Django Rest framework之权限的实现示例

from django.db import models


class UserInfo(models.Model):
  USER_TYPE = (
    (1,\'普通用户\'),
    (2,\'VIP\'),
    (3,\'SVIP\')
  )

  user_type = models.IntegerField(choices=USER_TYPE, default=1)
  username = models.CharField(max_length=32)
  password = models.CharField(max_length=64)

class UserToken(models.Model):
  user = models.OneToOneField(UserInfo,on_delete=models.CASCADE)
  token = models.CharField(max_length=64)

# utils/permission.py


class SVIPPremission( ):
  message = \"必须是SVIP才能访问\" # 这里的message表示如果不通过权限的时候，错误提示信息

  def has_permission(self,request,view):
    if request.user.user_type != 3:
      return False
    return True


class MyPremission( ):
  # 这个权限类表示当用户为SVIP时不可通过
  def has_permission(self,request,view):
    if request.user.user_type == 3:
      return False
    return True

REST_ WORK = {
  \'DEFAULT_AUTHENTICATION_CLASSES\': [\'api.utils.authenticate.FirstAuthenticate\', \'api.utils.authenticate.MyAuthenticate\'], 
  \"UNAUTHENTICATED_USER\": None, # 匿名，request.user = None
  \"UNAUTHENTICATED_TOKEN\": None,# 匿名，request.auth = None
  \"DEFAULT_PERMISSION_CLASSES\": [\'api.utils.permission.MyPermission\'], # 表示每一个视图类（只要不重写permission_classes属性），都需要SVIP的用户才能访问。
}

from django.shortcuts import render, HttpResponse
from django.http import JsonResponse
from django.views import View
from rest_ work.views import APIView
from rest_ work.request import Request

from .utils import authenticate, permission
from api import models

import json


def md5(user):
  import hashlib
  import time

  # 当前时间，相当于生成一个随机的字符串
  ctime = str(time.time())

  # token加密
  m = hashlib.md5(bytes(user, encoding=\'utf-8\'))
  m.update(bytes(ctime, encoding=\'utf-8\'))
  return m.hexdigest()


class AuthView(APIView):
  \'\'\'用于用户登录验证\'\'\'
  authentication_classes = []   #里面为空，代表不需要认证
  permission_classes = []     #不里面为空，代表不需要权限

  def get(self, request, *args, **kwargs):
    ret = {\'code\': 1000, \'msg\': \'success\', \'name\': \'偷偷\'}
    ret = json.dumps(ret, ensure_ascii=False)

    return HttpResponse(ret)

  def post(self,request,*args,**kwargs):
    ret = {\'code\':1000,\'msg\':None}
    try:
      user = request.POST.get(\'username\')
      pwd = request.POST.get(\'password\')
      print(user, pwd)
      obj = models.UserInfo. s.filter(username=user,password=pwd).first()
      print(obj.username, obj.password)
      if not obj:
        ret[\'code\'] = 1001
        ret[\'msg\'] = \'用户名或密码错误\'
      #为用户创建token
      token = md5(user)
      #存在就更新，不存在就创建
      models.UserToken. s.update_or_create(user=obj,defaults={\'token\':token})
      ret[\'token\'] = token
    except Exception as e:
      ret[\'code\'] = 1002
      ret[\'msg\'] = \'请求异常\'
    return JsonResponse(ret)


ORDER_DICT = {
  1:{
    \'name\':\'apple\',
    \'price\':15
  },
  2:{
    \'name\':\'狗子\',
    \'price\':100
  }
}


class OrderView(APIView):
  # 用户想要获取订单，就要先通过身份认证、在全局settings.py 中已经配置
  permission_classes = []

  def get(self, request, *args, **kwargs):
    ret = {
      \'code\': 1024,
      \'msg\': \'订单获取成功\',
    }
    try:
      ret[\'data\'] = ORDER_DICT
    except Exception as e:
      pass
    return JsonResponse(ret)
  

class UserInfoView(APIView):
  permission_classes = [permission.SVIPPermission]

  def get(self, request, *args, **kwargs):
    print(request.user)
    return HttpResponse(\'SVIP用户信息\')

from django.conf.urls import url

from api.views import AuthView, OrderView, UserInfoView


urlpatterns = [
  url(r\'^api/v1/auth/$\', AuthView.as_view()),
  url(r\'^api/v1/order/$\', OrderView.as_view()),
  url(r\'^api/v1/info/$\', UserInfoView.as_view()),
]

class UserInfoView(APIView):
  permission_classes = [permission.SVIPPermission]

  def get(self, request, *args, **kwargs):
    print(request.user)
    return HttpResponse(\'SVIP用户信息\')