Django Rest framework之认证的实现代码

urlpatterns = [
  url(r'^admin/', admin.site.urls),
  url(r'^index/', views.index)
]

def index(request):
  return render(request, 'index.html')

urlpatterns = [
  url(r'^admin/', admin.site.urls),
  url(r'^index/', views.IndexView.as_view())   # 执行类后面的as_view()方法，是父类里面的方法
]

from django.views import View


class IndexView(View):
 
  # 以get形式访问会执行get函数,一般情况下获取数据
  def get(self, *args, **kwargs): 
    return HttpResponse('666')
   
  # 以post形式访问的话会执行post函数，一般情况下发送数据
  def post(self, *args, **kwargs): 
    return HttpResponse('999')

class View:

  http_method_names = ['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'trace'] # 支持的各种http方法

  def __init__(self, **kwargs):
     pass

  @classonlymethod
  def as_view(cls, **initkwargs): # url路由匹配进入as_view方法
    def view(request, *args, **kwargs):
      return self.dispatch(request, *args, **kwargs) # 返回dispath方法
    return view

  def dispatch(self, request, *args, **kwargs): # dispath方法是drf的关键，dispath方法会通过反射，通过请求的方法，分发到各个视图类的方法中
    pass

class A:
  def get_name(self):
    return self.name
  def return_name(self):
    if hasattr(self, 'name'):
      return 'name: ' + getattr(self, 'name', None)  
  
  
class B(A):
  name = "b"
  def get_name(self):
    return self.name
  
b = B()
b.get_name() # 输出B
b.return_name() # 输出name: B，这里由于B类中没有实现return_name方法，实例化B得到b之后，会调用父类A中的return_name方法，hasattr方法会查找类中是否有name属性，这里虽然在类A中没有，会向下查找B类中是否有name属性，然后返回'name: ' + getattr(self, 'name', None) ，也就是name：b

class X(object):
  def f(self):
    print( 'x')

class A(X):
  def f(self):
    print('a')

  def extral(self):
    print('extral a')

class B(X):
  def f(self):
    print('b')

  def extral(self):
    print( 'extral b')

class C(A, B, X):
  def f(self):
    super(C, self).f()
    print('c')

print(C.mro())

c = C()
c.f()
c.extral()

class Bird:
  def fly(self):
    print('fly')

class Fish:
  def swim(self):
    print('swim')
    
class Horse:
  def run(self):
    print('run')
    
    
class Something(Bird, Fish, Horse):
  pass


s = Something()
s.fly()
s.swim()
s.run()

class BirdMixin:
  def fly(self):
    print('fly')

class FishMixin:
  def swim(self):
    print('swim')
    
class Horse:
  def run(self):
    print('run')
    
    
class Something(BirdMixin, FishMixin, Horse):
  pass

class CreateAPIView(mixins.CreateModelMixin,
          GenericAPIView):
  pass


class ListAPIView(mixins.ListModelMixin,
         GenericAPIView):
  pass


class RetrieveAPIView(mixins.RetrieveModelMixin,
           GenericAPIView):
  pass

from django.db import models


class UserInfo(models.Model):
  USER_TYPE = (
    (1,'普通用户'),
    (2,'VIP'),
    (3,'SVIP')
  )

  user_type = models.IntegerField(choices=USER_TYPE， default=1)
  username = models.CharField(max_length=32)
  password = models.CharField(max_length=64)

class UserToken(models.Model):
  user = models.OneToOneField(UserInfo,on_delete=models.CASCADE)
  token = models.CharField(max_length=64)

python manage.py makemigrations
python manage.py migrate

from django.contrib import admin
from django.urls import path
from django.conf.urls import url

from api.views import AuthView


urlpatterns = [
  path('admin/', admin.site.urls),
  url(r'^api/v1/auth/$', AuthView.as_view())
]

from django.shortcuts import render, HttpResponse
from django.http import JsonResponse
from django.views import View

from api import models


def md5(user):
  import hashlib
  import time

  # 当前时间，相当于生成一个随机的字符串
  ctime = str(time.time())

  # token加密
  m = hashlib.md5(bytes(user, encoding='utf-8'))
  m.update(bytes(ctime, encoding='utf-8'))
  return m.hexdigest()


class AuthView(View):

  def get(self, request, *args, **kwargs):
    ret = {'code': 1000, 'msg': 'success', 'name': '偷偷'}
    ret = json.dumps(ret, ensure_ascii=False)

    return HttpResponse(ret)

  def post(self, request, *args, **kwargs):
    ret = {'code': 1000, 'msg': None}
    try:
      user = request.POST.get('username')
      pwd = request.POST.get('password')
      obj = models.UserInfo.objects.filter(username=user).first()

      if not obj:
        # 如果用户第一次登陆则创建用户
        obj = models.UserInfo.objects.create(username=user, password=pwd)
        ret['code'] = 1001
        ret['msg'] = '创建用户成功'

