课程视频（免费）：https://www.imooc.com/learn/1274
课程代码：https://github.com/liaogx/drf-tutorial

课程介绍

DRF基本配置

  1. INSTALLED_APPS = [
  2.     'rest_framework',
  3.     'rest_framework.authtoken',  
  4.     # DRF自带的Token认证功能，会生成一张Token表，记得migrate一下
  5. ]
  10. REST_FRAMEWORK = {
  11.     "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
  12.     "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
  13.     "PAGE_SIZE": 50,
  14.     "DATETIME_FORMAT": "%Y-%m-%d %H:%M:%S",
  15.     "DEFAULT_RENDERER_CLASSES": [  # response渲染器
  16.         "rest_framework.renderers.JSONRenderer",
  17.         "rest_framework.renderers.BrowsableAPIRenderer",
  18.     ],
  19.     "DEFAULT_PARSER_CLASSES": [  # request.data解析器
  20.         "rest_framework.parsers.JSONParser",  # 解析前端传来的JSON
  21.         "rest_framework.parsers.FormParser",  # 解析前端传来的表单
  22.         "rest_framework.parsers.MultiPartParser",  # 解析前端传来的文件
  23.     ],
  24.     "DEFAULT_PERMISSION_CLASSES": [
  25.         "rest_framework.permissions.IsAuthenticated",
  26.     ],
  27.     "DEFAULT_AUTHENTICATION_CLASSES": [
  28.         "rest_framework.authentication.BasicAuthentication",  # 基本认证：用户名+密码
  29.         "rest_framework.authentication.SessionAuthentication",
  30.         "rest_framework.authentication.TokenAuthentication",  # 如果加了这个，app中就必须要有'rest_framework.authtoken'
  31.     ]
  32. }
  34. # 可以导入相关模块后分析源码
  35. from rest_framework import renderers, parsers,  permissions, \
  36.     authentication, pagination, schemas

在settings.py中设置的REST_FRAMEWORK是全局生效的。比如上面设置了DEFAULT_PERMISSION_CLASSES，将来不管访问什么资源都需要登录认证。

学习思路：上面的很多配置对应的DRF中相关的类，均可以导入后查看源码来加深理解。

  1. urlpatterns = [
  2.     ...
  3.     path('api-auth/', include('rest_framework.urls'))  # DRF的登录退出
  4. ]

DRF学习地图（20个知识点）

实战教程-教师课程管理系统 - 图1

实战开始

1.创建模型

创建app： course
编写模型：

  1. from django.conf import settings
  2. from django.db import models
  5. class Course(models.Model):
  6.     name = models.CharField(max_length=255, unique=True, help_text="课程名称", verbose_name="名称")
  7.     introduction = models.TextField(help_text="课程简介", verbose_name="简介")
  8.     teacher = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE,
  9.                                 help_text="课程讲师", verbose_name="讲师")
  10.     price = models.DecimalField(max_digits=6, decimal_places=2, help_text="课程价格", verbose_name="价格")
  11.     created_at = models.DateTimeField(auto_now_add=True, verbose_name="创建时间")
  12.     updated_at = models.DateTimeField(auto_now=True, verbose_name="更新时间")
  14.     class Meta:
  15.         verbose_name = "课程信息"
  16.         verbose_name_plural = verbose_name
  17.         ordering = ("price",)
  19.     def __str__(self):
  20.         return self.name

将模型注册到admin：

  1. from django.contrib import admin
  3. from .models import Course
  6. @admin.register(Course)
  7. class CourseAdmin(admin.ModelAdmin):
  8.     list_display = ("name", "introduction", "teacher", "price")
  9.     search_fields = list_display
  10.     list_filter = list_display

