权限控制

权限控制

• 简述

在API开发中，我们经常要对用户进行权限上的判断， rest_framework也给我提供了相应的支持，接下来看下他的原码

class BasePermission(object):
    """
    A base class from which all permission classes should inherit.
    """
	#判断是否对视图有权限
    def has_permission(self, request, view):
        """
        Return `True` if permission is granted, `False` otherwise.
        """
        return True
	判断是否对某个模型有权限
    def has_object_permission(self, request, view, obj):
        """
        Return `True` if permission is granted, `False` otherwise.
        """
        return True

代码实现

如果我们想编写一个权限的控制

• 首先，我们要在app目录下新建一个 文件比如是permission.py

from rest_framework.permissions import BasePermission
#写一个继承自BasePermission
class SuperPerssion(BasePermission):
	#复写里面的has_permission函数
    def has_permission(self, request, view):
    	#判断当前用户是不是超级管理员
        return request.user.is_superuser

class StaffPerssion(BasePermission):

    def has_permission(self, request, view):
        return request.user.is_staff

• 对应的Serializer

from django.contrib.auth.models import User
from rest_framework import serializers
from .models import Book

class UsersSerializer(serializers.ModelSerializer):

    class Meta:
        model = User
        fields = ("id", "username", "email")

• 在我们的API中进行使用

class UsersAPI(ListAPIView):
    queryset = User.objects.all()
    #指定使用的序列化器
    serializer_class = UsersSerializer
    authentication_classes = (LoginAuth, )
    #权限控制
    permission_classes = (SuperPerssion, StaffPerssion)
    def list(self, request, *args, **kwargs):
        user = request.user
        if not isinstance(user, User):
            return Response({
                "code": LOGIN_FAIL_1_CODE,
                "msg": "用户名或密码错误"
            })
        queryset = self.filter_queryset(self.get_queryset())

        page = self.paginate_queryset(queryset)
        if page is not None:
            serializer = self.get_serializer(page, many=True)
            return self.get_paginated_response(serializer.data)

        serializer = self.get_serializer(queryset, many=True)
        return Response(serializer.data)