REST framework 權限管理源碼分析
同認證一樣，dispatch()作為入口，從self.initial(request, *args, **kwargs)進入initial()
def initial(self, request, *args, **kwargs):# .......# 用戶認證self.perform_authentication(request)# 權限控制self.check_permissions(request)# ...
check_permissions()便是權限管理源碼的入口
# 權限管理def check_permissions(self, request):"""Check if the request should be permitted.Raises an appropriate exception if the request is not permitted."""for permission in self.get_permissions():if not permission.has_permission(request, self):self.permission_denied(request, message=getattr(permission, 'message', None))
和用戶認證一樣，同樣遍歷一個權限類對象列表，并且調用該列表中元素的has_permission()方法，該方法返回布爾值，True代表有權限，False代表沒有權限.
def get_permissions(self):return [permission() for permission in self.permission_classes]
如果沒有權限，就調用permission_denied()
def permission_denied(self, request, message=None):if request.authenticators and not request.successful_authenticator:raise exceptions.NotAuthenticated()raise exceptions.PermissionDenied(detail=message)
如果使用了REST的認證框架（authentication_classes數組不為空）并且身份認證失敗，就拋出NotAuthenticated異常，否則會拋出PermissionDenied異常
class NotAuthenticated(APIException):status_code = status.HTTP_401_UNAUTHORIZEDdefault_detail = _('Authentication credentials were not provided.')default_code = 'not_authenticated'
NotAuthenticated會導致一個401錯誤（缺少用戶憑證）
class PermissionDenied(APIException):status_code = status.HTTP_403_FORBIDDENdefault_detail = _('You do not have permission to perform this action.')default_code = 'permission_denied'
而PermissionDenied會返回錯誤403（拒絕授權訪問）
在向permission_denied()類傳遞參數時，使用了反射
self.permission_denied(request, message=getattr(permission, 'message', None))
會在這個權限類對象中尋找message屬性，沒找到就使用None,而這個參數在后來只會被用在PermissionDenied異常上，這些異常都繼承自APIException,而在APIException的構造器中，可以發現detail參數就是異常描述，而在自己的權限類中定義message屬性可以改變認證失敗后的描述
class APIException(Exception):status_code = status.HTTP_500_INTERNAL_SERVER_ERRORdefault_detail = _('A server error occurred.')default_code = 'error'def __init__(self, detail=None, code=None):if detail is None:detail = self.default_detailif code is None:code = self.default_code# ...
示例
# api/utils/Permission.py
from rest_framework.permissions import BasePermissionclass CommonPermission(BasePermission):"""普通用戶權限，作用于全局"""def has_permission(self, request, view):print(request.user)if request.user.user_type == 1:return Truedef has_object_permission(self, request, view, obj):"""一旦獲得View權限，將獲得所有object權限:return: True"""return Trueclass VipPermission(BasePermission):"""VIP 用戶權限"""message = '您首先要稱為VIP才能訪問'def has_permission(self, request, view):print(request.user)if request.user.user_type == 2:return Truedef has_object_permission(self, request, view, obj):return True# api/view.py
from django.shortcuts import HttpResponse
from django.http import JsonResponse
from rest_framework.views import APIView
from api.utils.Permission import VipPermissionclass LoginView(APIView):authentication_classes = []# 登錄無需權限認證permission_classes = []def post(self, request, *args, **kwargs):pass@method_decorator(csrf_exempt, name='dispatch')
class ShopView(APIView):def get(self, request, *args, **kwargs):return HttpResponse(request.user.username)def post(self, request, *args, **kwargs):return HttpResponse('POST')class VipIndexView(APIView):"""只授權給VIP用戶查看"""permission_classes = [VipPermission]def get(self, *args, **kwargs):return JsonResponse("welcome VIP ", safe=False)# RESTdemo.setting.py
REST_FRAMEWORK = {'DEFAULT_AUTHENTICATION_CLASSES': ['api.utils.MyAuthentication.MyAuthentication'],'UNAUTHENTICATED_USER': None,'UNAUTHENTICATED_TOKEN': None,'DEFAULT_PERMISSION_CLASSES': ['api.utils.Permission.CommonPermission']
}
)))
)
)
