@api_view的权限认证

函数API的实现

from rest_framework.decorators import api_view

@api_view(['GET', 'POST'])
def ClubSonAPI(request, format=None,pk=None):
    if request.method == 'GET':
        club = models.ClubSon.objects.all()
        serializer = serializers.ClubSon(instance=club, many=True)
        return Response(serializer.data)
    elif request.method == 'POST':
        pass

• pk的作用
  • pk是对单条数据作用

权限认证

from rest_framework.decorators import api_view,authentication_classes,permission_classes
from rest_framework.permissions import IsAuthenticated
from rest_framework.authentication import SessionAuthentication, TokenAuthentication

@api_view(['GET', 'POST'])
@permission_classes([IsAuthenticated])
@authentication_classes([TokenAuthentication])
def ClubSonAPI(request, format=None,pk=None):
    if request.method == 'GET':
    	if request.user.has_perm('monitor.view_googletop'):      //权限验证
            club = models.ClubSon.objects.all()
            serializer = serializers.ClubSon(instance=club, many=True)
            return Response(serializer.data)
	elif request.method == 'POST':
        pass

• 三个装饰器顺序不能错
• has_perm 是验证权限的函数，参数格式为 应用.codename ，其中应用即app名称，codename在表 auth_permission 中，对应的是每个model的增删改查权限

权限认证模版

if request.user.has_perm('monitor.view_googletop'):
    # 权限认证完成后可以执行的代码
    # 所需要的权限跟进实际需求更改，本处权限判断为随意添加的
else:
    return error(message='没有访问权限')