django-auth-utils 0.1.1

权限检查视图

ObjectPermissionRequiredMixin视图结合了Django的PermissionRequiredMixin和SingleObjectMixin视图，并针对查找的对象执行权限检查。

像基类一样使用它

from auth_utils.views import ObjectPermissionRequiredMixin


class ArticleDetail(ObjectPermissionRequiredMixin, generic.DetailView):
    model = Article
    permission_required = ['news.read_article']


class ArticleUpdate(ObjectPermissionRequiredMixin, generic.UpdateView):
    model = Article
    permission_required = ['news.change_article']

模板中的权限检查

加载模板标签库

{% load auth_utils %}

perms过滤器允许使用方便的语法检查对象级别权限

{% if perm in user|perms:object %} ... {% endif %}

object参数是可选的。如果省略，则检查全局权限，类似于Django的perms对象。

示例

{% if 'news.read_article' in user|perms:article %}
    {{ article.text }}
{% else %}
    You do not have permission to read this article.
{% endif %}


{% if 'news.change_article' in user|perms:article %}
    <a href="...">Edit article</a>
{% endif %}

{% if 'news.delete_article' in user|perms:article %}
    <a href="...">Delete article</a>
{% endif %}

该库提供了 can_change 和 can_delete 简写，用于检查Django的默认 app.change_model 和 app.delete_model 模型权限。

{% if user|can_change:article %} <a href="...">Edit</a> {% endif %}
{% if user|can_delete:article %} <a href="...">Delete</a> {% endif %}

BaseAuthorizationBackend

此基类提供了Django 认证后端 运作所需的所有样板代码，但本身不执行任何用户认证或权限授权。

这使得编写只实现它们感兴趣的后端方法的 自定义授权策略 变得容易。

from auth_utils.backends import BaseAuthorizationBackend


class ArticleEditPolicy(BaseAuthorizationBackend):
    """
    Allow authors to change and delete their own articles.
    """

    def get_user_permissions(self, user_obj, obj=None):
        is_author = isinstance(obj, Article) and article.author == user_obj
        if user_obj.is_active and is_author:
            return {'news.change_article', 'news.delete_article'}
        else:
            return set()


class GuestAccessPolicy(BaseAuthorizationBackend):
    """
    Allow anonymous users to read non-premium articles.
    """

    def get_user_permissions(self, user_obj, obj=None):
        guest_readable = isinstance(obj, Article) and not article.is_premium
        if not user_obj.is_authenticated() and guest_readable:
            return {'news.read_article'}
        else:
            return set()

一旦定义，这些策略就可以在 AUTHENTICATION_BACKENDS 中启用。

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',

    # Custom authorization policies
    'news.auth.ArticleEditPolicy',
    'news.auth.GuestAccessPolicy',
]