Project: a trail log web app

Step 2: only your own records

The most important rule in this app is one line in every query: filter by the signed-in user. The list page asks for select(Hike).where(Hike.user_id == g.user.id), never for all hikes. Deleting looks the hike up by both its id and its owner:

hike = db().scalars(select(Hike).where(Hike.id == hike_id, Hike.user_id == g.user.id)).first()
if hike is None:
    abort(404)

Why 404 and not 403? A 403 would confirm that hike 17 exists and belongs to someone else. To a member, other people's hikes simply don't exist, so the honest answer is "not found". This bug class, reaching another person's record by changing a number in the URL, is called an insecure direct object reference, and it's one of the most common flaws found in real web apps. The fix is always the same: every lookup is scoped to the owner.

Accounts come from the login lesson unchanged: bcrypt hashes, session.clear() at login, a before_request function that puts the signed-in user in g.user, and a login_required decorator.

Step 3: the add form

The add form follows the forms lesson exactly. A check_hike(form) function returns cleaned values and errors:

• trail: required, with spaces trimmed;
• day: an ISO date (2025-06-14), not in the future;
• km: a number above 0 and at most 100 (a typo like 115 instead of 11.5 should be caught, not saved).

On errors, the view shows the hikes page again with the messages, the typed values and status 400. On success it saves, flashes "Hike saved." and redirects with 303 to /hikes. The project fixes "today" as a constant, TODAY, so the tests give the same result on any day; a real app would use date.today() and its tests would replace it.

Step 4: test it like a user

Each test signs up its own users with the test client, then does what a person would do: add hikes, look at the list, try something they shouldn't. The checks for this project follow the routes table: one or more checks per row, plus the rule that matters most, that one member never sees or deletes another member's hikes. When you build your own app, write those tests first. They're the fastest way to know the wiring holds as the app grows.

from flask import Flask, g
from sqlalchemy import create_engine, text

def create_app(database_url="sqlite://"):
    app = Flask(__name__)
    engine = create_engine(database_url)
    with engine.begin() as conn:
        conn.execute(text("CREATE TABLE IF NOT EXISTS visits (n INTEGER)"))

    @app.get("/")
    def home():
        with engine.begin() as conn:
            conn.execute(text("INSERT INTO visits VALUES (1)"))
            count = conn.execute(text("SELECT COUNT(*) FROM visits")).scalar_one()
        return f"visit number {count}"

    return app

first = create_app().test_client()
second = create_app().test_client()
print(first.get("/").get_data(as_text=True))
print(first.get("/").get_data(as_text=True))
print(second.get("/").get_data(as_text=True))

Running it on your own computer

To run the app outside the academy, save it as trail_log.py in a project folder with a virtual environment, as the local setup lesson showed. Then pip install flask sqlalchemy bcrypt, set SECRET_KEY and DATABASE_URL as environment variables, and start it with flask --app trail_log run --debug. Change sqlite:// to sqlite:///trail_log.db so the data survives restarts.

Two things a real deployment adds: migrations (with Alembic) so you can add a column later without losing data, and a production server such as Gunicorn behind HTTPS. The containers lesson packages an app like this one into an image you can deploy anywhere.

from flask import Flask, render_template_string, request

app = Flask(__name__)
SHOPS = [
    {"name": "Stitch & Seam", "town": "Fern Hollow", "fixes": ["tents", "jackets"]},
    {"name": "Ridge Cobbler", "town": "North Ridge", "fixes": ["boots"]},
]

PAGE = """<h1>Gear repair</h1>
<ul>{% for s in shops %}<li>{{ s.name }}, {{ s.town }}: {{ s.fixes | join(", ") }}</li>{% endfor %}</ul>"""


@app.route("/")
def home():
    town = request.args.get("town")
    shops = [s for s in SHOPS if not town or s["town"] == town]
    return render_template_string(PAGE, shops=shops)


client = app.test_client()
print(client.get("/?town=Fern Hollow").get_data(as_text=True))
# your code: a database, accounts, suggestions, reviews and tests