1 drf认证功能介绍
- 认证，频率，权限
- 用户是否登录到系统中
- 后期基本上会用JWT的认证
- 自定制的认证
2 认证功能源码分析
2.1：drf 认证流程
1 APIView--->dispatch--->self.initial(request, *args, **kwargs)-->self.perform_authentication(request)--->Request.user--->self._authenticate(self):Request类的方法--->self.authenticators:Request类的属性--->在Request对象实例化的时候传入的---->Request在什么时候实例化的？dispatch的时候--->APIView：self.get_authenticators()-->return [auth() for auth in self.authentication_classes]---->如果在自己定义的视图类中写了authentication_classes=[类1，类2]---->Request的self.authenticators就变成了我们配置的一个个类的对象
2.2:drf认证核心代码
#self._authenticate(self):Request类的方法
def _authenticate(self):
for authenticator in self.authenticators: # BookView中配置的一个个类的对象
try:
user_auth_tuple = authenticator.authenticate(self)
except exceptions.APIException:
self._not_authenticated()
raise
if user_auth_tuple is not None:
self._authenticator = authenticator
self.user, self.auth = user_auth_tuple
return
2.3:局部配置认证类
只要在视图类中配置authentication_classes = [MyAuthen.LoginAuth, ]，就会执行上面的方法，执行认证
3 自定义认证类（重点）
3.1：如何自定义认证类
-定义一个类，继承BaseAuthentication
class LoginAuth(BaseAuthentication):
def authenticate(self, request):
token = request.GET.get('token')
res = models.UserToken.objects.filter(token=token).first()
if res:
return 元组
else:
raise AuthenticationFailed('您没有登录')
3.2:全局，局部使用认证,局部禁用
3.2.1局部使用
在视图类中配置（只要配置了，就是登录以后才能访问，没配置，不用登录就能访问）
class Test(APIView):
authentication_classes = [MyAuthen.LoginAuth, ]
pass
3.2.2:全局使用
全局使用（所有接口，都需要登录才能访问）
settings.py
REST_FRAMEWORK = {
"DEFAULT_AUTHENTICATION_CLASSES": ["app01.MyAuthen.LoginAuth", ]
}
3.2.3:局部禁用
在想禁用的视图类上,如下操作
class Test(APIView):
authentication_classes = []
pass
3.3:注意
- 认证类，认证通过可以返回一个元组，有两个值，第一个值会给，request.user,第二个值会个request.auth
- 认证类可以配置多个，按照从前向后的顺序执行，如果前面有返回值，认证就不再继续往下走了
4：示例
models.py
from django.db import models
# Create your models here.
class UserInfo(models.Model):
name = models.CharField(max_length=255,help_text='用户名')
password = models.CharField(max_length=255,help_text='密码')
mobile = models.CharField(max_length=255,help_text='手机')
email = models.CharField(max_length=255,help_text='邮箱')
token = models.CharField(max_length=255,null=True)
user_type = models.IntegerField(choices=((1,'vip'),(3,'generic')),default=1)
class Book(models.Model):
title = models.CharField(max_length=255,help_text='书名')
price = models.DecimalField(max_digits=5, decimal_places=2,help_text='价格')
publish = models.ForeignKey(to="Publish", on_delete=models.SET_NULL, null=True, db_constraint=False,help_text='出版社')
@property
def publish_name(self):
return {'id':self.publish_id,'name':self.publish.name,'addr':self.publish.addr}
class Publish(models.Model):
name = models.CharField(max_length=255,help_text='出版社名称')
addr = models.CharField(max_length=255,help_text='出版社地址')