      # 为用户创建token
      token = md5(user)
      # 存在就更新，不存在就创建
      models.UserToken.objects.update_or_create(user=obj, defaults={'token': token})
      ret['token'] = token
    except Exception as e:
      ret['code'] = 1002
      ret['msg'] = '请求异常'
    return JsonResponse(ret)

from rest_framework.views import APIView
from django.http import JsonResponse
from rest_framework.authentication import BaseAuthentication
from rest_framework import exceptions

from api import models


# 这里直接表示订单
ORDER_DICT = {
  1:{
    'name':'apple',
    'price':15
  },
  2:{
    'name':'狗子',
    'price':100
  }
}


class FirstAuthenticate(BaseAuthentication):
  # 添加自己的认证逻辑，基类BaseAuthentication中有一个必须要重写的接口

  def authenticate(self, request):
    pass

  def authenticate_header(self, request):
    pass


class MyAuthenticate(BaseAuthentication):
  # 添加自己的认证逻辑，基类BaseAuthentication中有两个必须要重写的接口

  def authenticate(self, request):
    token = request._request.GET.get('token') # 获取token参数
    token_obj = models.UserToken.objects.filter(token=token).first() # 在数据库UserToken查找是否有相应的对象
    if not token_obj: # 如果没有，则报错
      raise exceptions.AuthenticationFailed('用户认证失败')
    return (token_obj.user, token_obj) # 这里需要返回两个对象，分别是UserInfo对象和UserToken对象
 
  def authenticate_header(self, request): # 返回相应头信息
     pass


class OrderView(APIView):
  # 用户想要获取订单，就要先通过身份认证、
  # 这里的authentication_classes 就是用户的认证类
  authentication_classes = [FirestAuthenticate， MyAuthenticate]
  
  def get(self, request, *args, **kwargs):
    ret = {
      'code': 1024,
      'msg': '订单获取成功',
    }
    try:
      ret['data'] = ORDER_DICT
    except Exception as e:
      pass
    return JsonResponse(ret)

REST_FRAMEWORK = {
  'DEFAULT_AUTHENTICATION_CLASSES': ['api.utils.authenticate.FirstAuthenticate', 'api.utils.authenticate.MyAuthenticate'],
}

class OrderView(APIView):
  # 这里没有重写authentication_classes属性，则使用全局配置的authentication_classes，即在setting.py中的authentication_classes。
  def get(self, request, *args, **kwargs):
     pass

class CartView(APIView):
   authentication_classes = [authenticate.FirstAuthenticate,] # authentication_classes中只包含FirstAuthenticate，则只通过他的认证
  def get(self, request, *args, **kwargs):
     pass

class UserInfoView(APIView):
  authentication_classes = [] # authentication_classes为空，则不会进行认证
  def get(self, request, *args, **kwargs):
     pass

def _authenticate(self):
    """
    Attempt to authenticate the request using each authentication instance
    in turn.
    """
    for authenticator in self.authenticators: # 找到 authentication_classes，并循环每一个认证类
      try:
        user_auth_tuple = authenticator.authenticate(self) # 调用认证类的authenticate方法，也就是上面我们实现的方法，并将返回值赋值给user_auth_tuple
      except exceptions.APIException:
        self._not_authenticated() # 如果出错调用_not_authenticated，方法，下面会说到
        raise

      if user_auth_tuple is not None: # 如果authenticate方法的返回值不为空
        self._authenticator = authenticator
        self.user, self.auth = user_auth_tuple # 这也就是为什么认证类的authenticate方法会返回两个对象的原因
        return

    self._not_authenticated() # 如果没有通过认证，则调用_not_authenticated方法

  def _not_authenticated(self):
    """
    Set authenticator, user & authtoken representing an unauthenticated request.

    Defaults are None, AnonymousUser & None.
    """
    self._authenticator = None

    if api_settings.UNAUTHENTICATED_USER:
      self.user = api_settings.UNAUTHENTICATED_USER()
    else:
      self.user = None

    if api_settings.UNAUTHENTICATED_TOKEN:
      self.auth = api_settings.UNAUTHENTICATED_TOKEN()
    else:
      self.auth = None

REST_FRAMEWORK = {
  'DEFAULT_AUTHENTICATION_CLASSES': ['api.utils.authenticate.FirstAuthenticate', 'api.utils.authenticate.MyAuthenticate'],
  "UNAUTHENTICATED_USER": None, # 匿名，request.user = None
  "UNAUTHENTICATED_TOKEN": None,# 匿名，request.auth = None
}