classAPIView(View): # ... definitial(self, request, *args, **kwargs): """ Runs anything that needs to occur prior to calling the method handler. """ self.format_kwarg = self.get_format_suffix(**kwargs)
# Perform content negotiation and store the accepted info on the request neg = self.perform_content_negotiation(request) request.accepted_renderer, request.accepted_media_type = neg
# Determine the API version, if versioning is in use. version, scheme = self.determine_version(request, *args, **kwargs) request.version, request.versioning_scheme = version, scheme
# Ensure that the incoming request is permitted # 认证组件：校验用户 self.perform_authentication(request) # 权限组件：校验用户权限 self.check_permissions(request) classAPIView(View): # ... definitial(self, request, *args, **kwargs): """ Runs anything that needs to occur prior to calling the method handler. """ self.format_kwarg = self.get_format_suffix(**kwargs)
# Perform content negotiation and store the accepted info on the request neg = self.perform_content_negotiation(request) request.accepted_renderer, request.accepted_media_type = neg
# Determine the API version, if versioning is in use. version, scheme = self.determine_version(request, *args, **kwargs) request.version, request.versioning_scheme = version, scheme
# Ensure that the incoming request is permitted # 认证组件：校验用户 self.perform_authentication(request) # 权限组件：校验用户权限 self.check_permissions(request) # 频率组件：限制视图接口被访问次数 self.check_throttles(request)
二、权限六表
基于用户角色权限访问的控制 （RBAC，Role Based Access Control）：Django 框架使用
基于 auth 认证：ThinkPHP 使用
1. RBAC 认证
RBAC 认证规则通常会分为 三表规则，五表规则，Django 采用六表规则
2. 权限三表
用户表，角色表，权限表
User
id
name
g_id
1
小明
1
2
小白
2
3
小红
2,3
Group
id
name
p_id
1
校长
1
2
讲师
1,2,3
3
助教
1,3
Permission
id
name
1
管理
2
授课
3
答疑
4
财务
3. 权限五表
会发现权限三表中，User 表与 Group 表多对多关系， Group 表与 Permission 表是多对多关系。所以，需要新建这两张的关系表，这就是权限五表。
用户表，角色表，权限表，用户角色关系表，角色权限关系表
U-G关系表
id
u_id
g_id
1
1
1
2
2
2
3
3
2
4
3
3
G-P关系表
id
g_id
p_id
1
1
1
2
2
1
3
2
2
4
2
3
5
3
1
6
3
3
User
id
name
1
小明
2
小白
3
小红
Group
id
name
1
校长
2
讲师
3
助教
Permission
id
name
1
管理
2
授课
3
答疑
4. 权限六表
有的用户可能会执行角色分组以外的权限，所以除了五表外，多了用户表与权限表的关系表。
用户表，角色表，权限表，用户角色关系表，角色权限关系表，用户权限关系表。
U-P关系表
id
u_id
p_id
1
1
4
2
2
4
3
3
4
三、六表间访问
1. 分析源码
auth/models.py
classPermissionsMixin(models.Model): """ Add the fields and methods necessary to support the Group and Permission models using the ModelBackend. """ is_superuser = models.BooleanField( _('superuser status'), default=False, help_text=_( 'Designates that this user has all permissions without ' 'explicitly assigning them.' ), ) # 用户-角色关系表 groups = models.ManyToManyField( Group, verbose_name=_('groups'), blank=True, help_text=_( 'The groups this user belongs to. A user will get all permissions ' 'granted to each of their groups.' ), related_name="user_set", related_query_name="user", ) # 用户-权限关系表 user_permissions = models.ManyToManyField( Permission, verbose_name=_('user permissions'), blank=True, help_text=_('Specific permissions for this user.'), related_name="user_set", related_query_name=classPermissionsMixin(models.Model): """ Add the fields and methods necessary to support the Group and Permission models using the ModelBackend. """ is_superuser = models.BooleanField( _('superuser status'), default=False, help_text=_( 'Designates that this user has all permissions without ' 'explicitly assigning them.' ), ) # 用户-角色关系表 groups = models.ManyToManyField( Group, verbose_name=_('groups'), blank=True, help_text=_( 'The groups this user belongs to. A user will get all permissions ' 'granted to each of their groups.' ), related_name="user_set", related_query_name="user", ) # 用户-权限关系表 user_permissions = models.ManyToManyField( Permission, verbose_name=_('user permissions'), blank=True, help_text=_('Specific permissions for this user.'), related_name="user_set", related_query_name="user", )
微信
支付宝
