Django之权限管理

一, 引入

1.为什么要有权限?

2.为什么要开发权限的组件?

3.在web开发中,什么是权限?

4.表结构的设计

权限表

ID	URL
1	/user_list/
2	/customer_list/

用户表

ID	USER_NAME
1	root
2	root 2

角色/用户组表

ID	组
1	销售
2	开发

用户与角色的关系表

ID	USER_ID	角色ID
1	1	1
2	1	2
3	2	1
4	2	2

角色与权限的关系表

ID	角色ID	权限ID
1	1	1
2	1	2
3	2	1
4	2	2

models:

 from django.db import models
 
 
# 权限表
class Permission(models.Model):
    url = models.CharField(max_length=108, verbose_name='权限')
 
 
# 角色表
class Role(models.Model):
    name = models.CharField(max_length=108, verbose_name='角色')
    permissions = models.ManyToManyField('Permission', verbose_name='角色所拥有的权限', related_name='roles')
 
 
# 用户表
class UserInfo(models.Model):
    username = models.CharField(max_length=32, verbose_name='用户名')
    password = models.CharField(max_length=32, verbose_name='密码')
    roles = models.ManyToManyField('Role', verbose_name='用户所拥有的角色', related_name='users')

基本流程:

二, admin的展示

 from django.contrib import admin
from rbac import models
 
# 配置类
class PermissionAdmin(admin.ModelAdmin):
    # 展示
    list_display = ['title', 'url']
    # 可编辑
    list_editable = ['url']
 
admin.site.register(models.Role)
admin.site.register(models.Permission, admin_class=PermissionAdmin)
admin.site.register(models.UserInfo)

三, 记录登录状态与权限

 from django.utils.deprecation import MiddlewareMixin
from django.shortcuts import HttpResponse, redirect, reverse
from django.conf import settings
import re
 
def login(request):
    error = ''
    if request.method == 'POST':
        # 获取用户名和密码
        username = request.POST.get('username')
        password = request.POST.get('password')
        # 数据库校验用户名密码是否正确
        user_obj = models.UserInfo.objects.filter(username=username, password=password).first()
        if not user_obj:
            # 校验失败,返回登录页面
            error = '用户名或密码错误'
        else:
            # 登录成功
            # 查询当前用户的权限信息
            # permission = models.Permission.objects.filter(roles__users=user_obj).values('url').distinct()
            permission = user_obj.roles.all().filter(permissions__url__isnull=False).values('permissions__url').distinct()
            # 保存权限信息
            request.session['permission'] = list(permission)
            request.session['is_login'] = 1
            # 重定向去首页
            return redirect('index')
 
    return render(request, 'login.html', {'error': error})

四, 中间件校验权限

 class Rbac(MiddlewareMixin):
 
    def process_request(self, request):
        # 获取当前访问的地址
        url = request.path_info
        # 白名单
        for i in settings.WHITE_LIST:
            if re.match(i, url):
                return
        # 登陆状态的校验
        is_login = request.session.get('is_login')
        if not is_login:
            return redirect('login]')
        # 免认证校验
        for i in settings.PASS_AUTH_LIST:
            if re.match(i, url):
                return
        # 获取权限信息
        permissions = request.session.get('permission')
        # 权限的校验
        for i in permissions:
            if re.match(r'^{}$'.format(i['permissions__url']), url):
                return
                # 拒绝请求
        return HttpResponse('没有访问权限,请联系管理员')

 # settings.py中
# rbac 白名单
WHITE_LIST = [
    r'^/admin/',
    r'^/login/$',
    r'^/register/$',
]
 
# rabc 免认证
PASS_AUTH_LIST =[
    r'^/index/$'
]

五, 动态生成一级菜单

首先规范化RBAC:

 在settings.py中配置
PERMISSION_SESSION_KEY  session中记录权限的key
MENU_SESSION_KEY        session中记录菜单信息的key
LOGIN_SESSION_KEY       session中记录登录状态的key

将相关template,static,服务等整理到rbac(app)内

model的更改:

 # 权限表
class Permission(models.Model):
    url = models.CharField(max_length=108, verbose_name='权限')
    title = models.CharField(max_length=108, verbose_name='标题')
    is_menu = models.BooleanField(default=False, choices=((True, '是'), (False, '否')), verbose_name='是否目录')
    icon = models.CharField(max_length=64, verbose_name='图标', null=True, blank=True)
 
    def __str__(self):
        return self.title

session记录的更改:

 # 查询当前用户的权限信息
# permission = models.Permission.objects.filter(roles__users=user_obj).values('url').distinct()
permission = user_obj.roles.all().filter(permissions__url__isnull=False).values('permissions__url',
                                                                                'permissions__title',
                                                                                'permissions__is_menu',
                                                                                'permissions__icon',
                                                                                ).distinct()
# 权限的列表
permission_list = []
# 菜单的列表
menu_list = []
 
for i in permission:
    permission_list.append({
        'url': i['permissions__url']
    })
    if i.get('permissions__is_menu'):
        menu_list.append({
            'title': i['permissions__title'],
            'icon': i['permissions__icon'],
            'url': i['permissions__url']
        })
# 保存权限信息
request.session[settings.PERMISSION_SESSION_KEY] = permission_list
request.session[settings.LOGIN_SESSION_KEY] = True
# 保存菜单信息
request.session[settings.MENU_SESSION_KEY] = menu_list

自定义inclusion_tag:

 // 插件 menu.html
<div class="static-menu">
    {% for menu in menu_list %}
        <a href="{{ menu.url }}" class="{{ menu.class }}">
            <span class="icon-wrap"><i class="fa {{ menu.icon }}"></i></span> {{ menu.title }}</a>
    {% endfor %}
</div>
from django import template
from django.conf import settings
 
register = template.Library()
 
@register.inclusion_tag('rbac/menu.html')
def menu(request):
    menu_list = request.session.get(settings.MENU_SESSION_KEY)
    url = request.path_info
    for menu in menu_list:
        if menu.get('url') == url:
            menu['class'] = 'active'
    return {'menu_list': request.session.get(settings.MENU_SESSION_KEY)}

六, 动态生成二级菜单

model的更改:

 # 一级菜单表
class Menu(models.Model):
    title = models.CharField(max_length=108, verbose_name='一级菜单标题')
    icon = models.CharField(max_length=64, verbose_name='图标', null=True, blank=True)
 
    def __str__(self):
        return self.title
 
 
# 权限表(二级菜单)
class Permission(models.Model):
    '''
    menu_id: 有menu_id表示当前的权限是二级菜单
             没有menu_id表示当前的权限是普通权限
    '''
    url = models.CharField(max_length=108, verbose_name='权限')
    title = models.CharField(max_length=108, verbose_name='二级菜单标题')
    menu = models.ForeignKey('Menu', on_delete=models.CASCADE, verbose_name='一级菜单', null=True, blank=True)
 
    def __str__(self):
        return self.title

session记录的更改:

