authentication - How do I structure this medium sized flask application? -

using flask framework in python, application needs to:

1. register , log in users (with either sqlite or postgres database)
2. access specific google spreadsheet logged in user owns , output data in json format. i required have own authorization & authentication system

i having lot of trouble figuring out how structure application - directories , sub-directories should have?

i have done lot of playing around (about 1 months worth). using virtual environment don't know how test code either. in general, code runs have no idea how work really.** new flask.**

structuring app:

|app

|----run.py

|----config.py

|----database

|---------database.db

|----app

|---------views.py

|---------models.py

|---------forms.py

|---------extensions.py

|----templates

|---------....

|----static

|--------....

authorization / authentication: i have looked @ flask-login, flask-auth, flask-security. understand general idea not know how securely implement complete authorization & authentication system.

app = flask(__name__) app.config.from_object(config) login_manager = loginmanager() login_manager.init_app(app)  def create_app():        db.init_app()     db.app = app     db.create_all()     return app  @app.route('/') def index():      #needs render homepage template  @app.route('/signup', methods = ['get', 'post']) def register():     form = signupform()     if request.method == 'get':         return render_template('signup.html', form=form)     elif request.method == 'post':         if form.validate_on_submit():             if user.query.filter_by(email=form.email.data).first():                 return "email exists"             else:                 newuser = user(form.email.data, form.password.data)                 db.session.add(newuser)                 db.session.commit()                 login_user(newuser)              return "new user created"     else:         return "form didn't validate"      return "signup"  @app.route('/login', methods = ['get', 'post']) def login():     form = signupform()      if request.method == 'get':         return render_template('login.html', form=form)     elif request.method == 'post':         if form.validate_on_submit():             user = user.query.filter_by(email=form.email.data).first()             if user:                 if user.password == form.password.data:                     login_user(user)                     return "you logged in"                 else:                     return "wrong password"             else:                 return "user doesnt exist"         else:             return "form did not validate"  @login_manager.user_loader def load_user(email):     return user.query.filter_by(email = email).first()  @app.route('/protected') @login_required def protected():     return "protected area logged in users only"  if __name__ == '__main__':     #app.create_app()     app.run(port=5000, host='localhost')` 

---

from flask_security import security, sqlalchemyuserdatastore, usermixin, rolemixin, login_required import os  # create app app = flask(__name__) #app.config['debug'] = true app.config['secret_key'] = ''  app.config['sqlalchemy_database_uri'] = 'sqlite:////' app.config['security_password_hash'] = 'sha512_crypt' app.config['security_password_salt'] = str(os.urandom(24)) # create database connection object db = sqlalchemy(app)  # define models roles_users = db.table('roles_users',     db.column('user_id', db.integer(), db.foreignkey('user.id')),     db.column('role_id', db.integer(), db.foreignkey('role.id')))  class role(db.model, rolemixin):     id = db.column(db.integer(), primary_key=true)      name = db.column(db.string(80), unique=true)      description = db.column(db.string(255))  class user(db.model, usermixin):     id = db.column(db.integer, primary_key=true)     email = db.column(db.string(255), unique=true)      password = db.column(db.string(255))     active = db.column(db.boolean())     confirmed_at = db.column(db.datetime())     roles = db.relationship('role', secondary=roles_users,  backref=db.backref('users', lazy='dynamic'))   user_datastore = sqlalchemyuserdatastore(db, user, role) security = security(app, user_datastore)  # create user test @app.before_first_request  def create_user():     db.create_all()     user_datastore.create_user(email='', password='')     db.session.commit()  @app.route('/')  @login_required  def home():     #password = encrypt_password('mypass')     #print verify_and_update_password('mypass', password)     return "hello"  if __name__ == '__main__':      app.run(debug=true, use_reloader=false) 

** appreciate guidance!**

project structure:
if you're planning build larger flask application, should consider decomposing functionality blueprints.
official flask documentation has tutorial on how structure larger applications: http://flask.pocoo.org/docs/0.12/patterns/packages/

also, take @ hitchhiker's guide organizing project. has points: http://python-guide-pt-br.readthedocs.io/en/latest/writing/structure/

if you're designing rest api consider using flask-restful (which works nicely blueprints)