I am using flask and whooshalchemy to implement full text search in a simple web application. The Post and User models are defined like this:
class Post(db.Model):
__searchable__ = ['body']
id = db.Column(db.Integer, primary_key=True)
body = db.Column(db.Text)
author_id = db.Column(db.Integer, db.ForeignKey('user.id'))
class User(db.Model):
id = db.Column(db.Integer, primary_key=True)
posts = db.relationship('Post', backref='author', lazy='dynamic')
whooshalchemy.whoosh_index(app, Post)
In some view I perform a check whether current user is allowed to edit the post
post = Post.query.get(pid)
if current_user != post.author:
abort(403)
For some reason current_user and post.author are not the same object if whooshalchemy.whoosh_index(app, Post) is called. If I comment out that line then the test for the ownership of the post works as expected.
Why is this happening? Does whooshalchemy indexing create a copy of post.author that is different from what is loaded from user table? What can I do to correct it?
