七 解析器

解析器的作用:

-用来解析前台传过来的数据编码方式
   urlencoded:form表单:name=lqz&age=18
   formdata :上传文件:--dadfgdgag--   
   json:json格式   {"name":"lqz"}
-解析器取的顺序
   1 视图类中
   2 django总settings里取
   3 drf默认的配置文件取
—全局配置
   在setting中: 
      REST_FRAMEWORK = {
         'DEFAULT_PARSER_CLASSES':[
            'rest_framework.parsers.JSONParser',
            # 'rest_framework.parsers.FormParser',
         ]

      }
-局部使用:
   在视图类中:
   from rest_framework.parsers import JSONParser,MultiPartParser,FormParser
   parser_classes = [JSONParser,FormParser]

例子

解析器
局部配置
from rest_framework.parsers import JSONParser
class Book(APIView):
    parser_classes = [JSONParser, ]
    def get(self,request,*args,**kwargs):
        return HttpResponse('ok')
    def post(self,request):
        print(request.data)
        return HttpResponse('post')

from rest_framework.parsers import JSONParser,MultiPartParser,FormParser
class Book(APIView):
    parser_classes = [JSONParser,FormParser]
    def get(self,request,*args,**kwargs):
        return HttpResponse('ok')
    def post(self,request):
        print(request.data)
        return HttpResponse('post')

 八、认证组件

1、校验是否登陆

    -作用:校验是否登陆
        -首先定义一个类,继承BaseAuthentication,写一个方法:authenticate,在方法内部,实
        证过程,认证通过,返回None或者两个对象(user,auth),这两个对象,在视图类的request中可以取出来
        from rest_framework.authentication import BaseAuthentication
        class myAuthen(BaseAuthentication):
            def authenticate(self, request):
                token = request.query_params.get('token')
                ret = models.UserToken.objects.filter(token=token).first()
                if ret:
                    # return ret.user, ret
                    # 要写多个认证类,这个地返回None
                    # 最后一个认证类,返回这俩值
                    return ret.user, ret
                else:
                    raise AuthenticationFailed('您没有登陆')
                    
        -局部使用:在视图类中(可以写多个)
            authentication_classes = [myAuthen, ]
        -全局使用:
             "DEFAULT_AUTHENTICATION_CLASSES":["app01.service.auth.Authentication",]
        

2、正常非drf认证代码,update_or_create意思是有则更新,无则创建

class User(models.Model):
nid = models.AutoField(primary_key=True)
name = models.CharField(max_length=32)
pwd=models.CharField(max_length=32,null=True)
mychoice=((1,'普通用户'),(2,'超级用户'),(3,'宇宙用户'))
usertyle=models.IntegerField(choices=mychoice,default=1)

class UserToken(models.Model):
user=models.OneToOneField(to=User,to_field='nid')
token=models.CharField(max_length=64)


def get_token(username): import hashlib import time md
= hashlib.md5() # update内必须传bytes格式 md.update(username.encode('utf-8')) md.update(str(time.time()).encode('utf-8')) return md.hexdigest() class Login(APIView): def post(self, request): response = MyResponse() name = request.data.get('name') pwd = request.data.get('pwd') user = models.User.objects.filter(name=name, pwd=pwd).first() if user: response.msg = '登陆成功' # 登陆成功,返回一个随机字符串,以后在发请求,都携带这个字符串 token = get_token(name) response.token = token # 把随机字符串保存到数据库,有就更新,没有就创建 # ret=models.UserToken.objects.update_or_create(user_id=user.id,kwargs={'token':token}) ret = models.UserToken.objects.update_or_create(user=user, defaults={'token': token}) else: response.msg = '用户名或密码错误' response.status = 101 return JsonResponse(response.get_dic)

3、drf的认证组件用法,return user或者auth

class myAuthen():
    def authenticate(self,request):
        token = request.query_params.get('token')
        ret = models.UserToken.objects.filter(token=token).first()
        if ret:
            return ret.user,ret
        else:
            raise AuthenticationFailed('您咩有登陆')

    def authenticate_header(self,value):
        pass


from rest_framework.request import Request
from app01 import myserial

class Book(APIView):
authentication_classes = [myAuthen, ]
def get(self, request):
response = MyResponse()
print(request.user.name)
print(request.auth.token)
# 必须登陆才能访问
books = models.Book.objects.all()
ret = myserial.BookSer(instance=books, many=True)
response.msg = '查询成功'
response.data = ret.data
return JsonResponse(response.get_dic, safe=False)