 # 查询当前用户的权限信息
# permission = models.Permission.objects.filter(roles__users=user_obj).values('url').distinct()
permission = user_obj.roles.all().filter(permissions__url__isnull=False).values('permissions__url',
                                                                                'permissions__title',
                                                                                'permissions__menu__title',
                                                                                'permissions__menu__icon',
                                                                                'permissions__menu_id'
                                                                                ).distinct()
# 权限的列表
permission_list = []
# 菜单的字典
menu_dict = {}
 
for i in permission:
    permission_list.append({'url': i.get('permissions__url')})
 
    menu_id = i.get('permissions__menu_id')
    if menu_id:
        menu_dict.setdefault(menu_id, {
            'title': i['permissions__menu__title'],
            'icon': i['permissions__menu__icon'],
            'children': []
        })
        menu_dict[menu_id]['children'].append(
            {
                'title': i['permissions__title'],
                'url': i['permissions__url']
            }
        )
# 保存权限信息
request.session[settings.PERMISSION_SESSION_KEY] = permission_list
request.session[settings.LOGIN_SESSION_KEY] = True
# 保存菜单信息
request.session[settings.MENU_SESSION_KEY] = menu_dict

自定义inclusion_tag:

 // 插件中 menu.html
<div class="multi-menu">
    {% for menu_first in menu_list %}
        <div class="item">
            <div class="title">
                <i class="fa {{ menu_first.icon }}"></i> {{ menu_first.title }}
            </div>
            <div class="body">
                {% for menu_second in menu_first.children %}
                    <a class="{{ menu_second.class }}" href="{{ menu_second.url }}">{{ menu_second.title }}</a>
                {% endfor %}
            </div>
        </div>
    {% endfor %}
</div>

 # inclusion_tag
@register.inclusion_tag('rbac/menu.html')
def menu(request):
    menu_list = request.session.get(settings.MENU_SESSION_KEY).values()
    url = request.path_info
    for menu in menu_list:
        for i in menu.get('children'):
            if i.get('url') == url:
                i['class'] = 'active'
    return {'menu_list': menu_list}

七, 面包屑导航

model的更改:

 # 一级菜单表
class Menu(models.Model):
    title = models.CharField(max_length=108, verbose_name='一级菜单标题')
    icon = models.CharField(max_length=64, verbose_name='图标', null=True, blank=True)
    weight = models.IntegerField(default=1, verbose_name='权重') # 用于一级菜单排序
 
    def __str__(self):
        return self.title
 
 
# 权限表(二级菜单)
class Permission(models.Model):
    url = models.CharField(max_length=108, verbose_name='权限')
    title = models.CharField(max_length=108, verbose_name='二级菜单标题')
    menu = models.ForeignKey('Menu', on_delete=models.CASCADE, verbose_name='一级菜单', null=True, blank=True)
    parent = models.ForeignKey('self', on_delete=models.DO_NOTHING, verbose_name='父权限', null=True, blank=True)  # 用于区分二级权限和三级权限,生成面包屑导航
 
    def __str__(self):
        return self.title

session记录的更改:

     # 查询当前用户的权限信息
    # permission = models.Permission.objects.filter(roles__users=user_obj).values('url').distinct()
    permission = user_obj.roles.all().filter(permissions__url__isnull=False).values('permissions__url',
                                                                                    'permissions__title',
                                                                                    'permissions__id',
                                                                                    'permissions__parent_id',
                                                                                    'permissions__menu__title',
                                                                                    'permissions__menu__icon',
                                                                                    'permissions__menu__weight',
                                                                                    'permissions__menu_id',
                                                                                    ).distinct()
    # 权限的字典
    permission_dict = {}
    # 菜单的字典
    menu_dict = {}
 
    for i in permission:
        permission_dict[i.get('permissions__id')] = {
            'url': i.get('permissions__url'),
            'title': i.get('permissions__title'),
            'id': i.get('permissions__id'),
            'parent_id': i.get('permissions__parent_id')
 
        }
 
        menu_id = i.get('permissions__menu_id')
        if menu_id:
            menu_dict.setdefault(menu_id, {
                'title': i['permissions__menu__title'],
                'icon': i['permissions__menu__icon'],
                'weight': i['permissions__menu__weight'],
                'children': []
            })
            menu_dict[menu_id]['children'].append(
                {
                    'title': i['permissions__title'],
                    'url': i['permissions__url'],
                    'id': i['permissions__id'],
                }
            )
    # 保存权限信息
    request.session[settings.PERMISSION_SESSION_KEY] = permission_dict
    request.session[settings.LOGIN_SESSION_KEY] = True
    # 保存菜单信息
    request.session[settings.MENU_SESSION_KEY] = menu_dict

 # 此时session记录信息数据格式
# 注意: 存入session中时经过json序列化,字典的key中的数字会转换为字符串
# 权限信息字典
{
	1: {
		'url': '/customer/list/',
		'title': '客户列表',
		'id': 1,
		'parent_id': None
	},
	2: {
		'url': '/customer/add/',
		'title': '添加客户',
		'id': 2,
		'parent_id': 1
	},
	3: {
		'url': '/customer/edit/(?P<cid>\\d+)/',
		'title': '编辑客户',
		'id': 3,
		'parent_id': 1
	},
	4: {
		'url': '/customer/del/(?P<cid>\\d+)/',
		'title': '删除客户',
		'id': 4,
		'parent_id': 1
	},
	5: {
		'url': '/payment/list/',
		'title': '缴费列表',
		'id': 5,
		'parent_id': None
	},
	6: {
		'url': '/payment/add/',
		'title': '添加缴费',
		'id': 6,
		'parent_id': 5
	},
	7: {
		'url': '/payment/edit/(?P<pid>\\d+)/',
		'title': '编辑缴费',
		'id': 7,
		'parent_id': 5
	},
	8: {
		'url': '/payment/del/(?P<pid>\\d+)/',
		'title': '删除缴费',
		'id': 8,
		'parent_id': 5
	}
}
 
# 菜单信息字典
{
	1: {
		'title': '客户管理',
		'icon': 'fa-address-book',
		'weight': 10,
		'children': [{
			'title': '客户列表',
			'url': '/customer/list/',
			'id': 1
		}]
	},
	2: {
		'title': '财务管理',
		'icon': 'fa-money',
		'weight': 1,
		'children': [{
			'title': '缴费列表',
			'url': '/payment/list/',
			'id': 5
		}]
	}
}

