db.Integer, primary_key=True) username = db.Column(db.String(80), unique=True, nullable=False) email = db.Column(db.String(120), unique=True, nullable=False) password = db.Column(db.String(120), nullable=False) role = db.Column(db.String(80), nullable=False, default='user') def set_password(self, password): self.password = generate_password_hash(password) def check_password(self, password): return check_password_hash(self.password, password) ``` Next, create a registration form using Flask-WTF. ```python # forms.py from flask_wtf import FlaskForm from wtforms import StringField, PasswordField, SubmitField from wtforms.validators import DataRequired, Email, EqualTo class RegistrationForm(FlaskForm): username = StringField('Username', validators=[DataRequired()]) email = StringField('Email', validators=[DataRequired(), Email()]) password = PasswordField('Password', validators=[DataRequired()]) confirm_password = PasswordField('Confirm Password', validators=[DataRequired(), EqualTo('password')]) submit = SubmitField('Sign Up') ``` Create a registration route and a registration template using Jinja2. ```python # app.py from flask import Flask, render_template, redirect, url_for from forms import RegistrationForm from models import User, db app = Flask(__name__) app.config['SECRET_KEY'] = 'secret_key' app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///blog.db' db.init_app(app) @app.route('/register', methods=['GET', 'POST']) def register(): form = RegistrationForm() if form.validate_on_submit(): user = User(username=form.username.data, email=form.email.data) user.set_password(form.password.data) db.session.add(user) db.session.commit() return redirect(url_for('login')) return render_template('register.html', title='Register', form=form) ``` ```html <!-- templates/register.html --> <h1>Register</h1> <form method="POST"> {{ form.hidden_tag() }} {{ form.username.label }} {{ form.username() }} {{ form.email.label }} {{ form.email() }} {{ form.password.label }} {{ form.password() }} {{ form.confirm_password.label }} {{ form.confirm_password() }} {{ form.submit() }} </form> ``` Similarly, create a login form and a login route. ```python # forms.py class LoginForm(FlaskForm): username = StringField('Username', validators=[DataRequired()]) password = PasswordField('Password', validators=[DataRequired()]) submit = SubmitField('Login') ``` ```python # app.py @app.route('/login', methods=['GET', 'POST']) def login(): form = LoginForm() if form.validate_on_submit(): user = User.query.filter_by(username=form.username.data).first() if user and user.check_password(form.password.data): # Login successful return redirect(url_for('index')) return render_template('login.html', title='Login', form=form) ``` ```html <!-- templates/login.html --> <h1>Login</h1> <form method="POST"> {{ form.hidden_tag() }} {{ form.username.label }} {{ form.username() }} {{ form.password.label }} {{ form.password() }} {{ form.submit() }} </form> ``` Finally, implement role-based access control using decorators. ```python # app.py def requires_role(role): def decorator(f): @wraps(f) def decorated_function(*args, **kwargs): user = User.query.filter_by(username=current_user.username).first() if user and user.role != role: return 'Forbidden', 403 return f(*args, **kwargs) return decorated_function return decorator @app.route('/admin') @requires_role('admin') def admin(): return 'Hello, Admin!' ``` **Conclusion** In this lab topic, we created a user authentication system with registration, login, and role-based access control using Flask. We used Flask-WTF for creating forms and SQLAlchemy for database operations. We also implemented password hashing and storage using Werkzeug. **External Resources** * Flask Documentation: https://flask.palletsprojects.com/ * Flask-WTF Documentation: https://flask-wtf.readthedocs.io/ * SQLAlchemy Documentation: https://www.sqlalchemy.org/ **Practice and Feedback** Practice creating a user authentication system with registration, login, and role-based access control using Flask. If you have any questions or need help, feel free to ask in the comments below. **What's Next** In the next topic, we will cover 'Introduction to RESTful principles and API design' from the section 'RESTful API Development with Flask'.