RBAC 继完善代码之后的，再一次完善

在上一篇文章中，我的中间件是保存在我的web 业务app 中的。
但是rbac我想要完成的是一个组件的功能，所以这个验证的中间件，何不放到rbac的app之中：

为了太乱先放一个项目的目录图片：

不要忘记我们的目的：做一个可以灵活使用的rbac 权限组件：
先看看setting中的配置：

import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)

BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

# Quick-start development settings - unsuitable for production

# See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!

SECRET_KEY = 'o+ym86530)hs=+26$$n=+l(w$belc-3uu0aa%9+*(snlac-5@a'

# SECURITY WARNING: don't run with debug turned on in production!

DEBUG = True

ALLOWED_HOSTS = []

# Application definition

INSTALLED_APPS = [

    'django.contrib.admin',

    'django.contrib.auth',

    'django.contrib.contenttypes',

    'django.contrib.sessions',

    'django.contrib.messages',

    'django.contrib.staticfiles',

    'rbac.apps.RbacConfig',

    'web.apps.WebConfig',

]

# 编写中间件，对用户权限，进行校验

MIDDLEWARE = [

    'django.middleware.security.SecurityMiddleware',

    'django.contrib.sessions.middleware.SessionMiddleware',

    'django.middleware.common.CommonMiddleware',

    'django.middleware.csrf.CsrfViewMiddleware',

    'django.contrib.auth.middleware.AuthenticationMiddleware',

    'django.contrib.messages.middleware.MessageMiddleware',

    'django.middleware.clickjacking.XFrameOptionsMiddleware',

    "rbac.middlewares.rbac.RbacMiddleware",

]

ROOT_URLCONF = 'crm_learn.urls'

TEMPLATES = [

    {

        'BACKEND': 'django.template.backends.django.DjangoTemplates',

        'DIRS': [os.path.join(BASE_DIR, 'templates')]

        ,

        'APP_DIRS': True,

        'OPTIONS': {

            'context_processors': [

                'django.template.context_processors.debug',

                'django.template.context_processors.request',

                'django.contrib.auth.context_processors.auth',

                'django.contrib.messages.context_processors.messages',

            ],

        },

    },

]

WSGI_APPLICATION = 'crm_learn.wsgi.application'

# Database

# https://docs.djangoproject.com/en/2.1/ref/settings/#databases

DATABASES = {

    'default': {

        'ENGINE': 'django.db.backends.sqlite3',

        'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),

    }

}

# Password validatiALLOWED_HOSTSon

# https://docs.djangoproject.com/en/2.1/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [

    {

        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',

    },

    {

        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',

    },

    {

        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',

    },

    {

        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',

    },

]

# Internationalization

# https://docs.djangoproject.com/en/2.1/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_L10N = True

USE_TZ = True

# Static files (CSS, JavaScript, Images)

# https://docs.djangoproject.com/en/2.1/howto/static-files/

STATIC_URL = '/static/'

# ################## 默认文件上传配置 ########################

from django.core.files.uploadhandler import MemoryFileUploadHandler

from django.core.files.uploadhandler import TemporaryFileUploadHandler

# List of upload handler classes to be applied in order.

FILE_UPLOAD_HANDLERS = [

    'django.core.files.uploadhandler.MemoryFileUploadHandler',

    'django.core.files.uploadhandler.TemporaryFileUploadHandler',

]

