Restful framework【第七篇】权限组件

目录

• 基本使用
• 添加权限
•  权限源码流程
• 内置权限

 

---

回到顶部

基本使用#

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

-写一个类: class MyPer(BasePermission):     message='您没有权限'     def has_permission(self, request, view):     　　# 取出当前登录用户     　　user = request.user     　　# 取出当前登录用户类型的中文     　　tt = user.get_user_type_display()     　　if user.user_type == 0:         return True     　　else:         return False -局部使用     permission_classes=[MyPer] -全局使用 　　在setting中 　　"DEFAULT_PERMISSION_CLASSES":['app01.auth.MyPer'],

回到顶部

添加权限#

（1）API/utils文件夹下新建premission.py文件，代码如下：

• message是当没有权限时，提示的信息

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

# utils/permission.py     class SVIPPremission(object):     message = "必须是SVIP才能访问"     def has_permission(self,request,view):         if request.user.user_type != 3:             return False         return True     class MyPremission(object):     def has_permission(self,request,view):         if request.user.user_type == 3:             return False         return True

（2）settings.py全局配置权限

#全局
REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES":['API.utils.auth.Authentication',],
    "DEFAULT_PERMISSION_CLASSES":['API.utils.permission.SVIPPremission'],
}

（3）views.py添加权限

• 默认所有的业务都需要SVIP权限才能访问
• OrderView类里面没写表示使用全局配置的SVIPPremission
• UserInfoView类，因为是普通用户和VIP用户可以访问，不使用全局的，要想局部使用的话，里面就写上自己的权限类
• permission_classes = [MyPremission,]   #局部使用权限方法

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80

from django.shortcuts import render,HttpResponse from django.http import JsonResponse from rest_framework.views import APIView from API import models from rest_framework.request import Request from rest_framework import exceptions from rest_framework.authentication import BaseAuthentication from API.utils.permission import SVIPPremission,MyPremission   ORDER_DICT = {     1:{         'name':'apple',         'price':15     },     2:{         'name':'dog',         'price':100     } }   def md5(user):     import hashlib     import time     #当前时间，相当于生成一个随机的字符串     ctime = str(time.time())     m = hashlib.md5(bytes(user,encoding='utf-8'))     m.update(bytes(ctime,encoding='utf-8'))     return m.hexdigest()   class AuthView(APIView):     '''用于用户登录验证'''       authentication_classes = []      #里面为空，代表不需要认证     permission_classes = []          #不里面为空，代表不需要权限     def post(self,request,*args,**kwargs):         ret = {'code':1000,'msg':None}         try:             user = request._request.POST.get('username')             pwd = request._request.POST.get('password')             obj = models.UserInfo.objects.filter(username=user,password=pwd).first()             if not obj:                 ret['code'] = 1001                 ret['msg'] = '用户名或密码错误'             #为用户创建token             token = md5(user)             #存在就更新，不存在就创建             models.UserToken.objects.update_or_create(user=obj,defaults={'token':token})             ret['token'] = token         except Exception as e:             ret['code'] = 1002             ret['msg'] = '请求异常'         return JsonResponse(ret)     class OrderView(APIView):     '''     订单相关业务(只有SVIP用户才能看)     '''       def get(self,request,*args,**kwargs):         self.dispatch         #request.user         #request.auth         ret = {'code':1000,'msg':None,'data':None}         try:             ret['data'] = ORDER_DICT         except Exception as e:             pass         return JsonResponse(ret)     class UserInfoView(APIView):     '''        订单相关业务(普通用户和VIP用户可以看)        '''     permission_classes = [MyPremission,]    #不用全局的权限配置的话，这里就要写自己的局部权限     def get(self,request,*args,**kwargs):           print(request.user)         return HttpResponse('用户信息')

urls.py

?

