Home / MAD1 / Week 5

Week 5 · Controllers: Flask routes and business logic

The one-minute story

By the end of this week you can:

• write routes with variable parts, allowed methods and url_for;
• predict the output of small Flask apps (trailing slashes, wrong methods, abort, error handlers, redirects);
• read form data, query strings and JSON from the request object;
• use flash, session, redirect-after-POST and error handlers;
• organise a bigger app with blueprints and an application factory, and explain MVC;
• put validation, duplicate checks, permission checks and delete rules in the controller.

Words you need

Idea 1: A Flask app and its folders

Install and run in a virtual environment, so this project's packages do not clash with others:

python -m venv venv
venv\Scripts\activate          # on Windows; on Mac/Linux: source venv/bin/activate
pip install flask flask-sqlalchemy
pip freeze > requirements.txt  # anyone can rebuild with: pip install -r requirements.txt

A typical project:

my_app/
  app.py            controller code (routes) and app setup
  models.py         model classes (db.Model)
  templates/        Jinja HTML files (render_template looks here)
  static/           css, js, images (served at /static/...)
  requirements.txt
  venv/             never commit this

The smallest app:

from flask import Flask
app = Flask(__name__)

@app.route("/")
def index():
    return "Hello"

if __name__ == "__main__":
    app.run(debug=True)       # http://127.0.0.1:5000/

Flask(__name__) tells Flask where this file lives, so it can find templates/ and static/ next to it. The default folder names are templates and static, and you can change them: Flask(__name__, template_folder="my_templates").

Decorators in one minute

@app.route("/") is a decorator: a function that takes your function and returns a wrapped version. Stacked decorators apply from the bottom up.

def logger(func):
    def inner():
        print("start")
        r1 = func(); r2 = func()
        return r1, r2
    return inner

@logger
def get_data():
    return "Data"

print(get_data())

Output: start, then ('Data', 'Data'). The name get_data now refers to inner, which prints first and runs the original twice. With two decorators (@modify above @update), update wraps the function first and modify wraps the result. A real paper asked for modify (reverses a list) over update (halves each value) over a function that squares [2,4,1,7,5,9]: squares [4,16,1,49,25,81], then halve [2,8,0.5,24.5,12.5,40.5], then reverse: [40.5, 12.5, 24.5, 0.5, 8.0, 2.0].

Idea 2: Routing and URL rules

@app.route(rule, methods=[...]) binds a URL to a function. Anything in angle brackets is a variable part captured and passed as an argument.

@app.route("/greet/<name>")          # name is a string without slashes
def greet(name): return f"Hi {name}"

@app.route("/n/<int:n>")             # converter: only digits, passed as int
def plus_one(n): return str(n + 1)

Converters: string (default), int, float, path (allows slashes), uuid.

Trailing slash rules

@app.route("/home")
def home1(): return "This is homepage 1"

@app.route("/home/")
def home2(): return "This is homepage 2"

A rule without a trailing slash matches only /home. A rule with the slash matches /home/, and if a user types /home for a rule that ends in a slash, Flask redirects them to /home/. With both rules defined as above, /home gives homepage 1 and /home/ gives homepage 2, so the real answer for /home/ was "This is homepage 2".

Methods

A route answers GET only unless you list other methods.

@app.route("/only", methods=["POST"])
def only(): return "posted"

A browser address bar sends GET, so /only gives 405 Method Not Allowed. If the app has @app.errorhandler(405) returning "Please check the web request", that message is what you see. In one real question the route was /home/<username> with methods=['POST'], the URL typed in the browser was /home/user_4 (a GET), and the code inside (including abort(404)) never ran: the 405 handler's text appeared. Check the method before you trace the body.

url_for builds URLs from endpoint names

with app.test_request_context():
    print(url_for("greet", name="J"))        # /greet/J
    print(url_for("plus_one", n=3, x=1))     # /n/3?x=1   (extra values become the query string)
    print(url_for("static", filename="a.css"))   # /static/a.css

Use url_for instead of typing paths, so renaming a URL does not break your links. In templates: ` {{ url_for('greet', name='J') }} . Missing a required variable raises BuildError. In a real paper url_for('profile', student_name='John', student_id=101) for the route /student/<student_name>/<student_id> printed /student/John/101`, not a query string.

Idea 3: The request object and responses

Import it: from flask import request.

request.args["x"] raises a 400 Bad Request if x is missing, while request.args.get("x") returns None. A POST whose body is JSON but with no JSON content type makes request.json fail with 415 Unsupported Media Type (Flask 3).

What a view can return:

valid_users = [{"uid": "student", "pwd": "12345"}, {"uid": "professor", "pwd": "54321"}]

@app.route("/signin")
def login():
    args = request.args
    for vu in valid_users:
        if vu["uid"] == args["uid"] and vu["pwd"] == args["pwd"]:
            return "You are authorized!!"
        else:
            return "You are unauthorized!!"

Dict versus jsonify. For the route that returns {"Restaurant 1": "Hotel Alpine", ...} the content type is application/json. jsonify({"The list of gadgets": Gadgets}) gives an object with one key whose value is the whole list of dicts (not a merged dictionary). For jsonify(courses) where courses is a list of two dicts, status is 200 and mimetype application/json.

Idea 4: Redirects, errors, flash messages and sessions

Redirect. redirect(url_for("index")) sends 302 and the browser requests the new URL itself. In a real question, /first_index/XYZ redirected to index1's URL (/XYZ) and /first_index/ABC redirected to /second_index, which rendered a page with a "Go back" link.

