How to customize the permission system of django
This article introduces the relevant knowledge of "how to customize the permission system of django". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!
Recently, a permission management system needs to be built in the project. The functional requirement is to add a permission verification function to all the current backend APIs. If the user has permission to access this API, the data will be returned. If you do not have the permission to access this API, you will be prompted that the user does not have the right to access the API. Permission control that belongs to the button level.
The idea of user rights management, to manage the rights of roles, to determine which roles users belong to, what permissions these roles have, users will have the corresponding permissions of their roles. Generally speaking, it is based on RABC permission control.
The models models used in rights management are
1. Role model
two。 Permission name model
3. User model
The relevant model code is as follows:
Class PowerDetail (BaseModel): name= models.CharField (verbose_name= "permission details name", max_length=20) code = models.CharField (verbose_name= "permission details Encoding", max_length=50, unique=True)
Class Meta: db_table = "base_power_detail" unique_together = ("code", "name") verbose_name = "role permission details" verbose_name_plural = "role permission details" ordering = ["id"]
Def _ _ str__ (self): return self.name
Class Role (BaseModel): user = models.ManyToManyField (BaseUser, related_name= "roles") name= models.CharField (verbose_name= "role name", max_length=20) power_detail = models.ManyToManyField (PowerDetail, related_name= "roles")
Class Meta: verbose_name = "user role role" verbose_name_plural = "user role"
Def _ _ str__ (self): return self.name
When judging the permissions of the user is to query the redis, not the mysql database, which can reduce the pressure of database access. The role management of users and the rights management of roles I manage through the admin that comes with django. When managing user roles, the user's corresponding permissions are saved to redis by overriding the admin method.
The code to determine whether a user has permissions is implemented through a decorator check_power, as follows:
Def check_user_power (user, power_code): "determine whether the employee has the corresponding permissions for power_code" return r_db.sismember (get_user_power_key (user), power_code)
# decorator def check_power (code): def decode (func): def wrapper (self, request, * args, * * kwargs): user = request.login_user if not check_user_power (user, code): return Response ({"error": "no permission operation", "code": 401}) res = func (self, request, * args) * * kwargs) return res return wrapper return decode
Class V1VideoClassView (APIView): @ check_power (PowerDetailCode.category_label_manage.code) def get (self, request): "Video category"# {" id "," category name "} res = [{" id ": key," name ": value} for key, value in class_dict.items ()] return Response (res)
This is the end of the content of "how to customize the permission system for django". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!