4、先建个auth.py,存入认证组价的功能

from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed
from app01 import models


class myAuthen(BaseAuthentication):
    def authenticate(self, request):
        token = request.query_params.get('token')
        ret = models.UserToken.objects.filter(token=token).first()
        if ret:
            # return ret.user, ret
            # 要写多个认证类,这个地返回None
            # 最后一个认证类,返回这俩值
            return ret.user, ret
        else:
            raise AuthenticationFailed('您没有登陆')

5、若在setting里配置了全局验证,则全局验证,但是视图函数里的login()不需要,则我们参考了顺序是先找局部,在找setting里。所以需要在视图函数里配置

authentication_classes = [],即不需要验证
class Login(APIView):
    authentication_classes = []
    def post(self, request):
        response = MyResponse()
        name = request.data.get('name')
        pwd = request.data.get('pwd')
        user = models.User.objects.filter(name=name, pwd=pwd).first()
        if user:
            response.msg = '登陆成功'
            # 登陆成功,返回一个随机字符串,以后在发请求,都携带这个字符串
            token = get_token(name)
            response.token = token
            #     把随机字符串保存到数据库,有就更新,没有就创建
            #     ret=models.UserToken.objects.update_or_create(user_id=user.id,kwargs={'token':token})
            ret = models.UserToken.objects.update_or_create(user=user, defaults={'token': token})

        else:
            response.msg = '用户名或密码错误'
            response.status = 101
        return JsonResponse(response.get_dic)

6、settings

REST_FRAMEWORK = {
    'DEFAULT_PARSER_CLASSES':[
        'rest_framework.parsers.JSONParser',
        # 'rest_framework.parsers.FormParser',
    ],
    "DEFAULT_AUTHENTICATION_CLASSES": ["app01.auth.myAuthen", ],
"DEFAULT_PERMISSION_CLASSES":["app01.auth.myPermission",]

}

7、存的token数据一般存在服务器端数据库里,但是存在压力,第一存在redis里,第二种方式就是不存数据库的token验证,及如下所示

def get_token(id,salt='123'):
    import hashlib
    md=hashlib.md5()
    md.update(bytes(str(id),encoding='utf-8'))
    md.update(bytes(salt,encoding='utf-8'))

    return md.hexdigest()+'|'+str(id)

def check_token(token,salt='123'):
    ll=token.split('|')
    import hashlib
    md=hashlib.md5()
    md.update(bytes(ll[-1],encoding='utf-8'))
    md.update(bytes(salt,encoding='utf-8'))
    if ll[0]==md.hexdigest():
        return True
    else:
        return False

class TokenAuth():
    def authenticate(self, request):
        token = request.GET.get('token')
        success=check_token(token)
        if success:
            return
        else:
            raise AuthenticationFailed('认证失败')
    def authenticate_header(self,request):
        pass
class Login(APIView):
    def post(self,reuquest):
        back_msg={'status':1001,'msg':None}
        try:
            name=reuquest.data.get('name')
            pwd=reuquest.data.get('pwd')
            user=models.User.objects.filter(username=name,password=pwd).first()
            if user:
                token=get_token(user.pk)
                # models.UserToken.objects.update_or_create(user=user,defaults={'token':token})
                back_msg['status']='1000'
                back_msg['msg']='登录成功'
                back_msg['token']=token
            else:
                back_msg['msg'] = '用户名或密码错误'
        except Exception as e:
            back_msg['msg']=str(e)
        return Response(back_msg)
from rest_framework.authentication import BaseAuthentication
class TokenAuth():
    def authenticate(self, request):
        token = request.GET.get('token')
        token_obj = models.UserToken.objects.filter(token=token).first()
        if token_obj:
            return
        else:
            raise AuthenticationFailed('认证失败')
    def authenticate_header(self,request):
        pass

class Course(APIView):
    authentication_classes = [TokenAuth, ]

    def get(self, request):
        return HttpResponse('get')

    def post(self, request):
        return HttpResponse('post')

九 权限组件

1、校验用户是否有权限访问

-作用:校验用户是否有权限访问
    -因为是在认证通过才执行,所以可以取出user
    class myPermission():
        message = '不是超超级用户,查看不了'
        def has_permission(self, request, view):
            if request.user.usertyle != 3:
                return False
            else:
                return True
    -局部使用
        在视图类中:permission_classes=[myPermission,]
    -全局使用
        在setting中:
        "DEFAULT_PERMISSION_CLASSES":["app01.auth.myPermission",]

2、choices=的写法,一般用性别等不常用的常识

class User(models.Model):
    nid = models.AutoField(primary_key=True)
    name = models.CharField(max_length=32)
    pwd=models.CharField(max_length=32,null=True)
    mychoice=((1,'普通用户'),(2,'超级用户'),(3,'宇宙用户'))
    usertyle=models.IntegerField(choices=mychoice,default=1)

class UserToken(models.Model):
    user=models.OneToOneField(to=User,to_field='nid')
    token=models.CharField(max_length=64)