中间件的更改:

 class Rbac(MiddlewareMixin):
 
    def process_request(self, request):
        # 获取当前访问的地址
        url = request.path_info
        # 初始化current_menu_id
        request.current_menu_id = None
        # 初始化导航列表
        request.breadcrumb_list = [
            {'title': '首页', 'url': '/index/'}
        ]
        # 白名单
        for i in settings.WHITE_LIST:
            if re.match(i, url):
                return
        # 登陆状态的校验
        is_login = request.session.get(settings.LOGIN_SESSION_KEY)
        if not is_login:
            return redirect('login')
        # 免认证校验
        for i in settings.PASS_AUTH_LIST:
            if re.match(i, url):
                return
        # 获取权限信息
        permissions = request.session.get(settings.PERMISSION_SESSION_KEY)
        # 权限的校验
        for i in permissions.values():
            # i 权限  父权限  子权限
            if re.match(fr'^{i["url"]}$', url):
                menu_id = i.get('parent_id')
                if not menu_id:
                    # 当前访问的权限是父权限(二级菜单)
                    menu_id = i.get('id')
                    request.breadcrumb_list.append({
                        'title': i['title'],
                        'url': i['url']
                    })
                else:
                    # 当前访问的权限是子权限
                    parent_permission = permissions[str(menu_id)]
                    request.breadcrumb_list.append({
                        'title': parent_permission['title'],
                        'url': parent_permission['url'],
                    })
                    request.breadcrumb_list.append({
                        'title': i['title'],
                        'url': i['url'],
                    })
                request.current_menu_id = menu_id
                return
                # 拒绝请求
        return render(request, 'rbac/403.html')

自定义inclusion_tag:

 @register.inclusion_tag('rbac/menu.html')
def menu(request):
    menu_list = request.session.get(settings.MENU_SESSION_KEY).values()
    od_menu_list = sorted(menu_list, key=lambda x: x['weight'], reverse=True)
    for menu in od_menu_list:
        menu['class'] = 'hidden'
        for i in menu.get('children'):
            if i.get('id') == request.current_menu_id:
                i['class'] = 'active'
                menu['class'] = ''
                break
    return {'menu_list': od_menu_list}
// 插件  menu.html
<div class="multi-menu">
    {% for menu_first in menu_list %}
        <div class="item">
            <div class="title">
                <i class="fa {{ menu_first.icon }}"></i> {{ menu_first.title }}
            </div>
            <div class="body {{ menu_first.class }}">
                {% for menu_second in menu_first.children %}
                    <a class="{{ menu_second.class }}" href="{{ menu_second.url }}">{{ menu_second.title }}</a>
                {% endfor %}
            </div>
        </div>
    {% endfor %}
</div>
--------------------------------------------------------------
// breadcrumb.html
<ol class="breadcrumb no-radius no-margin" style="border-bottom: 1px solid #ddd;">
    {% for breadcrumb in breadcrumb_list %}
        {% if forloop.last %}
            <li class="active">{{ breadcrumb.title }}</li>
        {% else %}
            <li><a href="{{ breadcrumb.url }}">{{ breadcrumb.title }}</a></li>
        {% endif %}
    {% endfor %}
</ol>

八, 权限控制到按钮级别

model的更改:

 # 权限表(二级菜单)
class Permission(models.Model):
    '''
    name: 权限控制到按钮级别,判断是否有这个权限
    '''
    url = models.CharField(max_length=108, verbose_name='权限')
    name = models.CharField(max_length=108, verbose_name='url别名', unique=True)
    title = models.CharField(max_length=108, verbose_name='二级菜单标题')
    menu = models.ForeignKey('Menu', on_delete=models.CASCADE, verbose_name='一级菜单', null=True, blank=True)
    parent = models.ForeignKey('self', on_delete=models.DO_NOTHING, verbose_name='父权限', null=True, blank=True)
 
    def __str__(self):
        return self.title

session记录的更改:

 # 查询当前用户的权限信息
    # permission = models.Permission.objects.filter(roles__users=user_obj).values('url').distinct()
    permission = user_obj.roles.all().filter(permissions__url__isnull=False).values('permissions__url',
                                                                                    'permissions__title',
                                                                                    'permissions__id',
                                                                                    'permissions__name',
                                                                                    'permissions__parent_id',
                                                                                    'permissions__parent__name',
                                                                                    'permissions__menu__title',
                                                                                    'permissions__menu__icon',
                                                                                    'permissions__menu__weight',
                                                                                    'permissions__menu_id',
                                                                                    ).distinct()
    # 权限的字典
    permission_dict = {}
    # 菜单的字典
    menu_dict = {}
    for i in permission:
        permission_dict[i.get('permissions__name')] = {
            'url': i.get('permissions__url'),
            'title': i.get('permissions__title'),
            'id': i.get('permissions__id'),
            'parent_id': i.get('permissions__parent_id'),
            'parent_name': i.get('permissions__parent__name'),
        }
        menu_id = i.get('permissions__menu_id')
        if menu_id:
            menu_dict.setdefault(menu_id, {
                'title': i['permissions__menu__title'],
                'icon': i['permissions__menu__icon'],
                'weight': i['permissions__menu__weight'],
                'children': []
            })
            menu_dict[menu_id]['children'].append(
                {
                    'title': i['permissions__title'],
                    'url': i['permissions__url'],
                    'id': i['permissions__id'],
                }
            )
    # 保存权限信息
    request.session[settings.PERMISSION_SESSION_KEY] = permission_dict
    request.session[settings.LOGIN_SESSION_KEY] = True
    # 保存菜单信息
    request.session[settings.MENU_SESSION_KEY] = menu_dict

中间件:

 # 获取权限信息
permissions = request.session.get(settings.PERMISSION_SESSION_KEY)
# 权限的校验
 
for i in permissions.values():
    # i权限  父权限  子权限
    if re.match(fr'^{i["url"]}$', url):
        menu_id = i.get('parent_id')
        if not menu_id:
            # 当前访问的权限是父权限(二级菜单)
            menu_id = i.get('id')
            request.breadcrumb_list.append({
                'title': i['title'],
                'url': i['url']
            })
        else:
            # 当前访问的权限是子权限
            parent_name = i.get('parent_name')
            parent_permission = permissions[parent_name]
            request.breadcrumb_list.append({
                'title': parent_permission['title'],
                'url': parent_permission['url'],
            })
            request.breadcrumb_list.append({
                'title': i['title'],
                'url': i['url'],
            })
        request.current_menu_id = menu_id
        return
        # 拒绝请求
return render(request, 'rbac/403.html')

自定义tags:

 @register.inclusion_tag('rbac/menu.html')
def menu(request):
    menu_list = request.session.get(settings.MENU_SESSION_KEY).values()
    od_menu_list = sorted(menu_list, key=lambda x: x['weight'], reverse=True)
    for menu in od_menu_list:
        menu['class'] = 'hidden'
        for i in menu.get('children'):
            if i.get('id') == request.current_menu_id:
                i['class'] = 'active'
                menu['class'] = ''
                break
    return {'menu_list': od_menu_list}
 
 
@register.inclusion_tag('rbac/breadcrumb.html')
def breadcrumb(request):
    return {
        'breadcrumb_list': request.breadcrumb_list
    }
 
 
@register.filter
def has_permission(request, name):
    permission = request.session.get(settings.PERMISSION_SESSION_KEY)
    if name in permission:
        return True

模板中使用:

 {% if request|has_permission:'customer_add' %}
    <a class="btn btn-default" href="{% url 'customer_add' %}">
        <i class="fa fa-plus-square" aria-hidden="true"></i> 添加客户
    </a>
{% endif %}

九, 权限管理

routes.py中

 from django.conf import settings
from django.utils.module_loading import import_string
from django.urls import RegexURLResolver, RegexURLPattern
from collections import OrderedDict
 
 
def recursion_urls(pre_namespace, pre_url, urlpatterns, url_ordered_dict):
 
    for item in urlpatterns:
        if isinstance(item, RegexURLResolver):
            if pre_namespace:
                if item.namespace:
                    namespace = "%s:%s" % (pre_namespace, item.namespace,)
                else:
                    namespace = pre_namespace
            else:
                if item.namespace:
                    namespace = item.namespace
                else:
                    namespace = None
 
            " None   /^  "
            recursion_urls(namespace, pre_url + item.regex.pattern, item.url_patterns, url_ordered_dict)
        else:
 
            if pre_namespace:
                name = "%s:%s" % (pre_namespace, item.name,)
            else:
                name = item.name
            if not item.name:
                raise Exception('URL路由中必须设置name属性')
            """
            /^^login/$    /login/ 
            """
            url = pre_url + item._regex
            url_ordered_dict[name] = {'name': name, 'url': url.replace('^', '').replace('$', '')}
 
 
def get_all_url_dict(ignore_namespace_list=None):
    """
    获取路由中
    :return:
    """
    ignore_list = ignore_namespace_list or []
    url_ordered_dict = OrderedDict()
 
    md = import_string(settings.ROOT_URLCONF)  # 根据路径的字符串 导入模块
    urlpatterns = []
    
    for item in md.urlpatterns:
        if isinstance(item, RegexURLResolver) and item.namespace in ignore_list:
            continue
        urlpatterns.append(item)
    recursion_urls(None, "/", urlpatterns, url_ordered_dict)
    return url_ordered_dict

views.py

 from django.shortcuts import render, redirect, reverse, HttpResponse
from django.views import View
from rbac import models
from django.db.models import Q
from rbac.forms import RoleForm
from rbac.forms import MenuForm
from rbac.forms import PermissionForm
from rbac.forms import MultiPermissionForm
from django.forms import modelformset_factory, formset_factory
from rbac.service.routes import get_all_url_dict
 
 
# 展示角色
class RoleList(View):
 
    def get(self, request):
        all_role = models.Role.objects.all()
        return render(request, 'rbac/role_list.html', {
            'all_role': all_role
        })
 
 
# 新增编辑角色
class RoleChange(View):
    def get(self, request, role_id=None, *args, **kwargs):
        role_obj = models.Role.objects.filter(pk=role_id).first()
        form_obj = RoleForm(instance=role_obj)
        return render(request, 'rbac/forms.html', {
            'form_obj': form_obj,
        })
 
    def post(self, request, role_id=None, *args, **kwargs):
        role_obj = models.Role.objects.filter(pk=role_id).first()
        form_obj = RoleForm(instance=role_obj, data=request.POST)
        if form_obj.is_valid():
            form_obj.save()
            return redirect('rbac:role_list')
        return render(request, 'rbac/forms.html', {
            'form_obj': form_obj,
        })
 
 
# 展示权限信息
class MenuList(View):
    def get(self, request):
        mid = request.GET.get('mid')
        if not mid:
            all_permission = models.Permission.objects.all()
        else:
            all_permission = models.Permission.objects.filter(Q(menu_id=mid) | Q(parent__menu_id=mid))
        # all_permission = all_permission.values('id', 'title', 'name', 'url', 'menu_id', 'menu__title', 'parent_id')
        permission_dict = {}
        for i in all_permission:
            menu_id = i.menu_id
            id = i.pk
            if menu_id:
                i.children = []
                permission_dict[id] = i
        for i in all_permission:
            parent_id = i.parent_id
            if parent_id:
                permission_dict[parent_id].children.append(i)
        all_menu = models.Menu.objects.all()
        return render(request, 'rbac/menu_list.html', {
            'all_menu': all_menu,
            'all_permission': permission_dict.values(),
            'mid': mid,
        })
 
 
# 新增编辑菜单
class MenuChange(View):
    def get(self, request, menu_id=None, *args, **kwargs):
        menu_obj = models.Menu.objects.filter(pk=menu_id).first()
        form_obj = MenuForm(instance=menu_obj)
        return render(request, 'rbac/menu_form.html', {
            'form_obj': form_obj,
        })
 
    def post(self, request, menu_id=None, *args, **kwargs):
        menu_obj = models.Menu.objects.filter(pk=menu_id).first()
        form_obj = MenuForm(instance=menu_obj, data=request.POST)
        if form_obj.is_valid():
            form_obj.save()
            return redirect('rbac:menu_list')
        return render(request, 'rbac/menu_form.html', {
            'form_obj': form_obj,
        })
 
 
# 新增编辑权限
class PermissionChange(View):
    def get(self, request, permission_id=None, *args, **kwargs):
        permission_obj = models.Permission.objects.filter(pk=permission_id).first()
        form_obj = PermissionForm(instance=permission_obj)
        return render(request, 'rbac/menu_form.html', {
            'form_obj': form_obj,
        })
 
    def post(self, request, permission_id=None, *args, **kwargs):
        permission_obj = models.Permission.objects.filter(pk=permission_id).first()
        form_obj = PermissionForm(instance=permission_obj, data=request.POST)
        if form_obj.is_valid():
            form_obj.save()
            return redirect('rbac:menu_list')
        return render(request, 'rbac/forms.html', {
            'form_obj': form_obj,
        })
 