1 2 3 4 5 6 7 8 9 10

from django.contrib import admin from django.urls import path from API.views import AuthView,OrderView,UserInfoView   urlpatterns = [     path('admin/', admin.site.urls),     path('api/v1/auth/',AuthView.as_view()),     path('api/v1/order/',OrderView.as_view()),     path('api/v1/info/',UserInfoView.as_view()), ]

auth.py

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

# API/utils/auth/py   from rest_framework import exceptions from API import models from rest_framework.authentication import BaseAuthentication     class Authentication(BaseAuthentication):     '''用于用户登录验证'''     def authenticate(self,request):         token = request._request.GET.get('token')         token_obj = models.UserToken.objects.filter(token=token).first()         if not token_obj:             raise exceptions.AuthenticationFailed('用户认证失败')         #在rest framework内部会将这两个字段赋值给request，以供后续操作使用         return (token_obj.user,token_obj)       def authenticate_header(self, request):         pass

（4）测试

普通用户访问OrderView,提示没有权限

 

 普通用户访问UserInfoView，可以返回信息

回到顶部

 权限源码流程#

（1）dispatch

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

def dispatch(self, request, *args, **kwargs):     """     `.dispatch()` is pretty much the same as Django's regular dispatch,     but with extra hooks for startup, finalize, and exception handling.     """     self.args = args     self.kwargs = kwargs     #对原始request进行加工，丰富了一些功能     #Request(     #     request,     #     parsers=self.get_parsers(),     #     authenticators=self.get_authenticators(),     #     negotiator=self.get_content_negotiator(),     #     parser_context=parser_context     # )     #request(原始request,[BasicAuthentications对象，])     #获取原生request,request._request     #获取认证类的对象，request.authticators     #1.封装request     request = self.initialize_request(request, *args, **kwargs)     self.request = request     self.headers = self.default_response_headers  # deprecate?       try:         #2.认证         self.initial(request, *args, **kwargs)           # Get the appropriate handler method         if request.method.lower() in self.http_method_names:             handler = getattr(self, request.method.lower(),                               self.http_method_not_allowed)         else:             handler = self.http_method_not_allowed           response = handler(request, *args, **kwargs)       except Exception as exc:         response = self.handle_exception(exc)       self.response = self.finalize_response(request, response, *args, **kwargs)     return self.response

（2）initial

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

def initial(self, request, *args, **kwargs):     """     Runs anything that needs to occur prior to calling the method handler.     """     self.format_kwarg = self.get_format_suffix(**kwargs)       # Perform content negotiation and store the accepted info on the request     neg = self.perform_content_negotiation(request)     request.accepted_renderer, request.accepted_media_type = neg       # Determine the API version, if versioning is in use.     version, scheme = self.determine_version(request, *args, **kwargs)     request.version, request.versioning_scheme = version, scheme       # Ensure that the incoming request is permitted     #4.实现认证     self.perform_authentication(request)     #5.权限判断     self.check_permissions(request)     self.check_throttles(request)

（3）check_permissions

里面有个has_permission这个就是我们自己写的权限判断

?

1 2 3 4 5 6 7 8 9 10 11

def check_permissions(self, request):     """     Check if the request should be permitted.     Raises an appropriate exception if the request is not permitted.     """     #[权限类的对象列表]     for permission in self.get_permissions():         if not permission.has_permission(request, self):             self.permission_denied(                 request, message=getattr(permission, 'message', None)             )

（4）get_permissions

 def get_permissions(self):
        """
        Instantiates and returns the list of permissions that this view requires.
        """
        return [permission() for permission in self.permission_classes]

（5）permission_classes

 

 所以settings全局配置就如下

#全局
REST_FRAMEWORK = {
   "DEFAULT_PERMISSION_CLASSES":['API.utils.permission.SVIPPremission'],
}

回到顶部

内置权限#

django-rest-framework内置权限BasePermission

默认是没有限制权限

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

class BasePermission(object):     """     A base class from which all permission classes should inherit.     """       def has_permission(self, request, view):         """         Return `True` if permission is granted, `False` otherwise.         """         return True       def has_object_permission(self, request, view, obj):         """         Return `True` if permission is granted, `False` otherwise.         """         return True

我们自己写的权限类，应该去继承BasePermission,修改之前写的permission.py文件

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

# utils/permission.py   from rest_framework.permissions import BasePermission   class SVIPPremission(BasePermission):     message = "必须是SVIP才能访问"     def has_permission(self,request,view):         if request.user.user_type != 3:             return False         return True     class MyPremission(BasePermission):     def has_permission(self,request,view):         if request.user.user_type == 3:             return False         return True

总结：

（1）使用

• 自己写的权限类：1.必须继承BasePermission类；  2.必须实现：has_permission方法

（2）返回值

• True   有权访问
• False  无权访问

（3）局部

• permission_classes = [MyPremission,] 

 （4）全局

REST_FRAMEWORK = {
   #权限
    "DEFAULT_PERMISSION_CLASSES":['API.utils.permission.SVIPPremission'],
}