Flask

masks.flask adds masks to a Flask app. Python apps explains the settings, the handshake, sessions, and privileges that every framework shares.

Setting up

Install the package with the flask extra:
Terminal window
```
pip install "masks-client[flask]"
```

Create Masks with the app and its settings:

import os

from flask import Flask

from masks.flask import Masks, masked

app = Flask(__name__)
app.secret_key = os.environ["SESSION_SECRET"]
auth = Masks(app, issuer=os.environ["MASKS_ISSUER"], resource="https://app.example.com")


@app.get("/settings")
@auth.required()
def settings():
    return {"name": masked.name}

Masks registers the routes as a blueprint. It takes the settings as keywords or a Config, as Masks(app, config). Keywords that leave out secret use app.secret_key. A Config needs its own secret. Masks() followed by init_app(app) works as well.

masked is the actor for the current request. The decorators take privileges.

init_app raises these errors:

ValueError for a privilege that privileges does not name, even in a decorator applied before init_app ran.
TypeError for an async session store or store.

The session is read the first time a request needs it, so a view that never asks for the actor reads nothing from a session store.

Reference


`masked`	The actor for the current request.
`@auth.required(*privileges, tokens=False)`	Needs a sign-in holding each privilege. With `tokens=True`, it checks a token when the request has an `Authorization` header or no session.
`@auth.protected(*privileges)`	Needs an access token holding each privilege.
`auth.authorize(*privileges, tokens=False)`	`required` inside a view. Raises `masks.web.Refusal`.
`auth.actor`	The actor, the same as `masked`.
`auth.client()`	A `masks.Client` with the app’s credentials.
`auth.start_delegation(provider, prompt=None, max_age=None)`	Starts a delegation. Returns the redirect.
`auth.finish_delegation()`	Finishes it. Returns a `masks.HeldConnection`.
`auth.login_url(return_to="", organization="", privilege=())`	A link that starts a sign-in.
`auth.logout_url()`	The path a sign-out form posts to.
`auth.registered()`	Whether masks still knows the app.
`auth.connected()`	Whether the app holds credentials.
`auth.session()`	The session, a mutable mapping.