django之rest_framework权限

全局使用,在设置中写(其他和认证一样)

REST_FRAMEWORK={
    'DEFAULT_AUTHENTICATION_CLASSES':['app01.MyAuth.LoginAuth',],
    'DEFAULT_PERMISSION_CLASSES':['app01.MyAuth.UserPermission',]
}

局部启用

permission_classes = [UserPermission,]

1,配置路由

先写两个查看属性的路由

    url(r'^authors/', views.Authors.as_view()),
    url(r'^users/', views.User.as_view()),

2,在视图层写下两个查看的类

class Authors(APIView):
    permission_classes = []

    def get(self, request, *args, **kwargs):
        response = {'status': 100, 'msg': '查询成功'}
        ret = models.Author.objects.all()
        ser = MySerializer.AuthorSerializer(ret, many=True)
        response['data'] = ser.data
        return JsonResponse(response, safe=False)


class User(APIView):
    def get(self, request, *args, **kwargs):
        response = {'status': 100, 'msg': '查询成功'}
        ret = models.UserInfo.objects.all()
        ser = MySerializer.UserSer(ret, many=True)
        response['data'] = ser.data
        return JsonResponse(response, safe=False)

3,在自定义的认证组件文件中

from app01 import models
from rest_framework import exceptions
from rest_framework.permissions import BasePermission


class UserPermission(BasePermission):
    # massage显示错误信息时更改成文字
    message = '您没有权限查看'
    def has_permission(self, request, view):
        user_type = request.user.user_type
        # 取出用户类型对应的文字 get_字段名_display()
        user_type_name = request.user.get_user_type_display()
        print(user_type_name)
        if user_type == 2:
            return True
        else:
            return False

二,查看源码

与认证差不多，最大差别是方法has_permission(self,request,view)