2.创建序列化器

  1. from django.contrib.auth.models import User
  2. from rest_framework import serializers
  4. from .models import Course
  7. class UserSerializer(serializers.ModelSerializer):
  8.     class Meta:
  9.         model = User
  10.         fields = '__all__'
  13. class CourseSerializer(serializers.ModelSerializer):
  14.     teacher = serializers.ReadOnlyField(source='teacher.username')  # 外键字段 只读
  16.     class Meta:
  17.         model = Course  # 写法和上面的CourseForm类似
  18.         # exclude = ('id', )  # 注意元组中只有1个元素时不能写成("id")
  19.         # fields = ('id', 'name', 'introduction', 'teacher', 'price', 'created_at', 'updated_at')
  20.         fields = '__all__'
  21.         depth = 2  # 【重要！！！】对于外键字段的序列化，可以指定遍历的深度
  24. """超链接API"""
  25. # class CourseSerializer(serializers.HyperlinkedModelSerializer):
  26. #     teacher = serializers.ReadOnlyField(source='teacher.username')
  27. #
  28. #     class Meta:
  29. #         model = Course
  30. #         # url是默认值，可在settings.py中设置URL_FIELD_NAME使全局生效
  31. #         fields = ('id', 'url', 'name', 'introduction', 'teacher', 'price', 'created_at', 'updated_at')

3.视图-开发Restful API接口

Django原生视图API的不足：

分页、排序、认证、权限、限流。
这些Restful API的标配Django几乎啥都没有，都需要自己从零到一实现，太难了。。。
于是就有了DRF的视图。

4种开发方式

image.png
在开始视图编写之前，先注册一下根urls.py

  1. from django.contrib import admin
  2. from django.urls import path, include
  4. urlpatterns = [
  5.     path('admin/', admin.site.urls),
  6.     path('api-auth/', include('rest_framework.urls')),
  7.     path("course/", include("course.urls")),
  8. ]

（1）函数式编程

  1. from rest_framework import status
  2. from rest_framework.decorators import api_view
  3. from rest_framework.response import Response
  4. from .models import Course
  5. from .serializers import CourseSerializer
  7. @api_view(["GET", "POST"])
  8. def course_list(request):
  9.     """
  10.     获取所有课程信息或新增一个课程
  11.     :param request:
  12.     :return:
  13.     """
  14.     if request.method == "GET":
  15.         s = CourseSerializer(instance=Course.objects.all(), many=True)
  16.         return Response(data=s.data, status=status.HTTP_200_OK)
  18.     elif request.method == "POST":
  19.         s = CourseSerializer(data=request.data)  # 部分更新用partial=True属性
  20.         if s.is_valid():
  21.             s.save(teacher=request.user)  # 这里填充teacher属性哦！
  22.             return Response(data=s.data, status=status.HTTP_201_CREATED)
  23.         return Response(s.errors, status=status.HTTP_400_BAD_REQUEST)
  26. @api_view(["GET", "PUT", "DELETE"])
  27. def course_detail(request, pk):
  28.     """
  29.     获取、更新、删除一个课程
  30.     :param request:
  31.     :param pk:
  32.     :return:
  33.     """
  34.     try:  # 常规操作，先看看有没有响应数据
  35.         course = Course.objects.get(pk=pk)
  36.     except Course.DoesNotExist:  # 如果没有，返回404和错误信息
  37.         return Response(data={"msg": "没有此课程信息"}, status=status.HTTP_404_NOT_FOUND)
  38.     else:  # 如果有，再进行具体操作
  39.         if request.method == "GET":
  40.             s = CourseSerializer(instance=course)
  41.             return Response(data=s.data, status=status.HTTP_200_OK)
  43.         elif request.method == "PUT":
  44.             s = CourseSerializer(instance=course, data=request.data)
  45.             if s.is_valid():
  46.                 s.save()
  47.                 return Response(data=s.data, status=status.HTTP_200_OK)
  48.             return Response(data=s.errors, status=status.HTTP_400_BAD_REQUEST)
  49.         elif request.method == 'PATCH':
  50.             s = CourseSerializer(instance=course, data=request.data, partial=True)
  51.             if s.is_valid():
  52.                 s.save()
  53.                 return Response(data=s.data, status=status.HTTP_200_OK)
  54.             return Response(data=s.errors, status=status.HTTP_400_BAD_REQUEST)
  55.         elif request.method == "DELETE":
  56.             course.delete()
  57.             return Response(status=status.HTTP_204_NO_CONTENT)
  1. from django.urls import path
  2. from course import views
  4. urlpatterns = [
  5.     # Function Based View
  6.     path("fbv/list/", views.course_list, name="fbv-list"),
  7.     path("fbv/detail/<int:pk>/", views.course_detail, name="fbv-detail"),
  8. ]

