快速使用

认证，根据用户携带的 token/其他 获取当前用户信息。

权限，读取认证中获取的用户信息，判断当前用户是否有权限访问，例如：普通用户、管理员、超级用户，不同用户具有不同的权限。

  1. class UserInfo(models.Model):
  3.     role_choices = ((1, "普通用户"), (2, "管理员"), (3, "超级管理员"),)
  4.     role = models.IntegerField(verbose_name="角色", choices=role_choices, default=1)
  6.     username = models.CharField(verbose_name="用户名", max_length=32)
  7.     password = models.CharField(verbose_name="密码", max_length=64)
  8.     token = models.CharField(verbose_name="TOKEN", max_length=64, null=True, blank=True)

image.png
image.png

image.png
image.png

  1. import uuid
  2. from rest_framework.views import APIView
  3. from rest_framework.request import Request
  4. from rest_framework.response import Response
  5. from rest_framework.authentication import BaseAuthentication
  6. from rest_framework.permissions import BasePermission
  7. from rest_framework.exceptions import AuthenticationFailed
  9. # Create your views here.
  10. from app01 import models
  13. class AuthView(APIView):
  14.     '''提交的数据 {"username": "mufeng", "password": "123456"}
  15.     '''
  17.     def post(self, request, *args, **kwargs):
  18.         print(request.data)
  19.         username = request.data.get('username')
  20.         password = request.data.get('password')
  22.         user_object = models.UserInfo.objects.filter(username=username, password=password).first()
  23.         if not user_object:
  24.             return Response({'code': 1000, 'data': '用户名或密码错误'})
  26.         token = str(uuid.uuid4())
  27.         user_object.token = token
  28.         user_object.save()
  29.         res = {'code': 0, 'data': {'token': token, 'name': username}}
  30.         return Response(res)
  33. class TokenAuthentication(BaseAuthentication):
  34.     def authenticate(self, request):
  35.         msg = {'code': 1002, 'data': '认证失败'}
  36.         token = request.query_params.get('token')
  37.         if not token:
  38.             raise AuthenticationFailed(msg)
  40.         user_object = models.UserInfo.objects.filter(token=token).first()
  41.         if not user_object:
  42.             raise AuthenticationFailed(msg)
  44.         return user_object, token
  47. class PermissionA(BasePermission):
  48.     message = {"code": 1003, 'data': "无权访问"}
  50.     def has_permission(self, request, view):
  51.         if request.user.role == 2:
  52.             return True
  53.         return False
  55.     # 暂时先这么写
  56.     def has_object_permission(self, request, view, obj):
  57.         return True
  60. class OrderView(APIView):
  61.     authentication_classes = [TokenAuthentication]
  62.     permission_classes = [PermissionA, ]
  64.     def get(self, request, *args, **kwargs):
  65.         return Response({'code': 1000, 'data': '认证成功'})

多个权限类

当开发过程中需要用户同时具备多个权限（缺一不可）时，可以用多个权限类来实现。

权限组件内部处理机制：按照列表的顺序逐一执行 has_permission 方法，如果返回True，则继续执行后续的权限类；如果返回None或False，则抛出权限异常并停止后续权限类的执行。

  1. from django.db import models
  4. # Create your models here.
  5. # models.py
  6. class Role(models.Model):
  7.     """ 角色表 """
  8.     title = models.CharField(verbose_name="名称", max_length=32)
  11. class UserInfo(models.Model):
  12.     username = models.CharField(verbose_name="用户名", max_length=32)
  13.     password = models.CharField(verbose_name="密码", max_length=64)
  14.     token = models.CharField(verbose_name="TOKEN", max_length=64, null=True, blank=True)
  16.     roles = models.ManyToManyField(verbose_name="角色", to="Role")
  1. import uuid
  2. from rest_framework.views import APIView
  3. from rest_framework.request import Request
  4. from rest_framework.response import Response
  5. from rest_framework.authentication import BaseAuthentication
  6. from rest_framework.permissions import BasePermission
  7. from rest_framework.exceptions import AuthenticationFailed
  9. # Create your views here.
  10. from app01 import models
  13. class AuthView(APIView):
  14.     '''提交的数据 {"username": "mufeng", "password": "123456"}
  15.     '''
  17.     def post(self, request, *args, **kwargs):
  18.         print(request.data)
  19.         username = request.data.get('username')
  20.         password = request.data.get('password')
  22.         user_object = models.UserInfo.objects.filter(username=username, password=password).first()
  23.         if not user_object:
  24.             return Response({'code': 1000, 'data': '用户名或密码错误'})
  26.         token = str(uuid.uuid4())
  27.         user_object.token = token
  28.         user_object.save()
  29.         res = {'code': 0, 'data': {'token': token, 'name': username}}
  30.         return Response(res)
  33. class TokenAuthentication(BaseAuthentication):
  34.     def authenticate(self, request):
  35.         msg = {'code': 1002, 'data': '认证失败'}
  36.         token = request.query_params.get('token')
  37.         if not token:
  38.             raise AuthenticationFailed(msg)
  40.         user_object = models.UserInfo.objects.filter(token=token).first()
  41.         if not user_object:
  42.             raise AuthenticationFailed(msg)
  44.         return user_object, token
  47. class PermissionA(BasePermission):
  48.     message = {"code": 1003, 'data': "无权访问"}
  50.     def has_permission(self, request, view):
  51.         exists = request.user.roles.filter(title="员工").exists()
  52.         if exists:
  53.             return True
  54.         return False
  56.     def has_object_permission(self, request, view, obj):
  57.         return True
  60. class PermissionB(BasePermission):
  61.     message = {"code": 1003, 'data': "无权访问"}
  63.     def has_permission(self, request, view):
  64.         exists = request.user.roles.filter(title="主管").exists()
  65.         if exists:
  66.             return True
  67.         return False
  69.     def has_object_permission(self, request, view, obj):
  70.         return True
  73. class OrderView(APIView):
  74.     authentication_classes = [TokenAuthentication, ]
  75.     permission_classes = [PermissionA, PermissionB]  # 既是员工，又是主管
  77.     def get(self, request, *args, **kwargs):
  78.         return Response({"code": 0, "data": {"user": None, 'list': [1, 2, 3]}})

image.png
image.png
image.png

image.png

全局配置

  1. REST_FRAMEWORK = {
  2.     "DEFAULT_PERMISSION_CLASSES":["xxxx.xxxx.xx.类名","xxxx.xxxx.xx.类名",]
  3. }