title: Using both OAuth and GAE's Users API within a GAE application
body: <p>I would like to host my Flask-based web application on GAE.</p>
  
  <p><strong>Regular users</strong> are authenticated against Google using <a href="https://github.com/lepture/flask-oauthlib" rel="nofollow noreferrer">flask-oauthlib</a>.</p>
  
  <p>However, I would like to authenticate <strong>admin users</strong> using GAE's <a href="https://cloud.google.com/appengine/docs/python/users/" rel="nofollow noreferrer">Users API</a>, since it provides, among others, the <code>users.is_current_user_admin()</code>.</p>
  
  <p>However, it seems that I cannot protect the <code>admin</code> region from <code>app.yaml</code>, because the following configuration is not valid:</p>
  
  <pre><code># app.yaml
  [...]
  handlers:
  # For admin users
  # THIS IS INVALID!
  - url: /admin
    login: admin
  
  # For regular users
  - url: /.*
    script: main.app
  </code></pre>
  
  <hr>
  
  <p><strong>Option 1:</strong> Create a separate flask <code>app</code> object in the same GAE application:</p>
  
  <pre><code># app.yaml
  [...]
  # For admin users
  - url: /admin
    script: admin.app
    login: admin
  </code></pre>
  
  <p>Is that a good practice? If not, why?</p>
  
  <hr>
  
  <p><strong>Option 2:</strong> Simply implement a function such as:</p>
  
  <pre><code>def is_admin():
    return current_user.email in ["admin1@...", "admin2@...", "admin3@..."]
  </code></pre>
  
  <p>That is, do not rely on GAE's Users API.</p>
  
  <hr>
  
  <p>Notes:</p>
  
  <ul>
  <li>there are only a few admin users</li>
  <li>I do not need fine-grained roles at the moment</li>
  </ul>
  
  <p>Any thoughts (other solutions)?</p>