（2）类视图

  1. from rest_framework import status
  2. from rest_framework.response import Response
  3. from rest_framework.views import APIView
  5. from .models import Course
  6. from .serializers import CourseSerializer
  9. """二、 类视图 Class Based View"""
  12. class CourseList(APIView):
  14.     def get(self, request):
  15.         queryset = Course.objects.all()
  16.         s = CourseSerializer(instance=queryset, many=True)
  17.         # s = CourseSerializer(instance=queryset.first())
  18.         return Response(s.data, status=status.HTTP_200_OK)
  20.     def post(self, request):
  21.         s = CourseSerializer(data=request.data)  # 这里的data是前端返回的数据，在return前要调用.is_valid()方法校验
  22.         if s.is_valid():
  23.             s.save(teacher=self.request.user)  # 注意：这里依然要用代码确定teacher哦！！！
  24.             # 分别是<class 'django.http.request.QueryDict'> <class 'rest_framework.utils.serializer_helpers.ReturnDict'>
  25.             print(type(request.data), type(s.data))
  26.             return Response(data=s.data, status=status.HTTP_201_CREATED)
  27.         return Response(data=s.errors, status=status.HTTP_400_BAD_REQUEST)
  30. class CourseDetail(APIView):
  32.     @staticmethod
  33.     def get_object(pk):
  34.         try:
  35.             return Course.objects.get(pk=pk)
  36.         except Course.DoesNotExist:
  37.             return
  39.     def get(self, request, pk):
  40.         obj = self.get_object(pk=pk)
  41.         if not obj:
  42.             return Response(data={"msg": "没有此课程信息"}, status=status.HTTP_404_NOT_FOUND)
  44.         s = CourseSerializer(instance=obj)
  45.         return Response(s.data, status=status.HTTP_200_OK)
  47.     def put(self, request, pk):
  48.         obj = self.get_object(pk=pk)
  49.         if not obj:
  50.             return Response(data={"msg": "没有此课程信息"}, status=status.HTTP_404_NOT_FOUND)
  52.         s = CourseSerializer(instance=obj, data=request.data)
  53.         if s.is_valid():
  54.             s.save()
  55.             return Response(data=s.data, status=status.HTTP_200_OK)
  56.         return Response(data=s.errors, status=status.HTTP_400_BAD_REQUEST)
  58.     def delete(self, request, pk):
  59.         obj = self.get_object(pk=pk)
  60.         if not obj:
  61.             return Response(data={"msg": "没有此课程信息"}, status=status.HTTP_404_NOT_FOUND)
  62.         obj.delete()
  63.         return Response(status=status.HTTP_204_NO_CONTENT)
  1. from django.urls import path
  2. from course import views
  5. urlpatterns = [
  6.     # Class Based View
  7.     path("cbv/list/", views.CourseList.as_view(), name="cbv-list"),
  8.     path("cbv/detail/<int:pk>/", views.CourseDetail.as_view(), name="cbv-detail"),
  9. ]