 
# 删除
class Delete(View):
    def get(self, request, table, pk):
        model = getattr(models, table.capitalize())
        if not model:
            return HttpResponse('非法操作')
        obj = model.objects.filter(pk=pk).first()
        if not obj:
            return HttpResponse('非法操作')
        obj.delete()
        return redirect(request.META['HTTP_REFERER'])
 
 
def multi_permissions(request):
    """
    批量操作权限
    :param request:
    :return:
    """
    post_type = request.GET.get('type')
    # 编辑  删除
    FormSet = modelformset_factory(models.Permission, MultiPermissionForm, extra=0)
    # 新增
    AddFormSet = formset_factory(MultiPermissionForm, extra=0)
    # 数据库所有的权限
    permissions = models.Permission.objects.all()
    # 路由系统的所有的url 权限
    router_dict = get_all_url_dict(ignore_namespace_list=['admin'])
 
    # 数据库权限的name的集合
    permissions_name_set = set([i.name for i in permissions])
    # 路由系统中权限的name的集合
    router_name_set = set(router_dict.keys())
 
    add_name_set = router_name_set - permissions_name_set
    add_formset = AddFormSet(initial=[row for name, row in router_dict.items() if name in add_name_set])
 
    if request.method == 'POST' and post_type == 'add':
        add_formset = AddFormSet(request.POST)
        if add_formset.is_valid():
            permission_obj_list = [models.Permission(**i) for i in add_formset.cleaned_data]
            query_list = models.Permission.objects.bulk_create(permission_obj_list)
            add_formset = AddFormSet()
            for i in query_list:
                permissions_name_set.add(i.name)
 
    del_name_set = permissions_name_set - router_name_set
    del_formset = FormSet(queryset=models.Permission.objects.filter(name__in=del_name_set))
 
    update_name_set = permissions_name_set & router_name_set
    update_formset = FormSet(queryset=models.Permission.objects.filter(name__in=update_name_set))
 
    if request.method == 'POST' and post_type == 'update':
        update_formset = FormSet(request.POST)
        if update_formset.is_valid():
            update_formset.save()
            update_formset = FormSet(queryset=models.Permission.objects.filter(name__in=update_name_set))
 
    return render(
        request,
        'rbac/multi_permissions.html',
        {
            'del_formset': del_formset,
            'update_formset': update_formset,
            'add_formset': add_formset,
        }
    )
 
 
def distribute_permissions(request):
    """
    分配权限
    :param request:
    :return:
    """
    uid = request.GET.get('uid')
    rid = request.GET.get('rid')
 
    if request.method == 'POST' and request.POST.get('postType') == 'role':
        user = models.UserInfo.objects.filter(id=uid).first()
        if not user:
            return HttpResponse('用户不存在')
        user.roles.set(request.POST.getlist('roles'))
 
    if request.method == 'POST' and request.POST.get('postType') == 'permission' and rid:
        role = models.Role.objects.filter(id=rid).first()
        if not role:
            return HttpResponse('角色不存在')
        role.permissions.set(request.POST.getlist('permissions'))
 
    # 所有的用户
    user_list = models.UserInfo.objects.all()
    # 用户所拥有的角色 id
    user_has_roles = models.UserInfo.objects.filter(id=uid).values('id', 'roles')
 
    # 用户所拥有的角色id   {角色的id：None }
    user_has_roles_dict = {item['roles']: None for item in user_has_roles}
    # 所有的角色
    role_list = models.Role.objects.all()
 
    if rid:
        role_has_permissions = models.Role.objects.filter(id=rid, permissions__id__isnull=False).values('id',
                                                                                                        'permissions')
    elif uid and not rid:
        user = models.UserInfo.objects.filter(id=uid).first()
        if not user:
            return HttpResponse('用户不存在')
        role_has_permissions = user.roles.filter(permissions__id__isnull=False).values('id', 'permissions')
    else:
        role_has_permissions = []
 
    # 用户 或者 角色所拥有的权限
    role_has_permissions_dict = {item['permissions']: None for item in role_has_permissions}
 
    all_menu_list = []
 
    queryset = models.Menu.objects.values('id', 'title')  # [ { id  title } ]
    menu_dict = {}
 
    for item in queryset:
        # { id  title  children:[]  }
        item['children'] = []
        menu_dict[item['id']] = item
        all_menu_list.append(item)
 
    other = {'id': None, 'title': '其他', 'children': []}
    all_menu_list.append(other)
    menu_dict[None] = other
 
    root_permission = models.Permission.objects.filter(menu__isnull=False).values('id', 'title', 'menu_id')
    root_permission_dict = {}
    for per in root_permission:
        # { id  title menu_id   'children':[] }
        per['children'] = []
        nid = per['id']
        menu_id = per['menu_id']
        root_permission_dict[nid] = per
        menu_dict[menu_id]['children'].append(per)
 
    node_permission = models.Permission.objects.filter(menu__isnull=True).values('id', 'title', 'parent_id')
 
    for per in node_permission:
        # {  id  title parent_id  }
        pid = per['parent_id']
        if not pid:
            menu_dict[None]['children'].append(per)
            continue
        root_permission_dict[pid]['children'].append(per)
 
    return render(
        request,
        'rbac/distribute_permissions.html',
        {
            'user_list': user_list,  # 所有的用户
            'role_list': role_list,  # 所有的角色
            'user_has_roles_dict': user_has_roles_dict,  # 用户所拥有的角色
            'role_has_permissions_dict': role_has_permissions_dict,  # 角色拥有的权限
            'all_menu_list': all_menu_list,  # 菜单列表
            'uid': uid,
            'rid': rid
        }
    )

posted @ 2024-03-26 10:36 冀未然阅读(139) 评论(0) 编辑收藏举报

刷新页面返回顶部

（评论功能已被禁用）

相关博文：

· Django-xadmin+rule对象级权限的实现方式

· Django admin管理工具的使用、定制及源码解析

· Django权限菜单

· 4 权限分配

· PythonOther

阅读排行：
· 分享4款.NET开源、免费、实用的商城系统
· 全程不用写代码，我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了，比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15：你的「微服务管家」又秀新绝活了

公告

昵称：冀未然
园龄： 7年6个月
粉丝： 12
关注： 0

+加关注

2025年3月

日

一

二

三

四

五

六

合集 (12)

随笔分类 (223)

随笔档案 (181)

相册 (1)

第一本相册(1)

Django之权限管理

一, 引入

权限表

用户表

二, admin的展示

三, 记录登录状态与权限

四, 中间件校验权限

五, 动态生成一级菜单

首先规范化RBAC:

model的更改:

session记录的更改:

自定义inclusion_tag:

六, 动态生成二级菜单

model的更改:

session记录的更改:

自定义inclusion_tag:

七, 面包屑导航

model的更改:

session记录的更改:

中间件的更改:

自定义inclusion_tag:

八, 权限控制到按钮级别

model的更改:

session记录的更改:

中间件:

自定义tags:

