Django官方文档小结(四) -- 用户及权限

Python3.7.3
Django==2.0.7

from django.contrib.auth.models import AbstractUser

class UserProfile(AbstractUser):
    # ...

AUTH_USER_MODEL = 'app名.UserProfile'

>>> models.UserProfile.objects.create_user(username="cox",password="cox123456")
<UserProfile: cox>

>>> models.UserProfile.objects.create_superuser(username="admin",password="cox123456",email="job@minhung.me")
<UserProfile: admin>

>>> user_obj = models.UserProfile.objects.get(username='cox')
>>> user_obj.set_password('new password')
>>> user_obj.save()

from django.contrib.auth import authenticate
user = authenticate(username='cox', password='cox123456')
if user:
    # 用户名密码匹配正确
else:
    # 用户名密码不匹配 

from django.contrib.auth.backends import ModelBackend
from django.db.models import Q
from app import models

class CustomBackend(ModelBackend):
    """
    自定义用户验证规则
    """
    def authenticate(self, username=None, password=None, **kwargs):
        try:
            user = models.userprofile.objects.get(Q(username=username)|Q(email=username))
            if user.check_password(password):
                return user
        except Exception as e:
            print("用户登录验证异常except:", e)
            return None

# 路径是CustomBackend的路径
AUTHENTICATION_BACKENDS = (
    'django_restframework.authenticates.authenticate.CustomBackend',
)

from django.contrib.auth.models import Permission

class Permission(models.Model):
    name = models.CharField(max_length=255) # 权限名 
    content_type = models.ForeignKey(
        ContentType,
        models.CASCADE,
    ) # 内容类型 
    codename = models.CharField(max_length=100) 

>>> c_type = ContentType.objects.get(app_label='app')
>>> Permission.objects.create(name='text per',codename='per1',content_type=c_type)
<Permission: app | user | text per>

>>> per2 = Permission.objects.create(name='text per2',codename='per2',content_type=c_type)
>>> user_obj.user_permissions.add(per2)

>>> user_obj.user_permissions.all()
<QuerySet [<Permission: app | user | text per>, <Permission: app | user | text per2>]>

>>> user_obj.user_permissions.all()
<QuerySet [<Permission: app | user | text per>, <Permission: app | user | text per2>]>
>>> user_obj.user_permissions.clear()
>>> user_obj.user_permissions.all()
<QuerySet []>

>>> Permission.objects.all()
<QuerySet [<Permission: admin | log entry | Can add log entry>, <Permission: admin | log entry | Can change log entry>, <Permission: admin | log entry | Can delete log entry>, <Permission: app | user | Can add user>, <Permission: app | user | Can change user>, <Permission: app | user | Can delete user>, <Permission: app | user | text per>, <Permission: app | user | text per2>, <Permission: auth | group | Can add group>, <Permission: auth | group | Can change group>, <Permission: auth | group | Can delete group>, <Permission: auth | permission | Can add permission>, <Permission: auth | permission | Can change permission>, <Permission: auth | permission | Can delete permission>, <Permission: contenttypes | content type | Can add content type>, <Permission: contenttypes | content type | Can change content type>, <Permission: contenttypes | content type | Can delete content type>, <Permission: sessions | session | Can add session>, <Permission: sessions | session | Can change session>, <Permission: sessions | session | Can delete session>]>

from django.contrib.auth.models import Group

class Group(models.Model):
    name = models.CharField(max_length=80, unique=True) # 权限组名 
    permissions = models.ManyToManyField(
        Permission,
        verbose_name=_('permissions'),
        blank=True,
    ) # 权限组对应的权限

>>> from django.contrib.auth.models import Group
>>> g_player = Group.objects.create(name='player')
>>> g_player
<Group: player>

>>> g_player.permissions.add(per1)
>>> g_player.permissions.all()
<QuerySet [<Permission: app | user | text per>]>
>>> g_player.permissions.add(per2)
>>> g_player.permissions.all()
<QuerySet [<Permission: app | user | text per>, <Permission: app | user | text per2>]>

>>> g_player.permissions.clear()
>>> g_player.permissions.all()
<QuerySet []>

>>> user_obj.groups.add(g_player) # user_obj用户被添加到g_player权限组中
或 >>> g_player.user_set.add(user_obj) # 一样的效果
>>> user_obj.user_permissions.all()
<QuerySet []> # 为什么是空的???
# 因为之前已经把用户权限全部清空,用户被加到权限组后,
# 会拥有权限组的权限,但是并不是自己的权限,在数据库中没有记录,数据库只会记录用户在哪个权限组

>>> g_player.permissions.all() # 查看权限组g_player中的权限
<QuerySet [<Permission: app | user | text per>]> # 权限组g_player拥有per1权限
>>> user_obj.has_perm('app.per1') # 校验用户是否拥有per1权限 -- content_type.codename
True
>>> user_obj.has_perm('app.per2')
False

>>> user_obj.groups.remove(g_player)
或 >>> g_player.user_set.remove(user_obj)
>>> user_obj.groups.all()
<QuerySet []>

>>> user_obj.groups.clear()
>>> user_obj.groups.all()
<QuerySet []>

g_player.user_set.clear()