How to implement permissions in Flask-Admin to add users with a specific role?

Question

Python

I am using Flask-Admin and Flask-Security to implement the admin for my Python application. Here are the models for Role and User respectively:

class Role(db.Model, RoleMixin):
    id = db.Column(db.Integer(), primary_key=True)
    name = db.Column(db.String(80), unique=True)
    description = db.Column(db.String(255))

    def __str__(self):
        return self.name


class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(255), unique=True, index=True)
    password = db.Column(db.String(255))
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

    def __str__(self):
        return self.username

I made User's sqla.ModelView available only to users with "admin" and "superadmin" roles, and now users with these roles can add/edit/change new users. How can I make sure that only "superadmin" users can create users with "superadmin" and "admin" roles (i.e. superadmins can create everyone, and admins can create everyone except admins and superadmins)? In other words, I want to specify which of these options will be available to users with different roles: https://imgur.com/a/GdhUS2Y.
And I googled and read the docks, I could not find anything on this problem :(

Answer 1

Maybe the book "Developing Web Applications with Flask in Python" by Miguel Greenberg can help you. Chapter 9 - "User Roles". The book is available in pdf online.

Answer 2

This can be resolved with def on_model_change(self, form, model, is_created=True) :
And then check the role, if superduperadmin, then let's create an admin, if normal admin, then football.