模板中使用:

九, 权限管理

routes.py中

views.py

公告

搜索

常用链接

最新随笔

我的标签

合集 (12)

随笔分类 (223)

随笔档案 (181)

相册 (1)

	from django.db import models


	# 权限表
	class Permission(models.Model):
	url = models.CharField(max_length=108, verbose_name='权限')


	# 角色表
	class Role(models.Model):
	name = models.CharField(max_length=108, verbose_name='角色')
	permissions = models.ManyToManyField('Permission', verbose_name='角色所拥有的权限', related_name='roles')


	# 用户表
	class UserInfo(models.Model):
	username = models.CharField(max_length=32, verbose_name='用户名')
	password = models.CharField(max_length=32, verbose_name='密码')
	roles = models.ManyToManyField('Role', verbose_name='用户所拥有的角色', related_name='users')

	from django.contrib import admin
	from rbac import models

	# 配置类
	class PermissionAdmin(admin.ModelAdmin):
	# 展示
	list_display = ['title', 'url']
	# 可编辑
	list_editable = ['url']

	admin.site.register(models.Role)
	admin.site.register(models.Permission, admin_class=PermissionAdmin)
	admin.site.register(models.UserInfo)

	from django.utils.deprecation import MiddlewareMixin
	from django.shortcuts import HttpResponse, redirect, reverse
	from django.conf import settings
	import re

	def login(request):
	error = ''
	if request.method == 'POST':
	# 获取用户名和密码
	username = request.POST.get('username')
	password = request.POST.get('password')
	# 数据库校验用户名密码是否正确
	user_obj = models.UserInfo.objects.filter(username=username, password=password).first()
	if not user_obj:
	# 校验失败,返回登录页面
	error = '用户名或密码错误'
	else:
	# 登录成功
	# 查询当前用户的权限信息
	# permission = models.Permission.objects.filter(roles__users=user_obj).values('url').distinct()
	permission = user_obj.roles.all().filter(permissions__url__isnull=False).values('permissions__url').distinct()
	# 保存权限信息
	request.session['permission'] = list(permission)
	request.session['is_login'] = 1
	# 重定向去首页
	return redirect('index')

	return render(request, 'login.html', {'error': error})

	class Rbac(MiddlewareMixin):

	def process_request(self, request):
	# 获取当前访问的地址
	url = request.path_info
	# 白名单
	for i in settings.WHITE_LIST:
	if re.match(i, url):
	return
	# 登陆状态的校验
	is_login = request.session.get('is_login')
	if not is_login:
	return redirect('login]')
	# 免认证校验
	for i in settings.PASS_AUTH_LIST:
	if re.match(i, url):
	return
	# 获取权限信息
	permissions = request.session.get('permission')
	# 权限的校验
	for i in permissions:
	if re.match(r'^{}$'.format(i['permissions__url']), url):
	return
	# 拒绝请求
	return HttpResponse('没有访问权限,请联系管理员')

	# settings.py中
	# rbac 白名单
	WHITE_LIST = [
	r'^/admin/',
	r'^/login/$',
	r'^/register/$',
	]

	# rabc 免认证
	PASS_AUTH_LIST =[
	r'^/index/$'
	]

	在settings.py中配置
	PERMISSION_SESSION_KEY session中记录权限的key
	MENU_SESSION_KEY session中记录菜单信息的key
	LOGIN_SESSION_KEY session中记录登录状态的key

	// 插件 menu.html
	<div class="static-menu">
	{% for menu in menu_list %}
	<a href="{{ menu.url }}" class="{{ menu.class }}">
	<span class="icon-wrap"><i class="fa {{ menu.icon }}"></i></span> {{ menu.title }}</a>
	{% endfor %}
	</div>
	from django import template
	from django.conf import settings

	register = template.Library()

	@register.inclusion_tag('rbac/menu.html')
	def menu(request):
	menu_list = request.session.get(settings.MENU_SESSION_KEY)
	url = request.path_info
	for menu in menu_list:
	if menu.get('url') == url:
	menu['class'] = 'active'
	return {'menu_list': request.session.get(settings.MENU_SESSION_KEY)}

	# 一级菜单表
	class Menu(models.Model):
	title = models.CharField(max_length=108, verbose_name='一级菜单标题')
	icon = models.CharField(max_length=64, verbose_name='图标', null=True, blank=True)

	def __str__(self):
	return self.title


	# 权限表(二级菜单)
	class Permission(models.Model):
	'''
	menu_id: 有menu_id表示当前的权限是二级菜单
	没有menu_id表示当前的权限是普通权限
	'''
	url = models.CharField(max_length=108, verbose_name='权限')
	title = models.CharField(max_length=108, verbose_name='二级菜单标题')
	menu = models.ForeignKey('Menu', on_delete=models.CASCADE, verbose_name='一级菜单', null=True, blank=True)

	def __str__(self):
	return self.title

	// 插件中 menu.html
	<div class="multi-menu">
	{% for menu_first in menu_list %}
	<div class="item">
	<div class="title">
	<i class="fa {{ menu_first.icon }}"></i> {{ menu_first.title }}
	</div>
	<div class="body">
	{% for menu_second in menu_first.children %}
	<a class="{{ menu_second.class }}" href="{{ menu_second.url }}">{{ menu_second.title }}</a>
	{% endfor %}
	</div>
	</div>
	{% endfor %}
	</div>

	# inclusion_tag
	@register.inclusion_tag('rbac/menu.html')
	def menu(request):
	menu_list = request.session.get(settings.MENU_SESSION_KEY).values()
	url = request.path_info
	for menu in menu_list:
	for i in menu.get('children'):
	if i.get('url') == url:
	i['class'] = 'active'
	return {'menu_list': menu_list}

	# 此时session记录信息数据格式
	# 注意: 存入session中时经过json序列化,字典的key中的数字会转换为字符串
	# 权限信息字典
	{
	1: {
	'url': '/customer/list/',
	'title': '客户列表',
	'id': 1,
	'parent_id': None
	},
	2: {
	'url': '/customer/add/',
	'title': '添加客户',
	'id': 2,
	'parent_id': 1
	},
	3: {
	'url': '/customer/edit/(?P<cid>\\d+)/',
	'title': '编辑客户',
	'id': 3,
	'parent_id': 1
	},
	4: {
	'url': '/customer/del/(?P<cid>\\d+)/',
	'title': '删除客户',
	'id': 4,
	'parent_id': 1
	},
	5: {
	'url': '/payment/list/',
	'title': '缴费列表',
	'id': 5,
	'parent_id': None
	},
	6: {
	'url': '/payment/add/',
	'title': '添加缴费',
	'id': 6,
	'parent_id': 5
	},
	7: {
	'url': '/payment/edit/(?P<pid>\\d+)/',
	'title': '编辑缴费',
	'id': 7,
	'parent_id': 5
	},
	8: {
	'url': '/payment/del/(?P<pid>\\d+)/',
	'title': '删除缴费',
	'id': 8,
	'parent_id': 5
	}
	}

