10.11(2)用户权限

2018-10-11 20:30:42

根据用户权限,是否显示权限操作按钮!

其实就是在html页面增加判断是不是用户有权限,有就显示按钮,没有就不显示

然后第一种简单粗暴,直接if url 写死了

第二种 直接多建了几张表解耦,然后各种复杂操作!就是为了解耦不写死!!长远看,很值得学习!

越努力,越幸运!永远不要高估自己!

 

放上代码

models.py

from django.db import models


class User(models.Model):
    name = models.CharField(max_length=32)
    pwd = models.CharField(max_length=32)
    roles = models.ManyToManyField(to="Role")

    def __str__(self): return self.name


class Role(models.Model):
    title = models.CharField(max_length=32)
    permissions = models.ManyToManyField(to="Permission")

    def __str__(self): return self.title


class Permission(models.Model):
    title = models.CharField(max_length=32)
    url = models.CharField(max_length=32)
    action = models.CharField(max_length=32,default="")
    group = models.ForeignKey("PermissionGroup",default=1)

    def __str__(self):
        return self.title


# 创建一个角色组的表 2018-10-11 17:33:51
class PermissionGroup(models.Model):
    title = models.CharField(max_length=32)

    def __str__(self): return self.title

rbac/service/persions.py

def initial_session(user,request):
    """用于储存查询到用户权限的session"""
    # 方案1
    permissions = user.roles.all().values("permissions__url").distinct()
    # 【{}，{}】
    permission_list = []

    for item in permissions:
        permission_list.append(item["permissions__url"])
    print(permission_list)

    request.session["permission_list"] = permission_list

    # 方案2

    permissions = user.roles.all().values("permissions__url","permissions__group_id","permissions__action").distinct()
    print("permissions",permissions)


    permission_dict={}
    for item in permissions:
        gid=item.get('permissions__group_id')

        if not gid in permission_dict:

            permission_dict[gid] = {
                "urls": [item["permissions__url"],],
                "actions": [item["permissions__action"],]
            }
        else:
            permission_dict[gid]["urls"].append(item["permissions__url"])
            permission_dict[gid]["actions"].append(item["permissions__action"])
    request.session['permission_dict'] = permission_dict

rbac/service/rabc.py

import re
from django.utils.deprecation import MiddlewareMixin
from django.shortcuts import HttpResponse, redirect


def reg(request,current_path):
    # 校验权限1(permission_list)
    permission_list = request.session.get("permission_list", [])
    flag = False
    for permission in permission_list:

        permission = "^%s$" % permission

        ret = re.match(permission, current_path)
        if ret:
            flag = True
            break
    return flag


class ValidPermission(MiddlewareMixin):
    def process_request(self, request):
        # 当前访问路径
        current_path = request.path_info

        # 检查是否属于白名单
        valid_url_list=["/login/","/reg/","/admin/.*"]

        for valid_url in valid_url_list:
            ret=re.match(valid_url,current_path)
            if ret:
                return None
        # 校验是否登录
        user_id = request.session.get("user_id")
        if not user_id:
            return redirect("/login/")
        # 校验权限1(permission_list)
        permission_list = request.session.get("permission_list",[])  # ['/users/', '/users/add', '/users/delete/(\d+)', 'users/edit/(\d+)']
        flag=reg(request,current_path)
        if not flag:
            return HttpResponse("没有访问权限！")
        return None

        # 校验权限2
        # permission_dict = request.session.get("permission_dict")
        #
        # for item in permission_dict.values():
        #       urls=item['urls']
        #       for reg in urls:
        #           reg ="^%s$" % reg
        #           ret=re.match(reg,current_path)
        #           if ret:
        #               request.actions=item['actions']
        #               return None
        #
        # return HttpResponse("没有访问权限！")

views.py

from django.shortcuts import render,HttpResponse
from rbac01.service.perssions import *
from rbac01.models import *


class Per(object):
    def __init__(self,actions):
        self.actions=actions

    def add(self):
        return "add" in self.actions

    def delete(self):
        return "delete" in self.actions

    def edit(self):
        return "edit" in self.actions

    def list(self):
        return "list" in self.actions


def users(request):
    user_list=User.objects.all()
    # permission_list=request.session.get("permission_list")
    # print(permission_list)
    # 查询当前登录人得名字
    id = request.session.get("user_id")
    user = User.objects.filter(id=id).first()
    # 创建一个类对象,然后传入前端, 可以直接 per.add  对象调用方法 省事!
    per = Per(request.actions)
    # locals() 内置函数  返回全局所有变量,生成一个字典,就是{'per': per}的升级版
    return render(request, "rbac/users.html", locals())











import re
def add_user(request):


    return HttpResponse("add user.....")