（3）通用类视图

  1. from rest_framework import generics
  3. from .models import Course
  4. from .serializers import CourseSerializer
  6. """三、 通用类视图 Generic Class Based View"""
  9. class GCourseList(generics.ListCreateAPIView):
  10.     queryset = Course.objects.all()
  11.     serializer_class = CourseSerializer
  13.     def perform_create(self, serializer):
  14.         """
  15.         重写该方法的来龙去脉
  17.         1、通过查看ListCreateAPIView源码可知，该类的创建功能来自于对父类mixins.CreateModelMixin的继承
  18.         2、继续查看该父类源码，发现它实现创建功能的方法为create()方法
  19.         3、阅读create()方法，发现其执行保存的逻辑在perform_create()方法中
  21.         故：如果想自定义保存操作，只需要重写perform_create()方法即可。
  22.         :param serializer:
  23.         :return:
  24.         """
  25.         serializer.save(teacher=self.request.user)
  28. class GCourseDetail(generics.RetrieveUpdateDestroyAPIView):
  29.     queryset = Course.objects.all()
  30.     serializer_class = CourseSerializer
  1. from django.urls import path
  2. from course import views
  5. urlpatterns = [
  6.     # Generic Class Based View
  7.     path("gcbv/list/", views.GCourseList.as_view(), name="gcbv-list"),
  8.     path("gcbv/detail/<int:pk>/", views.GCourseDetail.as_view(), name="gcbv-detail"),
  9. ]

使用Apifox请求一下http://127.0.0.1:8000/course/gcbv/list：

  1. {
  2.     "count": 4,
  3.     "next": null,
  4.     "previous": null,
  5.     "results": [
  6.         {
  7.             "id": 4,
  8.             "teacher": "admin",
  9.             "name": "及于需重两务",
  10.             "introduction": "nostrud adipisicing nulla",
  11.             "price": "36.00",
  12.             "created_at": "2022-05-09 15:40:56",
  13.             "updated_at": "2022-05-09 15:40:56"
  14.         },
  15.         {
  16.             "id": 2,
  17.             "teacher": "kkk",
  18.             "name": "给前端同学的设计模式精讲课",
  19.             "introduction": "从“写代码”到“写好代码”到“设计代码”，不仅是技术的提升，更是编程思维的提升，其中最关键的就是设计模式。但很多人想学习设计模式时，往往是查到的资料一堆，有用的知识少见，学得云里雾里，难以实践。本课从23种设计模式中精选前端常用的7种设计模式，利用场景化实例教学，让想学的人真正学明白、会应用、能实践。",
  20.             "price": "56.87",
  21.             "created_at": "2022-05-09 11:57:14",
  22.             "updated_at": "2022-05-09 11:57:14"
  23.         },
  24.         {
  25.             "id": 3,
  26.             "teacher": "admin",
  27.             "name": "色体中华",
  28.             "introduction": "ullamco anim labore exercitation laboris",
  29.             "price": "90.00",
  30.             "created_at": "2022-05-09 15:40:07",
  31.             "updated_at": "2022-05-09 15:40:07"
  32.         },
  33.         {
  34.             "id": 1,
  35.             "teacher": "yyy",
  36.             "name": "基于 Vue3 ，打造前台+中台通用提效解决方案",
  37.             "introduction": "写了那么多低效的前台项目，如何高效开发，避免无谓加班？本课程通过带你学习42 种前台常见业务模型的构建原理、15 种中台通用组件与一身的通用型项目，为你之后遇到每一个前台功能提供可操作的实现方案与物料库。掌握这些，前端开发事半功倍真的不是梦！",
  38.             "price": "99.87",
  39.             "created_at": "2022-05-09 10:57:27",
  40.             "updated_at": "2022-05-09 12:07:26"
  41.         }
  42.     ]
  43. }

可以发现，通用类视图对返回结果也做了一定的封装，count表示数据条数，previous和next是用于分页的，真正的数据放在了result里面。
如果我修改每页大小为两条数据，

  1. REST_FRAMEWORK = {
  2.     "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination",
  3.     "PAGE_SIZE": 2,
  4. }

