## Enforce private-file authorization for Flask

### Summary
Private file access for a Flask app on Ample. Verified on Flask: a role-to-document access model with negative tests (401, 403) and an authorized private-bucket round-trip (private=ok). Build and start: pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template.

### Prerequisites
- A Flask project (pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template)
- A PostgreSQL driver reading DATABASE_URL at runtime
- A bucket from `ample bucket create` with credentials passed as encrypted S3_* environment variables
- An Ample account token with servers:write, databases:read, buckets:read

### Workflow Steps
1. **Build and start**: pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template; the server must bind 0.0.0.0 on PORT.
2. **Create the bucket and pass its credentials**: Create it once with `ample bucket create`, then pass endpoint, region, bucket and keys with --env; use path-style addressing.  
   Command: `ample deploy . --name  --public --start "python3 app.py" --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=...`
3. **Authorize before touching storage**: Return 401 for unauthenticated requests and 403 for the wrong role; keep the bucket unpublished and stream objects through the app.
4. **Verify**: Fetch the live URL and /p/private-document-library on the example; on failure read the build and runtime logs.  
   Command: `ample logs  --kind build`

### Examples
- **Flask pattern fixture**: Verified private file access on Flask.

### Success Checks
- App responds on its public URL when accessing `/`.
- The `/p/private-document-library` endpoint check from the example should return the expected results.

### Limitations
- Verified on the python-3.12 template at s-1vcpu-1gb; other sizes and Flask major versions are not verified.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Managed PostgreSQL 16 only; extensions, connection limits and backup or restore procedures are not verified.

### Cost Estimate
- **Currency**: USD
- **Monthly Amount**: 10.0
- **Components**:
  - App server: s-1vcpu-1gb ($5.0/month)
  - Managed PostgreSQL database: s-1vcpu-1gb ($5.0/month)
- **Note**: Always-on monthly price of the tested sizes; apps auto-pause when idle. Buckets are allocation-priced per quota and not included.

### Evidence Summary
- **Canary run**: Flask pattern fixture deployed on Ample; contains a role-to-document access model with negative tests (401, 403) and an authorized private-bucket round-trip (private=ok).  
  Observed at: 2026-09-21T01:14:18Z.

### Formats
- **HTML**: [Link](/content/guides/flask/private-file-access/index.html)  
- **Markdown**: [Link](/content/guides/flask/private-file-access.md)  
- **JSON**: [Link](https://api.ample.computer/v1/catalog/recipes/page%3Aguides%3Aflask%3Aprivate-file-access)

### Next Actions
- [Browse the catalog index](#)
- [Search published recipes by intent, stack and constraints](#)
- [Prepare a side-effect-free deployment plan for an authorized project](#)