app.py

from flask import Flask
from flask import abort, Flask, redirect, render_template, request
from flask.views import View
from flask_wtf import FlaskForm
from flask_wtf.csrf import CSRFProtect
from os import urandom
from hydra_client import HydraAdmin
from flask_sqlalchemy import SQLAlchemy
from flask_security import Security, SQLAlchemyUserDatastore, \
    UserMixin, RoleMixin, login_required, current_user



HYDRA_ADMIN_URL = "http://127.0.0.1:4445"

app = Flask(__name__)
app.secret_key = urandom(16)
app.config['DEBUG'] = True
app.config['SECRET_KEY'] = 'super-secret'
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite://'
app.config["SECURITY_PASSWORD_SALT"] = "SuPeRrAnDoMpAsSwOrD"

db = SQLAlchemy(app)

# Define models
roles_users = db.Table('roles_users',
        db.Column('user_id', db.Integer(), db.ForeignKey('user.id')),
        db.Column('role_id', db.Integer(), db.ForeignKey('role.id')))

class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True)
    description = db.Column(db.String(255))

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(255), unique=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

# Create a user to test with
@app.before_first_request
def create_user():
    db.create_all()
    user_datastore.create_user(email='example@oas.example.com', password='password')
    db.session.commit()

csrf = CSRFProtect(app)


@app.route('/')
@login_required
def home():
    hydra = HydraAdmin(HYDRA_ADMIN_URL)
    challenge = request.args.get("login_challenge")
    if not challenge:
        print("nope")
        abort(400)
    print(challenge)
    login_request = hydra.login_request(challenge)
    redirect_to = login_request.accept(current_user.email)
    return redirect(redirect_to)