返回的结果是下面这样的：

  1. {
  2.     "count": 4,
  3.     "next": "http://127.0.0.1:8000/course/gcbv/list/?page=2",
  4.     "previous": null,
  5.     "results": [
  6.         {
  7.             "id": 4,
  8.             "teacher": "admin",
  9.             "name": "及于需重两务",
  10.             "introduction": "nostrud adipisicing nulla",
  11.             "price": "36.00",
  12.             "created_at": "2022-05-09 15:40:56",
  13.             "updated_at": "2022-05-09 15:40:56"
  14.         },
  15.         {
  16.             "id": 2,
  17.             "teacher": "kkk",
  18.             "name": "给前端同学的设计模式精讲课",
  19.             "introduction": "从“写代码”到“写好代码”到“设计代码”，不仅是技术的提升，更是编程思维的提升，其中最关键的就是设计模式。但很多人想学习设计模式时，往往是查到的资料一堆，有用的知识少见，学得云里雾里，难以实践。本课从23种设计模式中精选前端常用的7种设计模式，利用场景化实例教学，让想学的人真正学明白、会应用、能实践。",
  20.             "price": "56.87",
  21.             "created_at": "2022-05-09 11:57:14",
  22.             "updated_at": "2022-05-09 11:57:14"
  23.         }
  24.     ]
  25. }

牛逼吧，超链接字段！

（4）视图集

  1. from rest_framework import viewsets
  3. from .models import Course
  4. from .serializers import CourseSerializer
  6. """四、 DRF的视图集viewsets"""
  9. class CourseViewSet(viewsets.ModelViewSet):
  10.     queryset = Course.objects.all()
  11.     serializer_class = CourseSerializer
  13.     def perform_create(self, serializer):
  14.         serializer.save(teacher=self.request.user)
  1. from django.urls import path
  2. from course import views
  4. urlpatterns = [
  5.     # DRF viewsets manual url
  6.     path("viewsets/", views.CourseViewSet.as_view(
  7.         {"get": "list", "post": "create"}
  8.     ), name="viewsets-list"),
  9.     path("viewsets/<int:pk>/", views.CourseViewSet.as_view(
  10.         {"get": "retrieve", "put": "update", "patch": "partial_update", "delete": "destroy"}
  11.     ), name="viewsets-detail"),
  12. ]

上面写url的方法着实恶心，只是为了增加对视图集的理解，下面才是正规操作：

  1. from django.urls import path, include
  2. from rest_framework.routers import DefaultRouter
  4. from course import views
  6. router = DefaultRouter()
  7. router.register(prefix="viewsets", viewset=views.CourseViewSet)
  9. urlpatterns = [
  10.     # DRF viewsets router url
  11.     path("", include(router.urls))
  12. ]

4.认证和权限

基本概念

先捋捋概念：

  • 认证：对用户登录的身份进行校验
  • 权限：对于一个认证通过的用户，他能访问哪些接口，或者对于一个接口，他能拿到什么级别的数据

再捋捋顺序：

  • 由源码分析可得：认证发生在权限检查和限流检查之前
    • 即：在执行任何代码之前，都是在视图最开始的地方进行身份认证

      全局配置

      可以在settings.py文件中的REST_FRAMEWORK字典中设置全局的认证与权限的配置： ```python INSTALLED_APPS = [ ‘rest_framework’, ‘rest_framework.authtoken’,

      DRF自带的Token认证功能，会生成一张Token表，记得migrate一下

      ]

REST_FRAMEWORK = { “DEFAULT_PERMISSION_CLASSES”: [ “rest_framework.permissions.IsAuthenticatedOrReadOnly”, ], “DEFAULT_AUTHENTICATION_CLASSES”: [ “rest_framework.authentication.BasicAuthentication”, # 基本认证：用户名+密码 “rest_framework.authentication.SessionAuthentication”, “rest_framework.authentication.TokenAuthentication”, # 如果加了这个，app中就必须要有’rest_framework.authtoken’

  1.     # 可以在此添加自定义的认证方案
  2.     ...
  3. ]

