权限控制
基于form组件实现
1. 配置文件编写权限关系表
有权限控制,意味着要登录,需要提前把登录页面放到白名单,在setting.py文件写入白名单内的路径不做访问控制和登录认证
WHITE_URL = ["/web/login/", "/web/sms_login", "web/sms_send", "/web/logout/"]
在setting.py文件写入权限关系表,实现ADMIN,BOSS,CUSTOMER三者不同的访问路径
MY_PERMISSION = {
"ADMIN": {
"home": {"text": "主页", "parent": None},
"order": {"text": "订单", "parent": None},
"level_list": {"text": "级别展示", "parent": None},
"level_add": {"text": "级别新增", "parent": "level_list"},
"customer_list": {"text": "用户管理", "parent": None},
},
"BOSS": {
"home": {"text": "主页", "parent": None},
"order": {"text": "订单", "parent": None},
"order_add": {"text": "订单新增", "parent": "order"},
"level_list": {"text": "级别展示", "parent": None},
"level_add": {"text": "级别新增", "parent": "level_list"},
"level_edit": {"text": "级别编辑", "parent": "level_list"},
"level_del": {"text": "级别删除", "parent": "level_list"},
"customer_list": {"text": "用户管理", "parent": None},
"customer_add": {"text": "新增用户", "parent": "customer_list"},
"customer_edit": {"text": "用户编辑", "parent": "customer_list"},
"customer_del": {"text": "用户删除", "parent": "customer_list"},
},
"CUSTOMER": {
"home": {"text": "主页", "parent": None},
# "order": None,
}
}
2. 通过django的session组件,对用户登录后将角色传入到session中
user_obj = models.Customer.objects.filter(username=user, password=pwd).first()
if not user_obj:
userform.add_error("acc_password", "账号或者用户名错误")
return render(request, "login.html", {"userform": userform})
mapping = {"root": "BOSS", "admin": "ADMIN"}
request.session[settings.SESSION_KEY] = {"name": user, "role": user_obj.get_role_level_display()}
return redirect(settings.HOME_PAGE)
get_role_level_display() 是为了展示下面role_level里的choice字段
model代码
class Customer(ActiveBaseModel):
role_Choices=((30,"BOSS"),(20,"ADMIN"),(1,"CUSTOMER"))
username = models.CharField(max_length=20, verbose_name="用户名称")
password = models.CharField(max_length=20, verbose_name="密码")
...省略...
level =models.ForeignKey(verbose_name="会员等级",to="Level",on_delete=models.CASCADE,default=1)
role_level = models.SmallIntegerField(choices=role_Choices,default=1,verbose_name="角色级别")
# limit_choices_to 可以用来对关联内容做限制展示
# level = models.ForeignKey(verbose_name="级别", to="Level", on_delete=models.CASCADE, limit_choices_to={'active': 1})
create_date=models.DateTimeField(verbose_name="创建日期",auto_now_add=True)
3. 通过中间件读取里面的角色和配置文件角色相关的权限
搞懂中间件的先后执行顺序
process_request 是第一步,通过这步获取session内的数据,同时做初步的登录访问控制路由
process_view 是在上一步获取权限的基础上进行鉴权操作.
# 用来通过实例对象,将权限,角色等信息规范的写入到对应的属性中去
class UserDict():
def __init__(self,name,role):
self.name=name
self.role=role
self.detail = settings.MY_MENU.get(role)
self.permission=settings.MY_PERMISSION.get(role)
self.path = None
# 将UserDict通过中间件赋值到request对象中,后续可以通过request.user_dict.permission获取登录角色的权限
class AuthMiddleware(MiddlewareMixin):
def process_request(self, request):
# 白名单url不需要登录就能访问
if request.path_info in settings.WHITE_URL:
return None
# 检测是否已经登录,判断session中的userino的session信息
user_dict = request.session.get(settings.SESSION_KEY)
print("user_dict>>", user_dict)
if not user_dict:
return redirect(settings.LOGIN_HOME)
# 也可以 request.user_dict.name = user_dict.get("name"),但是推荐下面这样写
# 因为类属性字段都会统一,而且调用时候也方便直接获取对象的属性即可
# 并且在html模版中也可以传入request对象,如果要获取用户名字就是request.user_dict.name
request.user_dict=UserDict(**user_dict)
def process_view(self,request,callback,callback_args,callback_kwargs):
# 无须登录就能访问的白名单没有给request添加user_dict类,放行
if not hasattr(request,"user_dict"):
return None
url_name = request.resolver_match.url_name
if not request.user_dict.permission.get(url_name):
return HttpResponse("没有权限进入")
# 添加访问路径
visit_path_list=[]
visit_path_list.append(request.user_dict.permission[url_name]["text"])
while request.user_dict.permission[url_name]["parent"]:
print("url_name>>", url_name)
father_menu = request.user_dict.permission[url_name]["parent"]
father_menu_text = request.user_dict.permission[father_menu]["text"]
visit_path_list.append(father_menu_text)
url_name=father_menu
visit_path_list.reverse()
print("访问路径是",visit_path_list) #访问路径是 ['订单', '订单新增']
request.user_dict.path=visit_path_list
4. 自定义模版
理论上 第3步已经实现了权限控制,这一步是增加体验感,对于没权限的功能,在前端页面上不做展示.
