python (django) 3. 权限 permission

权限控制与API认证实践

最新推荐文章于 2024-06-04 10:54:03 发布

原创最新推荐文章于 2024-06-04 10:54:03 发布 · 994 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#杂碎

开发专栏收录该内容

134 篇文章

订阅专栏

本文探讨了在RESTful API中实现用户权限控制的具体方法，包括定义GradeOnePermission类来检查用户等级，以及使用StudentAuthenticate进行用户认证。通过示例展示了如何在TokenView中应用这些权限和认证机制。

1. api/permission.py

# -*- coding: utf8 -*-


class GradeOnePermission(object):

    def has_permission(self, request, view):
        grade = request.user.grade
        print(request.user)
        print(grade)
        if grade == 1:
            return True
        else:
            return False

2. api/views.py

from api.authenticate import StudentAuthenticate
from api.permission import GradeOnePermission


class TokenView(GenericViewSet):

    # authentication_classes = []
    permission_classes = [GradeOnePermission]
    parser_classes = [JSONParser, ]

    def get(self, request, *args, **kwargs):
        name = request.query_params.get('name')
        try:
            stu = Student.objects.get(name=name)
        except Student.DoesNotExist:
            raise ParseError(_('Student does not include this name'))

        token = stu.token.token
        res = dict()
        res['code'] = 200
        res['name'] = name
        res['token'] = token
        logger.info(pformat(res))

        return Response(data=res, status=status.HTTP_200_OK)

3. settings.py

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES':  ['api.authenticate.StudentAuthenticate'],
    'DEFAULT_PERMISSOIN_CLASSES': ['api.permission.GradeOnePermisson'],
}

4. postman

(1)

url: http://127.0.0.1:8011/api/v1/auth/

method: post

data: {
   "name": "student2",
   "password": "password1",
   "grade": 2
}

return:

{
"code": 200,
"name": "student2",
"token": "950f0ed2b4f164900f996bf1c6bf225c",
"msg": "创建成功"
}

(2)

url: http://127.0.0.1:8011/api/v1/token/?name=student2&token=950f0ed2b4f164900f996bf1c6bf225c

method: get

return:

{
"detail": "You do not have permission to perform this action."
}