Doku: https://flask-jwt-extended.readthedocs.io/en/latest/index.html
Github: https://github.com/vimalloc/flask-jwt-extended

from flask import Flask, jsonify, request
from flask_jwt_extended import (
	JWTManager, jwt_required, create_access_token,
	get_jwt_identity
)
from werkzeug.security import safe_str_cmp

class User(object):
    def __init__(self, id, username, password, role):
        self.id = id
        self.username = username
        self.password = password
        self.role = role
    def __str__(self):
        return "User(id='%s',role='%s')" % (self.id, self.role)

users = [
    User(1, 'user1', 'abcxyz', 'user'),
    User(2, 'user2', 'abcxyz', 'admin'),
]

username_table = {u.username: u for u in users}

app = Flask(__name__)
app.debug = True
app.config['SECRET_KEY'] = 'super-secret'

jwt = JWTManager(app)

@app.route('/auth/login', methods=['POST'])
def login():
	if not request.is_json:
		return jsonify({"msg": "No JSON in request"}), 400
	username = request.json.get('username', None)
	password = request.json.get('password', None)
	user = username_table.get(username, None)
	if user and safe_str_cmp(user.password.encode('utf-8'), password.encode('utf-8')):
		access_token = create_access_token(identity={"username":user.username, "role":user.role})
		return jsonify(access_token=access_token, role=user.role), 200
	return "Unauthorized", 404

@app.route('/protected')
@jwt_required
def protected():
	current_identity = get_jwt_identity()
	return '%s' % current_identity

@app.route('/admin')
@jwt_required
def admin():
	current_identity = get_jwt_identity()
	if current_identity['role'] != "admin":
		return "Forbidden", 403
	return "You are admin!"