3、eg

from rest_framework.permissions import BasePermission
class myPermission(BasePermission):
    message = '不是超超级用户,查看不了'
    def has_permission(self, request, view):
        if request.user.usertyle != 3:
            return False
        else:
            return True


REST_FRAMEWORK = {
'DEFAULT_PARSER_CLASSES':[
'rest_framework.parsers.JSONParser',
# 'rest_framework.parsers.FormParser',
],
"DEFAULT_AUTHENTICATION_CLASSES": ["app01.auth.myAuthen", ],
"DEFAULT_PERMISSION_CLASSES":["app01.auth.myPermission",]

}
from app01.auth import myAuthen
from app01.auth import myPermission

class Book(APIView):
    # authentication_classes = [myAuthen, ]
    # permission_classes=[myPermission,]

    def get(self, request):
        response = MyResponse()
        print(request.user.name)
        print(request.auth.token)
        # 必须登陆才能访问
        books = models.Book.objects.all()
        ret = myserial.BookSer(instance=books, many=True)
        response.msg = '查询成功'
        response.data = ret.data
        return JsonResponse(response.get_dic, safe=False)

十、频率组件

1、参考原码写的符合频率组件logic的代码

class MyThro():
    VISIT_RECORD = {}
    # VISIT_RECORD = {ip:[时间1,时间2],ip2:[],ip3:[当前时间]}

    def __init__(self):
        self.history = None

    def allow_request(self, request, view):
        # (1)取出访问者ip
        # print(request.META)
        ip = request.META.get('REMOTE_ADDR')
        import time
        ctime = time.time()
        # (2)判断当前ip不在访问字典里,添加进去,并且直接返回True,表示第一次访问
        if ip not in self.VISIT_RECORD:
            self.VISIT_RECORD[ip] = [ctime, ]
            return True
        self.history = self.VISIT_RECORD.get(ip)
        # (3)循环判断当前ip的列表,有值,并且当前时间减去列表的最后一个时间大于60s,把这种数据pop掉,这样列表中只有60s以内的访问时间,
        while self.history and ctime - self.history[-1] > 60:
            self.history.pop()
        # (4)判断,当列表小于3,说明一分钟以内访问不足三次,把当前时间插入到列表第一个位置,返回True,顺利通过
        # (5)当大于等于3,说明一分钟内访问超过三次,返回False验证失败
        if len(self.history) < 3:
            self.history.insert(0, ctime)
            return True
        else:
            return False

    def wait(self):
        import time
        ctime = time.time()
        return 60 - (ctime - self.history[-1])

视图函数使用代码

from app01.auth import MyThro
class Book(APIView):
    authentication_classes = [myAuthen, ]
    permission_classes=[]
    throttle_classes=[MyThro,]

    def get(self, request):
        # request.user
        response = MyResponse()
        # request.GET
        print(request.user.name)
        print(request.auth.token)
        # 必须登陆才能访问
        books = models.Book.objects.all()
        ret = myserial.BookSer(instance=books, many=True)
        response.msg = '查询成功'
        response.data = ret.data
        return JsonResponse(response.get_dic, safe=False)

2、使用

    频率:
        -定义一个类:
        from rest_framework.throttling import SimpleRateThrottle
        class MyThro(SimpleRateThrottle):
            scope = 'aaa'
            def get_cache_key(self, request, view):
                # return self.get_ident(request)
                return request.META.get('REMOTE_ADDR')
            
        -setting中配置
        "DEFAULT_THROTTLE_RATES":{
            'aaa':'3/msssssss'
        }
        
        -全局使用:
            'DEFAULT_THROTTLE_CLASSES':['app01.auth.MyThro',],
        -局部使用:
            throttle_classes=[MyThro,]

eg.

from rest_framework.throttling import SimpleRateThrottle
class MyThro(SimpleRateThrottle):
    scope = 'aaa'
    def get_cache_key(self, request, view):
        # return self.get_ident(request)
        return request.META.get('REMOTE_ADDR')
        # return

3、假如全局限制每分钟查看3次,视图函数每分钟10次,则需要在

"DEFAULT_THROTTLE_RATES":{
'aaa':'3/msssssss'
},

from rest_framework.throttling import SimpleRateThrottle
class MyThro(SimpleRateThrottle):
scope = 'aaa'
def get_cache_key(self, request, view):
# return self.get_ident(request)
return request.META.get('REMOTE_ADDR')
# return

将aaa 赋值为10/mmmmms