}

  1. DRF的认证和权限**均**依赖的**两个核心数据**：
  3. - request.user
  4. - request.auth：DRF的认证机制其实是依赖了`django.contrib.auth`。
  6. 对上面`DEFAULT_AUTHENTICATION_CLASSES`列表中的多个认证类，DRF会**按照顺序从上往下**进行验证，并使用**第一个成功通过的认证类**的返回值来**设置**`request.user`和`request.auth`。如果认证成功，DRF会把`request.user`设置为`django.contrib.auth.models.User`的实例，把`request.auth`设置为`None`。<br />举例：如果`BasicAuthentication`认证通过，就不用往下认证了，直接使用该认证结果设置`request.user`和`request.auth`。
  8. <a name="WTpGm"></a>
  9. ### 认证-常用认证类
  10. <a name="Kl26o"></a>
  11. #### BasicAuthentication
  12. 用户名密码认证，默认会使用base64编码，安全性极低
  13. <a name="NDi4h"></a>
  14. #### SessionAuthentication
  15. 需要后端提供csrf令牌
  16. <a name="x6CXw"></a>
  17. #### TokenAuthentication
  18. 为每个用户生成一个token（令牌）。<br />需要在`settings.py`文件的`INSTALLED_APPS`中添加   `'rest_framework.authtoken'` 这个app，然后在命令行执行`python mange.py migrate`命令，该命令会生成一张token表。<br />现在就只剩生成token了。<br />我们想在每个用户生成的时候创建一个token，这就需要用到Django的信号机制了。
  19. ```python
  20. from django.db.models.signals import post_save
  21. from django.dispatch import receiver
  22. from django.conf import settings
  23. from rest_framework.authtoken.models import Token
  26. @receiver(post_save, sender=settings.AUTH_USER_MODEL)  # Django的信号机制
  27. def generate_token(sender, instance=None, created=False, **kwargs):
  28.     """
  29.     创建用户时自动生成Token
  30.     :param sender:
  31.     :param instance:
  32.     :param created:  默认不是新建
  33.     :param kwargs:
  34.     :return:
  35.     """
  36.     if created:  # 如果是新建，则生成一个Token
  37.         Token.objects.create(user=instance)

其实上面的代码已经完成了token的生成，此后再创建用户，就会在token表中插入一条记录。
那么用户如何获取自己的token呢？很简单，添加一个视图函数即可，DRF已经帮我们完成，只需在根urls.py文件中添加一条记录：

  1. from django.urls import path, include
  2. from rest_framework.authtoken import views  # 引入相关视图
  4. urlpatterns = [
  5.     ...
  6.     path("api-token-auth/", views.obtain_auth_token),  # 获取Token的接口
  7. ]

注意，用户获取token时，还是需要BasicAuth模式的，即需要提供用户名和密码来获取token。

认证-设置认证策略（在视图中添加认证）

下面举例了两种方式：

  • FBV添加认证：通过装饰器
  • CBV视图添加认证：通过类属性

以上两种方式都是对视图的个性化设置，优先级要比settings.py文件中DEFAULT_AUTHENTICATION_CLASSES里设置的权限类要高，只有一个视图没有单独指定认证策略时，才会使用全局配置。

