认证+权限+频率（内置）（自定义）

# permission.py 
from rest_framework.permissions import BasePermission


class comm_BasePermission(BasePermission):
    def has_permission(self, request, view):
        user = request.user
        print(user.get_user_type_display())
        print(user.username)
        # if user.user_type == 1 or 2:
        if user.user_type == 1:
            return True
        else:
            return False

 

 # authontionscate.py
1 from rest_framework.authentication import BaseAuthentication

from rest_framework.exceptions import AuthenticationFailed

from . import models


class comm_authentication(BaseAuthentication):
    def authenticate(self, request):
        # token 放的位置由后端决定
        token = request.GET.get('token')
        # token = reques
        if token:
            token_user = models.UserToken.objects.filter(token=token).first()
            if token_user:
                return token_user.user, token
            # else:
            #     AuthenticationFailed({'code': 101, 'msg': '你没有权限'})
            else:
                raise AuthenticationFailed('token认证失败')
        else:
            raise AuthenticationFailed('token没有')

 

 1 # model.py
from django.db import models


class Book(models.Model):
    title = models.CharField(max_length=64)
    author = models.CharField(max_length=225)
    price = models.CharField(max_length=64)


class User(models.Model):
    username = models.CharField(max_length=16)
    password = models.CharField(max_length=32)
    user_type = models.IntegerField(choices=((1, 'vip'), (2, 'comm'), (3, '2b')))


class UserToken(models.Model):
    token = models.CharField(max_length=64)
    user = models.OneToOneField(to='User', on_delete=models.DO_NOTHING)

# urls.py
from django.contrib import admin
from django.urls import path, re_path, include
from rest_framework.routers import SimpleRouter

from app01 import views

router = SimpleRouter()
router.register('', views.BookView, 'get1')

urlpatterns = [
    path('admin/', admin.site.urls),
    path('login/', views.LoginView.as_view()),
    path('', include(router.urls)),

]

# views.py
import uuid
from django.shortcuts import render
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.decorators import action
from rest_framework.viewsets import ModelViewSet
from rest_framework.generics import GenericAPIView

from rest_framework.authentication import SessionAuthentication
from rest_framework.permissions import IsAdminUser
from rest_framework.throttling import AnonRateThrottle, UserRateThrottle

from . import models
from . import serializer
from .authontionscate import comm_authentication
from .permission import comm_BasePermission

'''
1.认证配合权限（自定义）局部
2.认证配合权限（内置）全局
3.认证+频率（内置）---未登录的用户 登录的用户 进行限制
4.认证+权限+频率（内置）
'''


# 1.认证配合权限（自定义）局部
# 图书返回接口
# class BookView(ModelViewSet):
#     authentication_classes = [comm_authentication]
#     permission_classes = [comm_BasePermission]
#     queryset = models.Book.objects.all()
#     serializer_class = serializer.ModelViewSetSerializer
#
#     @action(methods=['GET', 'POST'], detail=False)
#     def get1(self, request):
#         book = self.get_queryset()[0:2]
#         book_serializer = self.get_serializer(book, many=True)
#         return Response({'code': 100, 'msg': '成功', 'data': book_serializer.data})
#
#
# # 登录接口
# class LoginView(APIView):
#     def post(self, request):
#         username = request.data.get('username')
#         password = request.data.get('password')
#         user = models.User.objects.filter(username=username, password=password).first()
#         if user:
#             token = uuid.uuid4()
#             models.UserToken.objects.update_or_create(defaults={'token': token}, user=user)
#             return Response({'code': 100, 'msg': '成功', 'token': token})
#         else:
#             return Response({'code': 101, 'msg': '失败，账号错误或密码错误'})


