day80-<权限组件>-基本流程以及部分代码

from django.db import models


class Menu(models.Model):
    """
    表层菜单-->点击展开-->点击收起
    """
    title = models.CharField(max_length=32)
    icon = models.CharField(max_length=32, null=True, blank=True)

    def __str__(self):
        return self.title

    class Meta:
        verbose_name = '收合表层菜单'
        verbose_name_plural = '收合表层菜单'


class Permission(models.Model):
    """
    权限表(URL)
    """
    title = models.CharField(max_length=32, verbose_name='URL名称')
    URL = models.CharField(max_length=32, verbose_name='权限URL')
    # is_menu = models.BooleanField(verbose_name='是否具是菜单', default=False)
    # icon = models.CharField(max_length=32, null=True, blank=True)
    # 并不是所有权限都在左侧伸缩表单里面，所以可以不指定外键，也可以不填
    menu = models.ForeignKey(to='Menu', null=True, blank=True)

    class Meta:
        verbose_name_plural = '权限表'
        verbose_name = '权限表'

    def __str__(self):
        return self.title


class Role(models.Model):
    """
    角色表(角色和权限之间多对多)
    """
    role_name = models.CharField(max_length=32, verbose_name='角色(职务)名称')
    permissions = models.ManyToManyField(to='Permission', verbose_name='所拥有的权限', blank=True)

    class Meta:
        verbose_name = '角色(权限)表'
        verbose_name_plural = '角色(权限)表'

    def __str__(self):
        return '{}-{}'.format(self.role_name, self.permissions)


class User(models.Model):
    """
    用户表(用户和角色之间多对多)
    """
    name = models.CharField(max_length=32, verbose_name='用户名')
    password = models.CharField(max_length=32, verbose_name='密码')
    roles = models.ManyToManyField(to='Role', verbose_name='角色(职务)', blank=True)

    class Meta:
        verbose_name = '用户表'
        verbose_name_plural = '用户表'

    def __str__(self):
        return self.name

from django.conf import settings


def ini_session(request, user, username):
    """
    将权限写进session
    :return:
    """
    # 获取权限列表
    permission_list = \
        user.roles.filter(permissions__URL__isnull=False).values(
            'permissions__URL',  # 权限的url
            'permissions__title',  # 权限 url 的名称
            'permissions__menu_id',
            'permissions__menu__title',  # 可以做二级菜单的url的一级菜单的名称
            'permissions__menu__icon',  # 可以做二级菜单的url的一级菜单的图标
        ).distinct()

    # 查看当前用户都有哪些权限
    print('用户权限总列表{}'.format(permission_list))
    # 空列表接收权限
    all_permissions = []
    # 空字典接收菜单
    all_menus = {}
    for i in permission_list:
        # 添加权限进列表
        all_permissions.append(i['permissions__URL'])
        # 添加菜单列表
        menu_id = i['permissions__menu_id']
        if not menu_id:
            continue
        if menu_id not in all_menus:
            all_menus[menu_id] = {  # 如果id不在里面就新建
                'title': i['permissions__menu__title'],  # 伸缩菜单名
                'icon': i['permissions__menu__icon'],  # 伸缩菜单图标
                'children': [
                    {
                        'title': i['permissions__title'],  # 伸缩菜单 子url 名称
                        'url': i['permissions__URL']  # 伸缩菜单 子url
                    }
                ]
            }
        else:  # 如果id已经在里面，就追加children
            all_menus[menu_id]['children'].append(
                {
                    'title': i['permissions__title'],  # 伸缩菜单 子url 名称
                    'url': i['permissions__URL']  # 伸缩菜单 子url
                }
            )

    print(all_menus)
    # 写权限进session
    request.session[settings.PERMISSION_SESSION_KEY] = all_permissions
    # 写菜单进session
    request.session[settings.MENU_KEY] = all_menus
    # 写用户名进session
    request.session[settings.USERNAME] = username

import re

from django.conf import settings
from django.shortcuts import render, HttpResponse
from django.utils.deprecation import MiddlewareMixin


class PermissionMiddleware(MiddlewareMixin):
    """
    权限中间件request
    """

    @staticmethod
    def process_request(request):
        current_url = request.path_info

        # step1:首先校验白名单
        for i in settings.WHITE_URL_LIST:
            if re.match(i, current_url):
                return
            
        # step2:非白名单URL访问对权限进行校验
        permission_list = request.session.get(settings.PERMISSION_SESSION_KEY, '')
        menu_list = request.session.get(settings.MENU_KEY, '')
        # print('中间件校验，当前用户的权限是{}'.format(permission_list))
        # [print('中间件校验，当前用户{}的菜单是{}'.format(request.session.get(settings.USERNAME, ''), i)) for i in menu_list]

        for url in permission_list:
            # 获取到每可以访问的正则 URL
            permission_url = ''.join(url)
            # 正则 URL 匹配当前URL
            ret = re.match('^{}$'.format(permission_url), current_url)
            if ret:
                return
        return HttpResponse('没有权限访问！')
    pass