app\models(2).py

#...
from . import db, login_manager

class Permission:
   	FOLLOW = 1
   	COMMENT = 2
    WRITE = 4
    MODERATE = 8
    ADMIN = 16


class Role(db.Model):
   __tablename__ = 'roles'
   id = db.Column(db.Integer, primary_key=True)
   name = db.Column(db.String(64), unique=True)
   default = db.Column(db.Boolean, default=False, index=True)
   permissions = db.Column(db.Integer)
   users = db.relationship('User', backref='role', lazy='dynamic')

   def __init__(self, **kwargs):
       super(Role, self).__init__(**kwargs)
       if self.permissions is None:
           self.permissions = 0

   @staticmethod
   def insert_roles():
       roles = {
           'User': [Permission.FOLLOW, Permission.COMMENT, Permission.WRITE],
           'Moderator': [Permission.FOLLOW, Permission.COMMENT,
                         Permission.WRITE, Permission.MODERATE],
           'Administrator': [Permission.FOLLOW, Permission.COMMENT,
                             Permission.WRITE, Permission.MODERATE,
                             Permission.ADMIN],
       }
       default_role = 'User'
       for r in roles:
           role = Role.query.filter_by(name=r).first()
           if role is None:
               role = Role(name=r)
           role.reset_permissions()
           for perm in roles[r]:
               role.add_permission(perm)
           role.default = (role.name == default_role)
           db.session.add(role)
       db.session.commit()

   def add_permission(self, perm):
       if not self.has_permission(perm):
           self.permissions += perm

   def remove_permission(self, perm):
       if self.has_permission(perm):
           self.permissions -= perm

   def reset_permissions(self):
       self.permissions = 0

   def has_permission(self, perm):
       return self.permissions & perm == perm

   def __repr__(self):
       return '<Role %r>' % self.name

class User(db.Model, UserMixin):
	#...
	avatar_hash = db.Column(db.String(32))

	def __init__(self, **kwargs)
		super(User, self).__init__(**kwargs)
		if self.role is None:
			# check if the new user is set up as the admin, and gives them admin permissions
			if self.email == current_app.config[‘OFFBRAND_ADMIN’]:
				self.role = Role.query.filter_by(name=’Administrator’).first()
			if self.role is None:
				self.role = Role.query.filter_by(default=True).first()
			if self.email is not None and self.avatar_hash is None:
				self.avatar_hash = self.gravatar_hash()