Flask Request Context and Object Authorization

Working case

Reviewer 47 opens case 62; reviewer 81 guesses the same path. Both have valid sessions. A handler that queries PermitCase by ID and returns the ORM object's dictionary reveals the district's private note to reviewer 81. The navigation menu filters unauthorized cases, but that only changes the menu. A later export endpoint repeats the same ID lookup and leaks the note even after the detail page is repaired. The corrected service queries the case and its reviewer assignment together, returns a narrow response projection, and uses the same authorization rule for export metadata. An approval command checks again because assignments can change between the GET and POST requests.

Implementation boundary

from flask import Blueprint, abort, jsonify, session
from sqlalchemy import select
from .database import db
from .models import PermitCase, PermitReviewer

permits = Blueprint("permits", __name__)

@permits.get("/permits/<int:case_id>")
def permit_detail(case_id: int):
    reviewer_id = session.get("reviewer_id")
    if reviewer_id is None:
        abort(401)
    statement = (
        select(PermitCase.id, PermitCase.title, PermitCase.status)
        .join(PermitReviewer, PermitReviewer.case_id == PermitCase.id)
        .where(PermitCase.id == case_id, PermitReviewer.reviewer_id == reviewer_id)
    )
    case = db.session.execute(statement).one_or_none()
    if case is None:
        abort(404)
    return jsonify({"case_id": case.id, "title": case.title, "status": case.status})

Keep a private blueprint behind authentication middleware or a before-request guard. Derive reviewer_id from the validated server session, not a request parameter. Pass that scalar into a query that scopes PermitCase to authorized reviewer assignments. For a hidden private case, choose one deliberate missing-style response for both nonexistent and forbidden IDs; internal logs may retain a safe request ID and reason. Project only fields the caller may receive, even after the scope check. Code outside Flask request handling should accept reviewer_id and case_id as parameters. Do not pass LocalProxy objects into a thread or queue; resolve the needed data while the request is active, then use a separate worker context and fresh database session.

Cost and boundaries

A permission-scoped detail query is usually an indexed case lookup plus an indexed assignment predicate. It may cost another join or existence check compared with an unsafe primary-key lookup, but it avoids fetching fields that must later be discarded. For a list, put the reviewer predicate in SQL rather than querying every case and filtering Python objects; otherwise memory, query count, and disclosure risk grow with the whole table. Repeated policy checks across 47 rows can create an N+1 pattern if each check loads a relationship. Measure SQL count, returned row count, and serialization width on allowed, denied, and missing paths. The public response should be small even if the database model is wide.

Failure trace

Exercise the same route anonymously, as reviewer 47, as reviewer 81, and with an ID that has never existed. Compare forbidden and absent responses against the chosen disclosure policy. Try the export endpoint and any document-download path with the guessed case ID. Revoke reviewer 47's assignment after loading the page, then submit approval; the write service must reject stale access. Give the model a private_note value that would be obvious in a leaked response and assert it is absent from JSON. Run the service in a plain unit test with explicit reviewer_id; if it reads request or g, the boundary has been breached.

Verification

A signed-in reviewer still needs permission for the exact case.
Response fields are projected rather than serialized from the model.
The service can run without a Flask request proxy.

Practice drill

Build a Flask blueprint for private permit detail and export metadata. Seed cases 62 and 81 with disjoint reviewers. Give one case a private district note and an attachment path. Authenticate the caller once at the HTTP edge, then pass its integer identity into a query service. Make the service return a response record containing only case ID, public title, and status. Test unknown, forbidden, allowed, and revoked cases. Reuse the same scoped lookup for export authorization. Log an opaque request ID for a denial without printing the hidden case title. Count queries for a 47-case reviewer list before and after moving the permission predicate into SQL.

Decision note

Treat Flask context as an HTTP convenience; make authorization and data projection explicit service inputs and outputs.

Common Mistakes

Treating a filtered menu as an authorization rule.
Passing request or g into a background thread.
Checking permission for detail but forgetting export and mutation routes.

Apply and check

Build Project: Flask permit service boundaries and review Web Development: Flask context and service boundaries quiz.