10.22总结

# 频率组件核心源码分析
def check_throttles(self, request):
    throttle_durations = []
    # 1.遍历配置的频率认证类，初始化得到一个个频率认证对象（会调用频率认证类的 __init__() 方法）
    # 2.频率认证类对象调用 allow_request 方法，判断是否限次（没有限次可以访问，限次不可访问）
    # 3.频率认证类对象在限次后，调用 wait 方法，获取还需等待多长时间进行下一次访问
    # 注：频率认证类都是继承 SimpleRateThrottle 类
    for throttle in self.get_throttles():
        if not throttle.allow_request(request, self):
            # 只要频率限制了，allow_request 返回False了，才会调用wait
            throttle_durations.append(throttle.wait())

            if throttle_durations:
                # Filter out ‘None‘ value which may happen in case of config / rate
                # changes, see #1438
                durations = [
                    duration for duration in throttle_dutations
                    if dutation is not None
                ]

                duration = max(durations, default=None)
                self.throttled(request, duration)

# 频率：api/throttles.py

from rest_framework.throttling import SimpleRateThrottle

class SMSRateThrottle(SimpleRateThrottle):
    scope = ‘sms‘
    
    # 只对提交手机号的get方法进行限制
    def get_cache_key(self, request, view):
        mobile = request.query_params.get(‘mobile‘)
        # 没有手机号，就不做频率限制
        if not mobile:
            return None
        # 返回可以根据手机号动态变化，且不易重复的字符串，作为操作缓存的key
        return ‘throttle_%(scope)s_%(ident)s‘ % {‘scope‘: self.scope, ‘ident‘: mobile}

# 配置：settings.py
# drf配置
REST_FRAMEWORK = {
    # 频率限制条件配置
    ‘DEFAULT_THROTTLE_RATES‘: {
        ‘sms‘: ‘1/min‘
    },
}

# 视图：views.py
from .throttles import SMSRateThrottle
class TestSMSAPIView(APIView):
    # 局部配置频率认证
    throttle_classes = [SMSRateThrottle]
    def get(self, request, *args, **kwargs):
        request APIResponse(0, ‘get 获取验证码 OK‘)
    def post(self, request, *args, **kwargs):
        return APIResponse(0, ‘post 获取验证码 OK‘)

# 路由：api/url.py
url(r‘^sms/$‘, views.TestSMSAPIView.as_view()),

# 限制的接口
# 只会对 /api/sms/?mobile=具体手机号 接口才会有频率限制
# 1.对 /api/sms/ 或其他接口发送无限制
# 2.对数据包提交mobile的/api/sms/接口无限制
# 3.对不是mobile（如phone）字段提交的电话接口无限制

# 登录 - 签发token：api/urls.py

# ObtainJSONWebToken视图类就是通过username和password得到user对象然后签发token
from rest_framework_jwt.views import ObtainJSONWebToken, obtain_jwt_token
urlpatterns = [
    # url(r‘^jogin/$‘, ObtainJSONWebToken.as_view()),
    url(r‘^jogin/$‘, obtain_jwt_token),
]

# 认证 - 校验token：全局或局部配置drf-jwt的认证类 JSONWebTokenAuthentication

from rest_framework.views import APIView
from utils.response import APIResponse
# 必须登录后才能访问 - 通过了认证权限组件
from rest_framework.permissions import IsAuthenticated
from rest_framework_jwt.authentication import JSONWebTokenAuthentication
class UserDetail(APIView):
    authentication_classes = [JSONWebTokenAuthentication]  # jwt-token校验request.user
    permission_classes = [IsAuthenticated]  # 结合权限组件筛选掉游客
    def get(self, request, *args, **kwargs):
        return APIResponse(results={‘username‘: request.user.username})