What it does

Flask-RPBAC lets you define authorization rules in a declarative style and apply them to Flask routes or entire blueprints. This keeps access decisions readable, testable, and easy to evolve as an application grows.

Typical use cases include:

• restricting admin-only endpoints

• enforcing permission checks for resource actions

• combining role and permission requirements for complex policies

• protecting blueprint sections with general access rules while keeping route-specific rules

Quick example

from flask import Flask
from flask_login import current_user
from flask_rpbac import RPBAC, Role, Permission, All, Any

app = Flask(__name__)
rpbac = RPBAC(app)

@rpbac.role_loader
def load_roles():
    return ["admin", "editor"] if current_user.is_authenticated else []

@rpbac.permission_loader
def load_permissions():
    return ["post:read", "post:write"] if current_user.is_authenticated else []

@app.route("/admin")
@rpbac.role_required(Role("admin"))
def admin_panel():
    return "Admin panel"

@app.route("/publish")
@rpbac.required(All(Role("editor"), Permission("post:write")))
def publish_post():
    return "Publish"

@app.route("/shared")
@rpbac.required(Any(Role("admin"), Permission("post:read")))
def shared_view():
    return "Shared view"

Installation

Install the package with pip:

pip install flask_rpbac

Requirements

Flask-RPBAC targets modern Flask applications and is designed for Flask 3.1 and newer, with Python 3.12+ support.

Contributing

Contributions are welcome. Please read the full contribution guide before opening a pull request.

We encourage pull requests, issue reports, and improvements to documentation, tests, and access control examples. A healthy contribution workflow is:

• open an issue or discussion for larger changes

• keep changes focused and easy to review

• add or update tests for behavior changes

• keep the public API clear and consistent

• update documentation when user-facing behavior changes

• follow the project coding and testing standards already in place

Before submitting changes, please run the project test suite and ensure the relevant checks pass. If you are improving behavior, add a regression test so the change is protected in the future.

Useful contributor resources:

• Contribution guide

• Code of Conduct

• Security Policy

• Issue templates

• Full documentation

Before submitting a change, contributors should have Python 3.12 or newer, create a virtual environment, install the development dependencies, and verify the project locally:

python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
pytest
tox

Please report security vulnerabilities privately through the process described in the Security Policy, rather than opening a public issue.

License

This project is distributed under the terms of the repository’s license.