Serializing Sqlalchemy Models For A Rest Api While Respecting Access Control?

Currently, the way our, as well as most web frameworks', serialization works is there's some type of method invocation which dumps the model into some type of format. In our case,

Solution 1:

establish the "serialization" contract via a mixin:

classSerializer(object):
    __public__ = None"Must be implemented by implementors"

    __internal__ = None"Must be implemented by implementors"defto_serializable_dict(self):
        # do stuff with __public__, __internal__# ...

keep it simple with the WSGI integration. "register", JSONSerializer as an object, and all that is some kind of Java/Spring thing, don't need that fanfare. Below is my pylons 1.0-style solution, I'm not on pyramid yet:

defmy_controller(self):
   # ...return to_response(request, response, myobject)


# elsewheredefto_response(req, resp, obj):
    # this would be more robust, look in# req, resp, catch key errors, whatever.# xxx_serialize are just functions.  don't need state
    serializer = {
       'application/json':json_serialize,
       'application/xml':xml_serialize,
       # ...
    }[req.headers['content-type']]

    return serializer(obj)