views.py
from django.shortcuts import render
# Create your views here.
from rest_framework.generics import GenericAPIView
from rest_framework.response import Response
from rest_framework.views import APIView
from rest_framework.mixins import CreateModelMixin,
ListModelMixin, UpdateModelMixin,DestroyModelMixin,RetrieveModelMixin
from . import models
from . import serializer
from .util import LearnBaseAuthentication
from .util import LearnBasePermission
from rest_framework.viewsets import GenericViewSet
class Login(APIView):
def post(self, request, *args, **kwargs):
username = request.data.get('username')
password = request.data.get('password')
user_obj = models.UserInfo.objects.filter(name=username, password=password)
if user_obj:
import uuid
token = uuid.uuid4()
models.UserInfo.objects.update_or_create(name=username, defaults={'token': token})
return Response({'code': 200, "token": token, "msg": '登录成功'})
return Response({'code': 100, "msg": '用户名或则密码错误'})
class Book(GenericViewSet, ListModelMixin, CreateModelMixin, UpdateModelMixin,DestroyModelMixin,RetrieveModelMixin):
authentication_classes = [LearnBaseAuthentication, ]
permission_classes = [LearnBasePermission, ]
queryset = models.Book.objects.all()
serializer_class = serializer.BookModelSerializer
def get(self, request, *args, **kwargs):
return self.list(request, *args, **kwargs)
def get_one(self,request,*args,**kwargs):
return self.retrieve(request,*args,**kwargs)
def post(self, request, *args, **kwargs):
return self.create(request, *args, **kwargs)
def put(self, request, *args, **kwargs):
return self.update(request, *args, **kwargs)
def delete(self, request, *args, **kwargs):
return self.destroy(request, *args, **kwargs)
util.py
from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed
from . import models
class LearnBaseAuthentication(BaseAuthentication):
def authenticate(self, request):
token = request.data.get('token')
print(token, 11)
user = models.UserInfo.objects.filter(token=token)
if user:
return user.last().name, token
else:
raise AuthenticationFailed('用户名或者密码错误')
# class LearnBaseAuthentication(BaseAuthentication):
# def authenticate(self, request):
# token = request.data.get('token')
# try:
# user = models.UserInfo.objects.get(token=token)
# if user:
# return user.username, token
# except Exception:
# raise AuthenticationFailed('用户名或者密码错误!')
class LearnBasePermission(BasePermission):
message = '您没有权限'
def has_permission(self, request, view):
user_type = models.UserInfo.objects.get(name=request.user).user_type
if user_type == 1:
return True
else:
return False
serializer
from rest_framework import serializers
from . import models
class BookModelSerializer(serializers.ModelSerializer):
class Meta:
model = models.Book
fields = ['id', 'title', 'price', 'publish_name', 'publish']
extra_kwargs = {
'id': {'required': False},
'publish_name': {'read_only': True},
'publish': {'write_only': True},
}
class PublishModelSerializer(serializers.ModelSerializer):
class Meta:
model = models.Publish
fields = '__all__'
extra_kwargs = {
'id': {'required': False}
}
urls.py
from django.urls import path
from learn import views
urlpatterns = [
path('books/', views.Book.as_view()),
path('login/', views.Login.as_view()),
]
5 自定义权限功能（重点）
5.1:为什么要有权限限制
登录成功以后，超级用户可以干某些事，普通用户不能干---》超级用户可以查看某些接口，普通用户不能查看
5.2：自定义权限
使用写一个类继承BasePermission，重写has_permission
class SuperPermission(BasePermission):
message='权限不够'
def has_permission(self, request, view):
# Return `True` if permission is granted, `False` otherwise.
# 超级用户可以访问，除了超级用户以外，都不能访问
if request.user.user_type == '1':
return True
else:
return False
5.3:权限(局部使用，局部禁用，全局使用)
5.3.1:局部使用
class Test():
permission_classes = [MyAuthen.SuperPermission]
def get(self,request,*args,**kwargs):
pass
5.3.2:局部禁用
class Test():
permission_classes = []
def get(self,request,*args,**kwargs):
pass
5.3.3:全局使用
settings.py
REST_FRAMEWORK = {
"DEFAULT_PERMISSION_CLASSES": ["....SuperPermission", ]
}
6 权限源码分析
核心代码
def check_permissions(self, request):
"""
Check if the request should be permitted.
Raises an appropriate exception if the request is not permitted.