	# 菜单信息字典
	{
	1: {
	'title': '客户管理',
	'icon': 'fa-address-book',
	'weight': 10,
	'children': [{
	'title': '客户列表',
	'url': '/customer/list/',
	'id': 1
	}]
	},
	2: {
	'title': '财务管理',
	'icon': 'fa-money',
	'weight': 1,
	'children': [{
	'title': '缴费列表',
	'url': '/payment/list/',
	'id': 5
	}]
	}
	}

	# 权限表(二级菜单)
	class Permission(models.Model):
	'''
	name: 权限控制到按钮级别,判断是否有这个权限
	'''
	url = models.CharField(max_length=108, verbose_name='权限')
	name = models.CharField(max_length=108, verbose_name='url别名', unique=True)
	title = models.CharField(max_length=108, verbose_name='二级菜单标题')
	menu = models.ForeignKey('Menu', on_delete=models.CASCADE, verbose_name='一级菜单', null=True, blank=True)
	parent = models.ForeignKey('self', on_delete=models.DO_NOTHING, verbose_name='父权限', null=True, blank=True)

	def __str__(self):
	return self.title

	# 获取权限信息
	permissions = request.session.get(settings.PERMISSION_SESSION_KEY)
	# 权限的校验

	for i in permissions.values():
	# i权限父权限子权限
	if re.match(fr'^{i["url"]}$', url):
	menu_id = i.get('parent_id')
	if not menu_id:
	# 当前访问的权限是父权限(二级菜单)
	menu_id = i.get('id')
	request.breadcrumb_list.append({
	'title': i['title'],
	'url': i['url']
	})
	else:
	# 当前访问的权限是子权限
	parent_name = i.get('parent_name')
	parent_permission = permissions[parent_name]
	request.breadcrumb_list.append({
	'title': parent_permission['title'],
	'url': parent_permission['url'],
	})
	request.breadcrumb_list.append({
	'title': i['title'],
	'url': i['url'],
	})
	request.current_menu_id = menu_id
	return
	# 拒绝请求
	return render(request, 'rbac/403.html')

	{% if request\|has_permission:'customer_add' %}
	<a class="btn btn-default" href="{% url 'customer_add' %}">
	<i class="fa fa-plus-square" aria-hidden="true"></i> 添加客户
	</a>
	{% endif %}

	from django.conf import settings
	from django.utils.module_loading import import_string
	from django.urls import RegexURLResolver, RegexURLPattern
	from collections import OrderedDict


	def recursion_urls(pre_namespace, pre_url, urlpatterns, url_ordered_dict):

	for item in urlpatterns:
	if isinstance(item, RegexURLResolver):
	if pre_namespace:
	if item.namespace:
	namespace = "%s:%s" % (pre_namespace, item.namespace,)
	else:
	namespace = pre_namespace
	else:
	if item.namespace:
	namespace = item.namespace
	else:
	namespace = None

	" None /^ "
	recursion_urls(namespace, pre_url + item.regex.pattern, item.url_patterns, url_ordered_dict)
	else:

	if pre_namespace:
	name = "%s:%s" % (pre_namespace, item.name,)
	else:
	name = item.name
	if not item.name:
	raise Exception('URL路由中必须设置name属性')
	"""
	/^^login/$ /login/
	"""
	url = pre_url + item._regex
	url_ordered_dict[name] = {'name': name, 'url': url.replace('^', '').replace('$', '')}


	def get_all_url_dict(ignore_namespace_list=None):
	"""
	获取路由中
	:return:
	"""
	ignore_list = ignore_namespace_list or []
	url_ordered_dict = OrderedDict()

	md = import_string(settings.ROOT_URLCONF) # 根据路径的字符串导入模块
	urlpatterns = []

	for item in md.urlpatterns:
	if isinstance(item, RegexURLResolver) and item.namespace in ignore_list:
	continue
	urlpatterns.append(item)
	recursion_urls(None, "/", urlpatterns, url_ordered_dict)
	return url_ordered_dict

	from django.shortcuts import render, redirect, reverse, HttpResponse
	from django.views import View
	from rbac import models
	from django.db.models import Q
	from rbac.forms import RoleForm
	from rbac.forms import MenuForm
	from rbac.forms import PermissionForm
	from rbac.forms import MultiPermissionForm
	from django.forms import modelformset_factory, formset_factory
	from rbac.service.routes import get_all_url_dict


	# 展示角色
	class RoleList(View):

	def get(self, request):
	all_role = models.Role.objects.all()
	return render(request, 'rbac/role_list.html', {
	'all_role': all_role
	})


	# 新增编辑角色
	class RoleChange(View):
	def get(self, request, role_id=None, args, *kwargs):
	role_obj = models.Role.objects.filter(pk=role_id).first()
	form_obj = RoleForm(instance=role_obj)
	return render(request, 'rbac/forms.html', {
	'form_obj': form_obj,
	})

	def post(self, request, role_id=None, args, *kwargs):
	role_obj = models.Role.objects.filter(pk=role_id).first()
	form_obj = RoleForm(instance=role_obj, data=request.POST)
	if form_obj.is_valid():
	form_obj.save()
	return redirect('rbac:role_list')
	return render(request, 'rbac/forms.html', {
	'form_obj': form_obj,
	})


	# 展示权限信息
	class MenuList(View):
	def get(self, request):
	mid = request.GET.get('mid')
	if not mid:
	all_permission = models.Permission.objects.all()
	else:
	all_permission = models.Permission.objects.filter(Q(menu_id=mid) \| Q(parent__menu_id=mid))
	# all_permission = all_permission.values('id', 'title', 'name', 'url', 'menu_id', 'menu__title', 'parent_id')
	permission_dict = {}
	for i in all_permission:
	menu_id = i.menu_id
	id = i.pk
	if menu_id:
	i.children = []
	permission_dict[id] = i
	for i in all_permission:
	parent_id = i.parent_id
	if parent_id:
	permission_dict[parent_id].children.append(i)
	all_menu = models.Menu.objects.all()
	return render(request, 'rbac/menu_list.html', {
	'all_menu': all_menu,
	'all_permission': permission_dict.values(),
	'mid': mid,
	})