# Maximum size, in bytes, of a request before it will be streamed to the

# file system instead of into memory.

# 允许内存中上传文件的大小

#   合法：InMemoryUploadedFile对象（写在内存）         -> 上传文件小于等于 FILE_UPLOAD_MAX_MEMORY_SIZE

# 不合法：TemporaryUploadedFile对象（写在临时文件）     -> 上传文件大于    FILE_UPLOAD_MAX_MEMORY_SIZE 且 小于 DATA_UPLOAD_MAX_MEMORY_SIZE

FILE_UPLOAD_MAX_MEMORY_SIZE = 2621440  # i.e. 2.5 MB

# Maximum size in bytes of request data (excluding file uploads) that will be

# read before a SuspiciousOperation (RequestDataTooBig) is raised.

# 允许上传内容的大小（包含文件和其他请求内容）

DATA_UPLOAD_MAX_MEMORY_SIZE = 2621440  # i.e. 2.5 MB

# Maximum number of GET/POST parameters that will be read before a

# SuspiciousOperation (TooManyFieldsSent) is raised.

# 允许的上传文件数

DATA_UPLOAD_MAX_NUMBER_FIELDS = 1000

# Directory in which upload streamed files will be temporarily saved. A value of

# `None` will make Django use the operating system's default temporary directory

# (i.e. "/tmp" on *nix systems).

# 临时文件夹路径

FILE_UPLOAD_TEMP_DIR = None

# The numeric mode to set newly-uploaded files to. The value should be a mode

# you'd pass directly to os.chmod; see https://docs.python.org/3/library/os.html#files-and-directories.

# 文件权限

FILE_UPLOAD_PERMISSIONS = None

# The numeric mode to assign to newly-created directories, when uploading files.

# The value should be a mode as you'd pass to os.chmod;

# see https://docs.python.org/3/library/os.html#files-and-directories.

# 文件夹权限

FILE_UPLOAD_DIRECTORY_PERMISSIONS = None

# session-key配置

PERMISSIONS_SESSION_KEY = "permissions__url"

# 配置权限 白名单

VALID_URL_LIST = ["/login/", "/admin/"]

LOGGING = {

    'version': 1,

    'disable_existing_loggers': False,

    'handlers': {

        'console':{

            'level':'DEBUG',

            'class':'logging.StreamHandler',

        },

    },

    'loggers': {

        'django.db.backends': {

            'handlers': ['console'],

            'propagate': True,

            'level':'DEBUG',

        },

    }

}

settiongs

我在配置文件中添加的这两个，配置项。

# session-key配置为了解决以后我可能想要更换 session-key的问题
PERMISSIONS_SESSION_KEY = "permissions__url"

# 配置权限白名单为了一些我并不想通过rbac组件进行权限验证的一些白名单
VALID_URL_LIST = ["/login/", "/admin/"]

然后是权限认证的中间件：

通过引入settings 的到， session-key 和白名单。在中间件进行验证

rom django.utils.deprecation import MiddlewareMixin

from django.shortcuts import HttpResponse

from django.conf import settings

import re

class RbacMiddleware(MiddlewareMixin):

    '''用户权限信息的校验'''

    def process_request(self, request):

        '''当用户请求进入时 触发执行'''

        '''

        1. 获取当前用户请求的url

        2. 获取当前用户在session中保存的 权限列表 [......]

        3. 当前请求url 在 session中， 就可以，进行访问

        '''

        current_url = request.path_info

        for valid_url in settings.VALID_URL_LIST:

            if re.match(valid_url, current_url):  # 先一步进行白名单的验证

                return None

        permission_list = request.session.get(settings.PERMISSIONS_SESSION_KEY)

        if not permission_list:

            return HttpResponse("您没有访问权限...请联系管理员")

        flag = False

        for url in permission_list:

            reg = "^%s$" % url

            if re.match(reg, current_url):

                flag = True

                break

        if not flag:

            return HttpResponse("无权访问")

rbac.middlewares.rbac.RbacMiddleware

然后是modles:

from django.db import models

class Permission(models.Model):

    """

    权限表

    """

    title = models.CharField(verbose_name='标题', max_length=32)

    url = models.CharField(verbose_name='含正则的URL', max_length=128)

    def __str__(self):

        return self.title

class Role(models.Model):

    """角色"""

    title = models.CharField(verbose_name='角色名称', max_length=32)

    permissions = models.ManyToManyField(verbose_name='拥有的所有权限', to='Permission', blank=True)

    def __str__(self):

        return self.title

class UserInfo(models.Model):

    """

    用户表

    """

    name = models.CharField(verbose_name='用户名', max_length=32)

    password = models.CharField(verbose_name='密码', max_length=64)

    email = models.CharField(verbose_name='邮箱', max_length=32)

    roles = models.ManyToManyField(verbose_name='拥有的所有角色', to='Role', blank=True)

    def __str__(self):

        return self.name

rbac.models

然后是 web 业务的视图函数中：

在这里我们直接引入rbac组件中 service.init_permission 权限初始化函数 init_permission(current_user, request)
来进行，权限的初始化。并且跳转到主页面。

from django.shortcuts import HttpResponse, redirect, render

from rbac.models import *

from rbac.service.init_permission import init_permission

def login(request):

    if request.method == "POST":

        user = request.POST.get("user")

        pwd = request.POST.get("pwd")

        current_user = UserInfo.objects.filter(name=user, password=pwd).first()

        if not current_user:

            return render(request, "login.html", {"msg": "username or password is wrong"})

        init_permission(current_user, request)

        return redirect("/customer/list/")

    return render(request, "login.html", locals())

web.views.account

巴特西

RBAC 继完善代码之后的，再一次完善

最新文章

热门文章