rest-framework认证、权限组件

认证组件：

　　models

class User(models.Model):
    username = models.CharField(max_length=32)
    password = models.CharField(max_length=32)
    user_type_entry = (
        (1,"Delux"),
        (2,"SVIP"),
        (3,"VVIP"),
    )
    user_type = models.IntegerField(choices=user_type_entry)

    def __str__(self):
        return self.username


class UserToken(models.Model):
    user = models.OneToOneField("User",on_delete=models.CASCADE)
    token = models.CharField(max_length=128)

　　写一个认证类

from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import APIException

from app01.models import UserToken


class UserAuth(BaseAuthentication):
    # 所有认证的逻辑都在authenticate中
    def authenticate(self, request):
        user_token = request.GET.get("token")
        token = UserToken.objects.filter(token=user_token).first()
        if token:
            return token.user, token.token
        else:
            raise APIException("没有认证！")

　　views中

class UserView(APIView):

    def post(self,request):
        # 定义返回消息
        response = dict()
        # 定义需要的用户信息
        fields = {"username", "password"}
        # 定义一个用户信息字典
        user_info = dict()

        if fields.issubset(set(request.data.keys())):
            for key in fields:
                user_info[key] = request.data[key]

        user_obj = User.objects.filter(**user_info).first()

        if user_obj:
            access_token = get_random_str()
            UserToken.objects.update_or_create(user=user_obj,defaults={
                "token": access_token
            })

            response["status_code"] = 200
            response["status_message"] = "登录成功"
            response["access_token"] = access_token
            response["user_role"] = user_obj.get_user_type_display()
        else:
            response["status_code"] = 201
            response["status_message"] = "登录失败，用户名或密码错误"

        return Response(response)

　　权限类

from rest_framework.permissions import BasePermission

class UserPerm(BasePermission):
    message = "您没有查看数据的权限！"

    def has_permission(self,request,view):
        if request.user.user_type == 3:
            return True
        return False

　　在需要认证和权限的视图类中加入

class BookView(ModelViewSet):
    authentication_classes = [UserAuth]
    permission_classes = [UserPerm]
    queryset = Book.objects.all()
    serializer_class = BookSerializer