crm 权限设计

from django.db import models

class Permission(models.Model):
    """
    权限表
    """
    url = models.CharField(‘权限‘, max_length=32)
    title = models.CharField(‘标题‘, max_length=32)

    def __str__(self):
        return self.title


class Role(models.Model):
    """
    角色表
    """
    name = models.CharField(‘角色名称‘, max_length=32)
    permissions = models.ManyToManyField(‘Permission‘, verbose_name=‘角色所拥有的权限‘, blank=True)

    def __str__(self):
        return self.name


class User(models.Model):
    """
    用户表
    """
    name = models.CharField(‘用户名‘, max_length=32)
    pwd = models.CharField(‘密码‘, max_length=32)
    roles = models.ManyToManyField(‘Role‘, verbose_name=‘用户所拥有的角色‘, blank=True)
    def __str__(self):
        return self.name

url(r‘^admin/‘, admin.site.urls),
url(r‘^login/$‘, auth.login,name=‘login‘),
url(r‘^index/$‘, auth.index,name=‘index‘),

from django.shortcuts import render, redirect, HttpResponse, reverse
from rbac import models


def index(request):
    return render(request, ‘index.html‘)


def login(request):
    if request.method == ‘POST‘:
        # 获取用户名和密码
        user = request.POST.get(‘user‘)
        pwd = request.POST.get(‘pwd‘)
        # 去数剧库进行筛选
        obj = models.User.objects.filter(name=user, pwd=pwd).first()
        if not obj:
            return render(request, ‘login.html‘)
        permission_query = obj.roles.filter(permissions__url__isnull=False).values(‘permissions__url‘,
                                                                                   ‘permissions__title‘).distinct()
        print(‘1111‘,permission_query)  # <QuerySet [{‘permissions__url‘: ‘/index/‘, ‘permissions__title‘: ‘首页‘}]>
        request.session[‘permission‘] = list(permission_query)
        request.session[‘is_login‘] = True
        return redirect(reverse(‘index‘))
    return render(request, ‘login.html‘)

from django.utils.deprecation import MiddlewareMixin
from django.shortcuts import HttpResponse, redirect, reverse
from django.conf import settings
import re
class RbacMiddleWare(MiddlewareMixin):
    def process_request(self, request):
        # 获取当前访问的页面
        url = request.path_info  # index
        # 白名单
        for i in settings.WHITE_LIST:
            if re.match(i, url):
                return
        # 获取登录状态
        is_login = request.session.get(‘is_login‘)
        # 没有登录跳转到登录页面
        if not is_login:
            return redirect(reverse(‘login‘))

        # 免认证
        for i in settings.NO_PERMISSION_LIST:
            if re.match(i, url):
                return
        # 获取当前用户的权限
        permission_list = request.session[‘permission‘]
        print(permission_list)
        # 权限的校验
        for i in permission_list:
            if re.match(‘^{}$‘.format(i[‘permissions__url‘]), url):
                return
        # 没匹配成功  没有权限
        return HttpResponse(‘没有访问的权限‘)

# 白名单
WHITE_LIST = [
    r‘^/login/$‘,
    r‘^/reg/$‘,
    r‘^/admin/.*‘,
]
# 免认证的地址  需要登录 不行权限校验
NO_PERMISSION_LIST = [
    ‘/index/‘
]

from django.contrib import admin
from rbac import models


# Register your models here.

class PermissionAdmin(admin.ModelAdmin):
    list_display = [‘url‘, ‘title‘]
    list_editable = [‘title‘]
admin.site.register(models.Permission, PermissionAdmin)
admin.site.register(models.Role)
admin.site.register(models.User)