# 2.认证配合权限（内置）全局
# class BookView(ModelViewSet):
#     queryset = models.Book.objects.all()
#     serializer_class = serializer.ModelViewSetSerializer
#
#     @action(methods=['GET', 'POST'], detail=False)
#     def get1(self, request):
#         book = self.get_queryset()[0:2]
#         book_serializer = self.get_serializer(book, many=True)
#         return Response({'code': 100, 'msg': '成功', 'data': book_serializer.data})
#
#
# # 登录接口
# class LoginView(APIView):
#     authentication_classes = []
#     permission_classes = []
#
#     def post(self, request):
#         username = request.data.get('username')
#         password = request.data.get('password')
#         user = models.User.objects.filter(username=username, password=password).first()
#         if user:
#             token = uuid.uuid4()
#             models.UserToken.objects.update_or_create(defaults={'token': token}, user=user)
#             return Response({'code': 100, 'msg': '成功', 'token': token})
#         else:
#             return Response({'code': 101, 'msg': '失败，账号错误或密码错误'})


# # 3.认证+频率（内置）--- 未登录的用户 登录的用户 进行限制
# class BookView(ModelViewSet):
#     queryset = models.Book.objects.all()
#     serializer_class = serializer.ModelViewSetSerializer
#
#     @action(methods=['GET', 'POST'], detail=False)
#     def get1(self, request):
#         book = self.get_queryset()[0:2]
#         book_serializer = self.get_serializer(book, many=True)
#         return Response({'code': 100, 'msg': '成功', 'data': book_serializer.data})
#
#
# # 登录接口
# class LoginView(APIView):
#     authentication_classes = []
#     permission_classes = []
#
#     def post(self, request):
#         username = request.data.get('username')
#         password = request.data.get('password')
#         user = models.User.objects.filter(username=username, password=password).first()
#         if user:
#             token = uuid.uuid4()
#             models.UserToken.objects.update_or_create(defaults={'token': token}, user=user)
#             return Response({'code': 100, 'msg': '成功', 'token': token})
#         else:
#             return Response({'code': 101, 'msg': '失败，账号错误或密码错误'})


# 4.认证+权限+频率（内置）
class BookView(ModelViewSet):
    authentication_classes = [SessionAuthentication]
    permission_classes = [IsAdminUser]
    throttle_classes = [AnonRateThrottle, UserRateThrottle]
    queryset = models.Book.objects.all()
    serializer_class = serializer.ModelViewSetSerializer

    @action(methods=['GET', 'POST'], detail=False)
    def get1(self, request):
        book = self.get_queryset()[0:2]
        book_serializer = self.get_serializer(book, many=True)
        return Response({'code': 100, 'msg': '成功', 'data': book_serializer.data})


# 登录接口
class LoginView(APIView):
    authentication_classes = []
    permission_classes = []

    def post(self, request):
        username = request.data.get('username')
        password = request.data.get('password')
        user = models.User.objects.filter(username=username, password=password).first()
        if user:
            token = uuid.uuid4()
            models.UserToken.objects.update_or_create(defaults={'token': token}, user=user)
            return Response({'code': 100, 'msg': '成功', 'token': token})
        else:
            return Response({'code': 101, 'msg': '失败，账号错误或密码错误'})

# serializer.py
from rest_framework import serializers
from . import models


class ModelViewSetSerializer(serializers.ModelSerializer):
    class Meta:
        model = models.Book
        fields = '__all__'

# settings.py

REST_FRAMEWORK = {
    # 2.内置登录认证
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.SessionAuthentication',
    ],
    # 2.内置权限
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAdminUser',
    ],
    # 3.内置频率--未登录限制
    'DEFAULT_THROTTLE_CLASSES': (
        'rest_framework.throttling.AnonRateThrottle',
    ),
    'DEFAULT_THROTTLE_RATES': {
        'anon': '3/m',
    },
    # 3.登录与未登录限制
    'DEFAULT_THROTTLE_CLASSES': (
        'rest_framework.throttling.AnonRateThrottle',
        'rest_framework.throttling.UserRateThrottle'  # 登录频率
    ),
    'DEFAULT_THROTTLE_RATES': {
        'user': '5/m',
        'anon': '3/m',
    },
    # 4. 局部
    'DEFAULT_THROTTLE_RATES': {
        'user': '5/m',
        'anon': '3/m',
    }
}