	# 新增编辑菜单
	class MenuChange(View):
	def get(self, request, menu_id=None, args, *kwargs):
	menu_obj = models.Menu.objects.filter(pk=menu_id).first()
	form_obj = MenuForm(instance=menu_obj)
	return render(request, 'rbac/menu_form.html', {
	'form_obj': form_obj,
	})

	def post(self, request, menu_id=None, args, *kwargs):
	menu_obj = models.Menu.objects.filter(pk=menu_id).first()
	form_obj = MenuForm(instance=menu_obj, data=request.POST)
	if form_obj.is_valid():
	form_obj.save()
	return redirect('rbac:menu_list')
	return render(request, 'rbac/menu_form.html', {
	'form_obj': form_obj,
	})


	# 新增编辑权限
	class PermissionChange(View):
	def get(self, request, permission_id=None, args, *kwargs):
	permission_obj = models.Permission.objects.filter(pk=permission_id).first()
	form_obj = PermissionForm(instance=permission_obj)
	return render(request, 'rbac/menu_form.html', {
	'form_obj': form_obj,
	})

	def post(self, request, permission_id=None, args, *kwargs):
	permission_obj = models.Permission.objects.filter(pk=permission_id).first()
	form_obj = PermissionForm(instance=permission_obj, data=request.POST)
	if form_obj.is_valid():
	form_obj.save()
	return redirect('rbac:menu_list')
	return render(request, 'rbac/forms.html', {
	'form_obj': form_obj,
	})


	# 删除
	class Delete(View):
	def get(self, request, table, pk):
	model = getattr(models, table.capitalize())
	if not model:
	return HttpResponse('非法操作')
	obj = model.objects.filter(pk=pk).first()
	if not obj:
	return HttpResponse('非法操作')
	obj.delete()
	return redirect(request.META['HTTP_REFERER'])


	def multi_permissions(request):
	"""
	批量操作权限
	:param request:
	:return:
	"""
	post_type = request.GET.get('type')
	# 编辑删除
	FormSet = modelformset_factory(models.Permission, MultiPermissionForm, extra=0)
	# 新增
	AddFormSet = formset_factory(MultiPermissionForm, extra=0)
	# 数据库所有的权限
	permissions = models.Permission.objects.all()
	# 路由系统的所有的url 权限
	router_dict = get_all_url_dict(ignore_namespace_list=['admin'])

	# 数据库权限的name的集合
	permissions_name_set = set([i.name for i in permissions])
	# 路由系统中权限的name的集合
	router_name_set = set(router_dict.keys())

	add_name_set = router_name_set - permissions_name_set
	add_formset = AddFormSet(initial=[row for name, row in router_dict.items() if name in add_name_set])

	if request.method == 'POST' and post_type == 'add':
	add_formset = AddFormSet(request.POST)
	if add_formset.is_valid():
	permission_obj_list = [models.Permission(**i) for i in add_formset.cleaned_data]
	query_list = models.Permission.objects.bulk_create(permission_obj_list)
	add_formset = AddFormSet()
	for i in query_list:
	permissions_name_set.add(i.name)

	del_name_set = permissions_name_set - router_name_set
	del_formset = FormSet(queryset=models.Permission.objects.filter(name__in=del_name_set))

	update_name_set = permissions_name_set & router_name_set
	update_formset = FormSet(queryset=models.Permission.objects.filter(name__in=update_name_set))

	if request.method == 'POST' and post_type == 'update':
	update_formset = FormSet(request.POST)
	if update_formset.is_valid():
	update_formset.save()
	update_formset = FormSet(queryset=models.Permission.objects.filter(name__in=update_name_set))

	return render(
	request,
	'rbac/multi_permissions.html',
	{
	'del_formset': del_formset,
	'update_formset': update_formset,
	'add_formset': add_formset,
	}
	)


	def distribute_permissions(request):
	"""
	分配权限
	:param request:
	:return:
	"""
	uid = request.GET.get('uid')
	rid = request.GET.get('rid')

	if request.method == 'POST' and request.POST.get('postType') == 'role':
	user = models.UserInfo.objects.filter(id=uid).first()
	if not user:
	return HttpResponse('用户不存在')
	user.roles.set(request.POST.getlist('roles'))

	if request.method == 'POST' and request.POST.get('postType') == 'permission' and rid:
	role = models.Role.objects.filter(id=rid).first()
	if not role:
	return HttpResponse('角色不存在')
	role.permissions.set(request.POST.getlist('permissions'))

	# 所有的用户
	user_list = models.UserInfo.objects.all()
	# 用户所拥有的角色 id
	user_has_roles = models.UserInfo.objects.filter(id=uid).values('id', 'roles')

	# 用户所拥有的角色id {角色的id：None }
	user_has_roles_dict = {item['roles']: None for item in user_has_roles}
	# 所有的角色
	role_list = models.Role.objects.all()

	if rid:
	role_has_permissions = models.Role.objects.filter(id=rid, permissions__id__isnull=False).values('id',
	'permissions')
	elif uid and not rid:
	user = models.UserInfo.objects.filter(id=uid).first()
	if not user:
	return HttpResponse('用户不存在')
	role_has_permissions = user.roles.filter(permissions__id__isnull=False).values('id', 'permissions')
	else:
	role_has_permissions = []

	# 用户或者角色所拥有的权限
	role_has_permissions_dict = {item['permissions']: None for item in role_has_permissions}

	all_menu_list = []

	queryset = models.Menu.objects.values('id', 'title') # [ { id title } ]
	menu_dict = {}

	for item in queryset:
	# { id title children:[] }
	item['children'] = []
	menu_dict[item['id']] = item
	all_menu_list.append(item)

	other = {'id': None, 'title': '其他', 'children': []}
	all_menu_list.append(other)
	menu_dict[None] = other

	root_permission = models.Permission.objects.filter(menu__isnull=False).values('id', 'title', 'menu_id')
	root_permission_dict = {}
	for per in root_permission:
	# { id title menu_id 'children':[] }
	per['children'] = []
	nid = per['id']
	menu_id = per['menu_id']
	root_permission_dict[nid] = per
	menu_dict[menu_id]['children'].append(per)

	node_permission = models.Permission.objects.filter(menu__isnull=True).values('id', 'title', 'parent_id')

	for per in node_permission:
	# { id title parent_id }
	pid = per['parent_id']
	if not pid:
	menu_dict[None]['children'].append(per)
	continue
	root_permission_dict[pid]['children'].append(per)

	return render(
	request,
	'rbac/distribute_permissions.html',
	{
	'user_list': user_list, # 所有的用户
	'role_list': role_list, # 所有的角色
	'user_has_roles_dict': user_has_roles_dict, # 用户所拥有的角色
	'role_has_permissions_dict': role_has_permissions_dict, # 角色拥有的权限
	'all_menu_list': all_menu_list, # 菜单列表
	'uid': uid,
	'rid': rid
	}
	)