Reimplement has_access decorator.

[bkyryliuk]

I moved has_access to utils and extended the redirect upon successful login to provide next arg that can be used by the login implementation to redirect user back to the original path.

I plan to contribute it back to the FAB later on.

Partially solves: #1303

It can be used then in the login implementation

from flask import request, url_for

def redirect_url():
    return request.args.get('next') or request.referrer or url_for('index')


class AuthRemoteUserView(AuthRemoteUserView):
    @expose('/login/')
    def login(self):
      .....
      if success:
         return redirect(self.redirect_url())

Additional links:

• http://flask.pocoo.org/docs/0.12/reqcontext/
• http://flask.pocoo.org/docs/0.12/api/#flask.Request.path

Reviewers:

• @mistercrunch
• @vera-liu
• @ascott

[mistercrunch]

why do we need this? seems like it could bite us in the future.

[bkyryliuk]

@mistercrunch - I just copied existing implementation:
https://github.com/dpgaspar/Flask-AppBuilder/blob/af095ac4094d068fa2dd467bd01fa8b95d697fc1/flask_appbuilder/security/decorators.py#L5

I plan to create another PR to path FAB is possible, there is a TODO for it.

[rpwils]

Has there been anymore progress on this issue?

[rpwils]

xrmx - This solution was not fully implemented in superset. The auth views in flask appbuilder do not take this change into account and they are not implemented in superset. We have implemented oauth login without the user needing to click the login buttons. When this occurs there is a popup to warn the user that Access was denied which is implemented in the has_access method thus forcing us to over write both. Any thought on how to resolve this?