这里自定义了添加,编辑,删除的自定义simple_tag
还自定义了过滤器,这里是根据功能选择不同的自定义模版类型,
选择自定义simple_tag是因为要传入多个参数,而自定义的过滤器只能传2个,但是simple_tag只能返回字符串,因此需要mark_safe进行转换成a标签
选择自定义过滤器 是因为要实现table标签 的列是否显示,如果登录角色没有edit和delete的权限,那么操作这列没必要显示出来,因此返回的值为布尔值即可
from django import template
from django.utils.safestring import mark_safe
from django.shortcuts import reverse
register=template.Library()
@register.simple_tag()
def add_permission(request,url_reverse_name,*args,**kwargs):
# 传入url别名反向生成url
actual_url = reverse(url_reverse_name,*args,**kwargs)
# 如果权限中有url别名 表示有权限
if not request.user_dict.permission.get(url_reverse_name):
return ""
else:
html_tag = '<a class="btn btn-success" href="{}">新增</a>'.format(actual_url)
# html_tag = '<a class="btn btn-success" >新增</a>'
return mark_safe(html_tag)
@register.simple_tag()
def edit_permission(request,url_reverse_name,*args,**kwargs):
# 这里的edit和上面的add url是不同的,edit和delete是要传入pk值的,反向解析通过kwargs获取
actual_url = reverse(url_reverse_name, args=args,kwargs=kwargs)
# 如果权限中有url别名 表示有权限
if not request.user_dict.permission.get(url_reverse_name):
return ""
else:
# html_tag = '<td><a class="btn btn-primary" href="{}">编辑</a> </td>'.format(actual_url)
html_tag = '<a class="btn btn-primary" href="{}">编辑</a> '.format(actual_url)
return mark_safe(html_tag)
@register.simple_tag()
def del_permission(request,url_reverse_name,*args,**kwargs):
# 这里的edit和上面的add url是不同的,edit和delete是要传入pk值的,反向解析通过kwargs获取
actual_url = reverse(url_reverse_name, args=args,kwargs=kwargs)
if not request.user_dict.permission.get(url_reverse_name):
return ""
else:
# html_tag = '<td><a class="btn btn-danger" href="{}">删除</a> </td>'.format(actual_url)
html_tag = '<a class="btn btn-danger" href="{}">删除</a>'.format(actual_url)
return mark_safe(html_tag)
@register.filter()
def has_permission(request,tags):
#filter只能传2个参数,这里我们把多个反向解析的url别名用逗号拼接传入tags
tag_lists = tags.split(",")
for tag_List in tag_lists:
if tag_List in request.user_dict.permission.keys():
return True
return False
5. 在html模版渲染中写入判断条件,实现动态展示
{% extends "home.html" %}
{% load permission_tags %}
{% block level %}
<div>
{# <a class="btn btn-success" href={% url 'level_add' %}>新增</a>#}
{% add_permission request "level_add" %}
</div>
<table class="table table-striped table-condensed table-hover">
<thead>
<tr>
<th>ID</th>
<th>标题</th>
<th>折扣</th>
{% if request|has_permission:"level_edit,level_del" %} 如果无删除和编辑权限,不显示操作这列
<th>操作</th>
{% endif %}
</tr>
</thead>
<tbody></tbody>
{% for obj in queryset %}
<tr>
<td>{{ obj.id }}</td>
<td>{{ obj.title }}</td>
<td>{{ obj.discount }} <span>%</span></td
{% if request|has_permission:"level_edit,level_del" %} 如果无删除和编辑权限,不显示操作这列
<td>
{% edit_permission request "level_edit" pk=obj.id %} {# 编辑按钮 #} 如果无编辑权限,不显示编辑按钮
{% del_permission request "level_del" pk=obj.id %} {# 删除按钮 #} 如果无删除权限,不显示删除按钮
</td>
{% endif %}
</tr>
{% endfor %}
</table>
{% endblock %}