  1. from django.conf import settings
  2. from django.db.models.signals import post_save
  3. from django.dispatch import receiver
  4. from rest_framework import generics
  5. from rest_framework import status
  6. from rest_framework.authentication import BasicAuthentication, TokenAuthentication
  7. from rest_framework.authtoken.models import Token
  8. from rest_framework.decorators import api_view, authentication_classes
  9. from rest_framework.permissions import IsAuthenticated
  10. from rest_framework.response import Response
  13. from .models import Course
  14. from .serializers import CourseSerializer
  17. @receiver(post_save, sender=settings.AUTH_USER_MODEL)  # Django的信号机制
  18. def generate_token(sender, instance=None, created=False, **kwargs):
  19.     if created:
  20.         Token.objects.create(user=instance)
  23. """一、 函数式编程 Function Based View"""
  24. @api_view(["GET", "POST"])
  25. @authentication_classes((BasicAuthentication,))
  26. def course_list(request):
  27.     if request.method == "GET":
  28.         s = CourseSerializer(instance=Course.objects.all(), many=True)
  29.         return Response(data=s.data, status=status.HTTP_200_OK)
  31.     elif request.method == "POST":
  32.         s = CourseSerializer(data=request.data)  # 部分更新用partial=True属性
  33.         if s.is_valid():
  34.             s.save(teacher=request.user)
  35.             return Response(data=s.data, status=status.HTTP_201_CREATED)
  36.         return Response(s.errors, status=status.HTTP_400_BAD_REQUEST)
  39. @api_view(["GET", "PUT", "DELETE"])
  40. @authentication_classes((TokenAuthentication, ))
  41. def course_detail(request, pk):
  42.     try:
  43.         course = Course.objects.get(pk=pk)
  44.     except Course.DoesNotExist:
  45.         return Response(data={"msg": "没有此课程信息"}, status=status.HTTP_404_NOT_FOUND)
  46.     else:
  47.         if request.method == "GET":
  48.             s = CourseSerializer(instance=course)
  49.             return Response(data=s.data, status=status.HTTP_200_OK)
  51.         elif request.method == "PUT":
  52.             s = CourseSerializer(instance=course, data=request.data)
  53.             if s.is_valid():
  54.                 s.save()
  55.                 return Response(data=s.data, status=status.HTTP_200_OK)
  56.             return Response(data=s.errors, status=status.HTTP_400_BAD_REQUEST)
  58.         elif request.method == "DELETE":
  59.             course.delete()
  60.             return Response(status=status.HTTP_204_NO_CONTENT)
  63. """三、 通用类视图 Generic Class Based View"""
  65. class GCourseList(generics.ListCreateAPIView):
  66.     queryset = Course.objects.all()
  67.     serializer_class = CourseSerializer
  68.     authentication_classes = (BasicAuthentication,)
  69.     permission_classes = (IsAuthenticated,)
  71.     def perform_create(self, serializer):
  72.         serializer.save(teacher=self.request.user)
  75. class GCourseDetail(generics.RetrieveUpdateDestroyAPIView):
  76.     queryset = Course.objects.all()
  77.     serializer_class = CourseSerializer
  78.     authentication_classes = (TokenAuthentication,)