"""
for permission in self.get_permissions():
if not permission.has_permission(request, self):
self.permission_denied(
request, message=getattr(permission, 'message', None)
)
默认配置文件
7:内置的权限和认证类
# 内置认证类
from rest_framework.exceptions import AuthenticationFailed
# 内置权限类
from rest_framework.permissions import BasePermission
8:示例2
需求
写一个图书的5个接口出版社的5个接口和登录接口
1：用户必须登录才能访问图书的5个接口
2：必须超级用户登录后才能访问出版社5个接口
models.py
from django.db import models
# Create your models here.
class Book(models.Model):
title = models.CharField(max_length=255)
price = models.DecimalField(max_digits=5, decimal_places=2)
publish = models.ForeignKey(to='Publish', on_delete=models.SET_NULL, null=True, db_constraint=False)
class Publish(models.Model):
name = models.CharField(max_length=255)
addr = models.CharField(max_length=255)
class UserInfo(models.Model):
username = models.CharField(max_length=255)
password = models.CharField(max_length=255)
mobile = models.CharField(max_length=25)
email = models.EmailField()
token = models.CharField(max_length=255,null=True)
user_type = models.IntegerField(choices=((1, 'vip'), (2, 'svip'), (3, 'generic')))
urls.py
from django.urls import path
from work import views
urlpatterns = [
path('login/', views.Login.as_view()),
path('books/', views.Book.as_view({'get': "list", 'post': 'create'})),
path('book/<int:pk>/', views.Book.as_view({'get': "retrieve", 'delete': 'destroy', 'put': 'update'})),
path('publishes/', views.Publish.as_view({'get': "list", 'post': 'create'})),
path('publish/<int:pk>/', views.Publish.as_view({'get': "retrieve", 'delete': 'destroy', 'put': 'update'}))
]
serializer.py
from rest_framework import serializers
from . import models
class BookModelSerializer(serializers.ModelSerializer):
class Meta:
model = models.Book
fields = ['id', 'title', 'price', 'publish']
class PublishModelSerializer(serializers.ModelSerializer):
class Meta:
model = models.Publish
fields = ['id', 'name', 'addr']
util.py
from . import models
from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed
from rest_framework.permissions import BasePermission
# token认证
class TokenBaseAuthentication(BaseAuthentication):
def authenticate(self, request):
visit_path = request.get_full_path()
token = request.data.get('token')
if not token:
raise AuthenticationFailed('先登录后访问')
print(token)
try:
user_obj = models.UserInfo.objects.get(token=token)
return user_obj, token
except Exception:
raise AuthenticationFailed('用户名或者者密码错误')
# 权限管理
class TokenBasePermission(BasePermission):
message = '权限不够'
def has_permission(self, request, view):
user_obj = request.user
visit = view.__class__.__name__.lower()
print(visit)
if user_obj.user_type == 1 and visit == 'book':
return True
elif user_obj.user_type == 2 and visit == 'publish':
return True
views.py
from django.shortcuts import render
# Create your views here.
import uuid
from rest_framework.viewsets import ModelViewSet
from rest_framework.views import APIView
from rest_framework.response import Response
from . import serializer
from . import models
from . import util
class Login(APIView):
def post(self, request, *args, **kwargs):
msg = {'code': 200, 'msg': None}
username = request.data.get('username')
password = request.data.get('password')
user_obj = models.UserInfo.objects.filter(username=username, password=password)
if not user_obj:
msg['code'] = 100
msg['msg'] = '用户名或者密码错误!'
return Response(msg)
token = uuid.uuid4()
models.UserInfo.objects.update_or_create(defaults={'token': token}, username=username)
msg['msg'] = '登录成功'
msg['token'] = token
msg['username'] = username
return Response(msg)
class Book(ModelViewSet):
authentication_classes = [util.TokenBaseAuthentication,]
permission_classes = [util.TokenBasePermission,]
queryset = models.Book.objects.all()
serializer_class = serializer.BookModelSerializer
class Publish(ModelViewSet):
authentication_classes = [util.TokenBaseAuthentication,]
permission_classes = [util.BasePermission,]
queryset = models.Publish.objects.all()
serializer_class = serializer.PublishModelSerializer