创建组件
需求分析：
创建独立app， rbac
##注意：
app创建后需要注册到setting.py中
INSTALLED_APPS = [
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'rbac.apps.RbacConfig',
'app01.apps.App01Config',
]
设计权限表
方案1：
创建用户表和创建权限表，然后两个表通过一个用户可能有多各权限 然后一个权限可以属于多个用户，所以两张表创建多对多关系，但是存在很多用户有相同的权限字段，所以参考方案二。
方案2：
创建用户表、创建权限表和角色表，为每个角色添加权限，然后用户通过角色获取自己的权限，分析如下所示
用户表：
ID username password ....
番禺
夹缝
果冻
鲁宁
角色表：
ID title
CEO
CTO
COO
部门经理
技术员
用户和角色关系表：
用户ID 角色ID
权限表：
ID url title
/index/ 首页
/userinfo/ 用户列表
/userinfo/add/ 添加用户
/userinfo/del/(\d+)/ 删除用户
/userinfo/edit/(\d+)/ 修改用户
角色权限关系表：
角色ID 权限ID
具体表设计如下所示：
from django.db import models class Permission(models.Model):
"""
权限表
"""
title = models.CharField(verbose_name='标题',max_length=)
url = models.CharField(verbose_name="含正则URL",max_length=)
is_menu = models.BooleanField(verbose_name="是否是菜单") class Meta:
verbose_name_plural = "权限表" def __str__(self):
return self.title class User(models.Model):
"""
用户表
"""
username = models.CharField(verbose_name='用户名',max_length=)
password = models.CharField(verbose_name='密码',max_length=)
email = models.CharField(verbose_name='邮箱',max_length=) roles = models.ManyToManyField(verbose_name='具有的所有角色',to="Role",blank=True)
class Meta:
verbose_name_plural = "用户表" def __str__(self):
return self.username class Role(models.Model):
"""
角色表
"""
title = models.CharField(max_length=)
permissions = models.ManyToManyField(verbose_name='具有的所有权限',to='Permission',blank=True)
class Meta:
verbose_name_plural = "角色表" def __str__(self):
return self.title
然后通过管理类同步数据库，添加数据。
. 权限录入：
CEO：番禺
/userinfo/
/userinfo/add/
/userinfo/edit/(\d+)/
/userinfo/del/(\d+)/
/order/
/order/add/
/order/edit/(\d+)/
/order/del/(\d+)/
总监：鲁宁
/userinfo/
/userinfo/add/
/order/
/order/add/
经理：肾松
/userinfo/
/order/
业务员：肾松，文飞，成栋
/order/
配置用户调用接口
1. 本地化用户权限
在rbac中创建一个初始化文件，用于本地化权限信息，使调用者方便调用
from django.conf import settings def init_permission(request,user):
"""
本地化用户权限"""
# 获取当前用户所有权限(重)
permission_list = user.roles.values('permissions__url').distinct()
request.session[settings.PERMISSION_LIST] = [url['permissions__url'] for url in permission_list]
2. 通过中间键进行用户请求url过滤
settings.py中
MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'rbac.middleware.PermissionMiddleware', # 将添加的中间件配置到settings中
]
#####################confirm###################
SESSION_KEY = 'auth_user'
PERMISSION_LIST = 'permission_list' INVALIDATION_LIST = [
'/admin.*',
'/login/',
'/register/',
]
创建middleware.py
# encoding:utf-8
# Author:"richie"
# Date:11/7/2017
import re
from django.conf import settings
from django.shortcuts import HttpResponse,redirect
class MiddlewareMixin(object):
def __init__(self, get_response=None):
self.get_response = get_response
super(MiddlewareMixin, self).__init__() def __call__(self, request):
response = None
if hasattr(self, 'process_request'):
response = self.process_request(request)
if not response:
response = self.get_response(request)
if hasattr(self, 'process_response'):
response = self.process_response(request, response)
return response class PermissionMiddleware(MiddlewareMixin): def process_request(self, request): current_path = request.path_info for url in settings.INVALIDATION_LIST:
if re.match(url,current_path):
return None permission_list = request.session.get(settings.PERMISSION_LIST) if not permission_list:
return redirect('/login/') flag = False for url in permission_list:
regular = "^{0}$".format(url) # 因为添加url的时候没有添加严格匹配的规则，所以在这里转格式
if re.match(regular,current_path):
flag = True
break if not flag:
# 没有匹配上
return HttpResponse('无权访问')
权限组件使用
分配url，
from django.conf.urls import url
from app01 import views
urlpatterns = [
url(r'^login/', views.login, name='login'),
url(r'^index/', views.home, name='home'),
url(r'^userinfo/', views.home, name='home'),
url(r'^userinfo/add', views.home, name='home'),
url(r'^order/', views.home, name='home'),
url(r'^order/add', views.home, name='home'),
]
定义视图函数：
from django.shortcuts import render,redirect
from django.conf import settings
from rbac.models import User
from rbac.service import init_permission
# Create your views here. class UserLoginForm(forms.ModelForm):
"""
定义用户登录的from表单
"""
class Meta:
model = models.User
fields = ['username','password'] def login(request):
if request.method == 'POST':
# 获取用户from表单数据
login_form = forms.UserLoginForm(request.POST)
# 数据格式验证
if login_form.is_valid():
#用户认证
username = login_form.cleaned_data.get('username')
password = login_form.cleaned_data.get('password')
# 用户数据数据库验证
user =User.objects.filter(username=username,password=password).first()
if user:
#初始化权限系统
init_permission(request,user)
# 添加用户信息
request.session[settings.SESSION_KEY] = {'uid':user.id,'username':username}
return redirect('/home/')
else:
# 登录失败 添加错误信息
login_form.errors.update({'user_error': '用户名或密码错误'})
else:
login_form = forms.UserLoginForm() return render(request, 'login.html',{'form':login_form}) def home(request):
"""
主页面
:param request:
:return:
""" #获取用户名信息
username = request.session.get(settings.SESSION_KEY).get('username')
return render(request,'home.html',locals())
3. 定义模板页面
login.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Title</title>
</head>
<body> <form method="post" novalidate>{% csrf_token %}
{{ form.errors.user_error }}
{% for filed in form %}
<p>{{ filed.label_tag }}{{ filed }}</p>
<p>{{ filed.errors.as_text }}</p>
{% endfor %} <input type="submit" value="提交">
</form> </body>
</html>
定义home.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Title</title>
</head>
<body>
{{ username }}
</body>
</html>