权限-常用的权限类

drf自带的权限类：
image.png
DRF默认使用AllowAny，即不设置任何权限。
IsAdminUser看的是User表中的is_staff字段。

权限-设置权限策略（在视图中添加权限）

权限的设置和认证一样，对于FBV使用装饰器，对于CBV则使用类属性

  1. #!/usr/bin/python3
  2. # -*- coding:utf-8 -*-
  3. # __author__ = "__Jack__"
  5. from django.conf import settings
  6. from django.db.models.signals import post_save
  7. from django.dispatch import receiver
  8. from rest_framework import generics
  9. from rest_framework import status
  10. from rest_framework.authentication import BasicAuthentication, SessionAuthentication, TokenAuthentication
  11. from rest_framework.authtoken.models import Token
  12. from rest_framework.decorators import api_view, authentication_classes, permission_classes
  13. from rest_framework.permissions import IsAuthenticated, IsAuthenticatedOrReadOnly
  14. from rest_framework.response import Response
  17. from .models import Course
  18. from .serializers import CourseSerializer
  21. @receiver(post_save, sender=settings.AUTH_USER_MODEL)  # Django的信号机制
  22. def generate_token(sender, instance=None, created=False, **kwargs):
  24.     if created:
  25.         Token.objects.create(user=instance)
  28. """一、 函数式编程 Function Based View"""
  31. @api_view(["GET", "POST"])
  32. @authentication_classes((BasicAuthentication, SessionAuthentication, TokenAuthentication))
  33. @permission_classes((IsAuthenticatedOrReadOnly,))
  34. def course_list(request):
  35.     """
  36.     获取所有课程信息或新增一个课程
  37.     :param request:
  38.     :return:
  39.     """
  40.     if request.method == "GET":
  41.         s = CourseSerializer(instance=Course.objects.all(), many=True)
  42.         return Response(data=s.data, status=status.HTTP_200_OK)
  44.     elif request.method == "POST":
  45.         s = CourseSerializer(data=request.data)  # 部分更新用partial=True属性
  46.         if s.is_valid():
  47.             s.save(teacher=request.user)
  48.             return Response(data=s.data, status=status.HTTP_201_CREATED)
  49.         return Response(s.errors, status=status.HTTP_400_BAD_REQUEST)
  52. @api_view(["GET", "PUT", "DELETE"])
  53. @authentication_classes((BasicAuthentication, SessionAuthentication, TokenAuthentication))
  54. @permission_classes((IsAuthenticated,))
  55. def course_detail(request, pk):
  56.     """
  57.     获取、更新、删除一个课程
  58.     :param request:
  59.     :param pk:
  60.     :return:
  61.     """
  62.     try:
  63.         course = Course.objects.get(pk=pk)
  64.     except Course.DoesNotExist:
  65.         return Response(data={"msg": "没有此课程信息"}, status=status.HTTP_404_NOT_FOUND)
  66.     else:
  67.         if request.method == "GET":
  68.             s = CourseSerializer(instance=course)
  69.             return Response(data=s.data, status=status.HTTP_200_OK)
  71.         elif request.method == "PUT":
  72.             s = CourseSerializer(instance=course, data=request.data)
  73.             if s.is_valid():
  74.                 s.save()
  75.                 return Response(data=s.data, status=status.HTTP_200_OK)
  76.             return Response(data=s.errors, status=status.HTTP_400_BAD_REQUEST)
  78.         elif request.method == "DELETE":
  79.             course.delete()
  80.             return Response(status=status.HTTP_204_NO_CONTENT)
  83. """三、 通用类视图 Generic Class Based View"""
  86. class GCourseList(generics.ListCreateAPIView):
  87.     queryset = Course.objects.all()
  88.     serializer_class = CourseSerializer
  89.     authentication_classes = (IsAuthenticatedOrReadOnly,)
  90.     permission_classes = (IsAuthenticated,)
  92.     def perform_create(self, serializer):
  93.         serializer.save(teacher=self.request.user)
  96. class GCourseDetail(generics.RetrieveUpdateDestroyAPIView):
  97.     queryset = Course.objects.all()
  98.     serializer_class = CourseSerializer
  99.     permission_classes = (IsAuthenticated,)

权限-自定义对象级别权限

什么是对象级权限？
现在的程序有一个问题，只要是经过认证的用户，就都可以对课程进行增删改查，理想的情况是：只有课程的发布者才有权修改或者删除自己的课程，对于别人，只能查看课程。所以每一个课程对象应该对不同的用户有不同的权限，这就是对象级权限。

如何自定义对象级权限呢？
在app文件夹下新建一个permissions.py文件：

  1. from rest_framework import permissions
  4. class IsOwnerOrReadOnly(permissions.BasePermission):
  5.     """自定义权限：只允许对象的所有者能够编辑"""
  7.     def has_object_permission(self, request, view, obj):
  8.         """
  9.         所有的request请求都有读权限，因此一律允许GET/HEAD/OPTIONS方法
  10.         :param request:
  11.         :param view:
  12.         :param obj:
  13.         :return: bool
  14.         """
  15.         if request.method in permissions.SAFE_METHODS:  # SAFE_METHODS = ("GET", "HEAD", "OPTIONS")
  16.             return True
  17.         # 对象的所有者才有写权限
  18.         return obj.teacher == request.user

然后向之前一样设置一下权限类就OK了！

  1. from rest_framework import generics
  2. from rest_framework.permissions import IsAuthenticated
  4. from .models import Course
  5. from .permissions import IsOwnerOrReadOnly  # 1、导入自定义的权限类
  6. from .serializers import CourseSerializer
  9. class GCourseDetail(generics.RetrieveUpdateDestroyAPIView):
  10.     queryset = Course.objects.all()
  11.     serializer_class = CourseSerializer
  12.     permission_classes = (IsAuthenticated, IsOwnerOrReadOnly)  # 2、将其注册到需要的视图中

5.生成接口文档