permissions approach

permission.py

class User(object):

	def permission_list(self):
		permissions = Permission.query.filter_by(user_id=self).all()
		l = []
		for permission in permissions:
			l.append((permission.to, permission.value))
		return l

	def permission_has(self, to):
		permission = Permission.query.filter_by(user_id=self.id, to=to).first()
		if not permission:
			return False
		else:
			return permission.value

	def permission_grant(self, to):
		permission = Permission.query.filter_by(user_id=user.id, to=to).first()
		if not permission:
			permission = Permission()
			permission.user_id = self.id
			permission.to = to
			permission.value = True
			db.sesssion.add(permission)
			db.session.commit()

	def permission_revoke(self, to):
		permission = Permission.query.filter_by(user_id=user.id, to=to).first()
		if permission:
			permission.value = False
			db.session.commit()

class Permission(db.Model):
	id = db.Column(db.Integer, primary_key=True)
	user_id = db.Column(db.Integer, db.ForeignKey('User.id'))

	to = db.Column(db.String(30))
	value = db.Column(db.Boolean)