Errors. abort(404) raises an HTTP error. Customise the page with a handler:

@app.errorhandler(404)
def not_found(e):
    return "Course not available!", 404

If you do not give the status after the text, the page still has status 200: fine for the browser output, wrong for tests. Common codes: 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 405 Method Not Allowed, 500 Server Error. In recent Flask, a handler for an unknown code such as 407 will not even register, so such questions always hinge on which error happens first (here the 405).

Flash messages show a one-time note on the next page.

from flask import flash, redirect, url_for, request

@app.route("/add", methods=["GET", "POST"])
def add():
    if request.method == "POST":
        name = request.form.get("name", "").strip()
        if not name:
            flash("Name required")
            return redirect(url_for("add"))
        flash("Added")
        return redirect(url_for("index"))
    return render_template("add.html")

In the template: ` {% for m in get_flashed_messages() %}<p>{{ m }}</p>{% endfor %} . Flash needs a secret_key`, because messages ride in the session.

Sessions remember a user between requests. The data is stored in a cookie in the browser, signed with secret_key: the user can read it (it is only base64) but cannot change it without Flask noticing.

app.secret_key = "change-me"      # or app.config["SECRET_KEY"]

session["uid"] = 7                # log in
uid = session.get("uid")          # read; None if absent
session.pop("uid", None)          # log out

With no secret key, using session raises RuntimeError: The session is unavailable because no secret key was set. Do not store passwords or big objects in the session, and never commit a real secret key to a public repository.

Idea 5: Post/Redirect/Get, validation and business logic

Business logic is the part that says what your app allows. It belongs in the controller (or a service function it calls), never only in the HTML.

There are two layers of validation. Frontend validation happens in the browser (required, type="email", min, max, pattern in the HTML) and is easy to bypass. Backend validation happens in the Python view and is the one you must trust. A real MSQ listed a form that had required attributes and a Python check if name == "": return redirect('/add') as having both, and a form whose HTML is built by the Python function as dynamically generated. One more subtlety from that paper: a CSS rule input:valid {border: 2px solid red} colours the border when the input is valid, not when it is blank.

class User(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(50), unique=True, nullable=False)
    tasks = db.relationship("Task", backref="owner", cascade="all, delete-orphan")

class Task(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    title = db.Column(db.String(100), nullable=False)
    user_id = db.Column(db.Integer, db.ForeignKey("user.id"), nullable=False)

@app.route("/tasks/add", methods=["GET", "POST"])
def add_task():
    uid = session.get("uid")
    if uid is None:
        abort(401)                                   # not logged in
    if request.method == "POST":
        title = request.form.get("title", "").strip()
        if not title:
            flash("Title is required")               # validation
            return redirect(url_for("add_task"))
        if Task.query.filter_by(user_id=uid, title=title).first():
            flash("Duplicate task")                  # duplicate check
            return redirect(url_for("add_task"))
        db.session.add(Task(title=title, user_id=uid))
        db.session.commit()
        flash("Task added")
        return redirect(url_for("list_tasks"))       # PRG
    return render_template("add.html")

@app.route("/tasks/<int:task_id>/delete", methods=["POST"])
def delete_task(task_id):
    t = db.session.get(Task, task_id)
    if t is None:
        abort(404)
    if t.user_id != session.get("uid"):
        abort(403)                                   # authorisation
    db.session.delete(t)
    db.session.commit()
    return redirect(url_for("list_tasks"))

Cascade and delete rules. If a user owns tasks and you delete the user, the tasks would be left pointing at nothing. Decide a rule: cascade="all, delete-orphan" deletes the children too; or refuse deletion while children exist (check and flash("Remove tasks first")). The viva loves this question.

Idea 6: Blueprints, configuration and the MVC mapping

MVC. Model = db.Model classes and the database. View = Jinja templates (what the user sees). Controller = the route functions: they read the request, apply business rules, call models and pick a view. A good app keeps SQL out of templates and HTML out of models.

Blueprints split a big app into parts (auth, tasks, admin). Each blueprint has its own routes, and the app registers it with a URL prefix.

from flask import Blueprint
tasks_bp = Blueprint("tasks", __name__, url_prefix="/tasks")

@tasks_bp.route("/")
def list_tasks(): ...

app.register_blueprint(tasks_bp)

The endpoint name now has the blueprint's name in front: url_for("tasks.list_tasks") gives /tasks/. Inside the same blueprint you can write url_for(".list_tasks").

Configuration is a dictionary on the app:

app.config["SECRET_KEY"] = "change-me"
app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///app.sqlite3"
app.config.update(DEBUG=True)         # many keys at once
app.config.from_object("config.Dev")  # or from a class or file

Application factory. Instead of a global app, write a function that builds the app. This lets tests create a fresh app each time and avoids import loops.

db = SQLAlchemy()                     # created without an app

def create_app(config=None):
    app = Flask(__name__)
    app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///:memory:"
    app.config["SECRET_KEY"] = "change-me"
    app.config.update(config or {})
    db.init_app(app)                  # connect db to this app
    app.register_blueprint(tasks_bp)
    with app.app_context():
        db.create_all()
    return app

if __name__ == "__main__":
    create_app().run(debug=True)

Whether your course project needs a factory depends on its size: a single app.py is acceptable. Know the idea.

Exam radar

Quick quiz

Viva: say it out loud

Recap

Practise with real exam questions

These come straight from past papers (with the real figures and the official answer key). Open 60 real questions on this week   All Quiz 2 papers