def del_user(request,id):

    return HttpResponse("del"+id)


def roles(request):

    role_list=Role.objects.all()
    per = Per(request.actions)
    return render(request,"rbac/roles.html",locals())






def login(request):

    if  request.method=="POST":

        user=request.POST.get("user")
        pwd=request.POST.get("pwd")

        user=User.objects.filter(name=user,pwd=pwd).first()
        if user:
            ############################### 在session中注册用户ID######################
            request.session["user_id"]=user.pk

            ###############################在session注册权限列表##############################



            # 查询当前登录用户的所有角色
            # ret=user.roles.all()
            # print(ret)# <QuerySet [<Role: 保洁>, <Role: 销售>]>

            # 查询当前登录用户的所有权限，注册到session中
            initial_session(user,request)


            # return HttpResponse("登录成功！")
            return redirect("/users/")


    return render(request,"login.html")

user.html

{% extends 'base.html' %}


{% block con %}
    {% load my_tags %}
    {% valid '<a href="/users/add/" class="btn btn-primary">添加用户</a>' request %}
    <h4>用户列表</h4>

    {% if per.add %}
    <a href="users/add/" class="btn btn-primary">添加用户</a>
    {% endif %}
    <table class="table table-bordered table-striped">
        <thead>
              <tr>
                   <th>序号</th>
                   <th>姓名</th>
                   <th>角色</th>
                   <th>操作</th>
              </tr>
        </thead>
       <tbody>
            {% for user in user_list %}
            <tr>
                 <td>{{ forloop.counter }}</td>
                 <td>{{ user.name }}</td>
                 <td>
                     {% for role in user.roles.all %}
                     {{ role.title }}
                     {% endfor %}

                 </td>

                 <td>
                     {% if per.delete %}
                      <a href="/users/delete/{{ user.pk }}" class="btn btn-danger">删除</a>
                     {% endif %}
                     {% if per.edit %}
                     <a href="" class="btn btn-warning">编辑</a>
                     {% endif %}
                 </td>
            </tr>
            {% endfor %}

       </tbody>
    </table>


{% endblock %}

my_stgs.py

# by luffycity.com

from django import template

register=template.Library()



# 解耦 放专门获取用户权限的函数

@register.inclusion_tag("rbac/menu.html")
def get_menu(request,):
    # 获取当前用户可以放到菜单栏中的权限
    menu_permission_list = request.session["menu_permission_list"]


    return {"menu_permission_list":menu_permission_list}

放上笔记

day83:

    权限粒度控制
    
    简单控制：
        {% if "users/add" in permissions_list%}


    摆脱表控制
    
    
    更改数据库结构
        class Permission(models.Model):
            title=models.CharField(max_length=32)
            url=models.CharField(max_length=32)

            # 添加个用户行为
            action=models.CharField(max_length=32,default="")
            # 部门群组
            group=models.ForeignKey("PermissionGroup",default=1)
            def __str__(self):return self.title



        class PermissionGroup(models.Model):
            title = models.CharField(max_length=32)

            def __str__(self): return self.title
    

    登录验证：
        permissions = user.roles.all().values("permissions__url","permissions__group_id","permissions__action").distinct()
        
        构建permission_dict

            permissions：
                [

                 {'permissions__url': '/users/add/', 
                 'permissions__group_id': 1, 
                 'permissions__action': 'add'}, 
                 
                 {'permissions__url': '/roles/', 
                 'permissions__group_id': 2, 
                 'permissions__action': 'list'}, 
                 
                 {'permissions__url': '/users/delete/(\d+)', 
                 'permissions__group_id': 1, 
                 'permissions__action': 'delete'}, 
                 
                 {'permissions__url': 'users/edit/(\d+)', 
                 'permissions__group_id': 1, 
                 'permissions__action': 'edit'}
                 ]
                 
            permission_dict

 
                 {
                 
                 1: {
                 'urls': ['/users/', '/users/add/', '/users/delete/(\d+)', 'users/edit/(\d+)'], 
                 'actions': ['list', 'add', 'delete', 'edit']}, 
                 
                 2: {
                 'urls': ['/roles/'],
                 'actions': ['list']}
                 
                 }

 
 
    中间价校验权限：
        permission_dict=request.session.get("permission_dict")

        for item in permission_dict.values():
              urls=item['urls']
              for reg in urls:
                  reg="^%s$"%reg
                  ret=re.match(reg,current_path)
                  if ret:
                      print("actions",item['actions'])
                      request.actions=item['actions']
                      return None

        return HttpResponse("没有访问权限！")
        
        
    思考：
        菜单权限显示