# Ensure that the incoming request is permitted
        self.perform_authentication(request)
        self.check_permissions(request)
        self.check_throttles(request)

    @property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, ‘_user‘):
            with wrap_attributeerrors():
                self._authenticate()
        return self._user

    def _authenticate(self):
        """
        Attempt to authenticate the request using each authentication instance
        in turn.
        """
        # 遍历验证器
        for authenticator in self.authenticators:
            try:
                # 执行验证器的 authenticate 方法, 返回验证的结果, 该结果是一个元组 (user, auth)
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                # 如果验证器的 authenticate 方法抛出 APIException 异常,
                # 说明验证代码逻辑可能出现了异常情况
                # 那么就执行 _not_authenticated 方法
                self._not_authenticated()
                # 执行完后还要继续向外抛出异常
                raise

            # 如果验证器的 authenticate 方法正常返回了元组, 就给request对象添加三个属性: _authenticator user auth
            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple
                return

        # 否则继续执行 _not_authenticated 方法
        self._not_authenticated()

    def _not_authenticated(self):
        """
        Set authenticator, user & authtoken representing an unauthenticated request.

        Defaults are None, AnonymousUser & None.
        """
        # 该方法说明请求没有认证信息, 那么就将:
        # _authenticator 属性设置None,
        # user 属性设为 api_settings.UNAUTHENTICATED_USER()的值, 这个值可以在我们的settings文件中自己设置,
        #      默认值为Django预定义的匿名用户对象AnonymousUser
        # auth 属性设为 api_settings.UNAUTHENTICATED_TOKEN()的值, 这个值也可以在我们的settings文件中自己设置,
        #      默认值为None
        self._authenticator = None

        if api_settings.UNAUTHENTICATED_USER:
            self.user = api_settings.UNAUTHENTICATED_USER()
        else:
            self.user = None

        if api_settings.UNAUTHENTICATED_TOKEN:
            self.auth = api_settings.UNAUTHENTICATED_TOKEN()
        else:
            self.auth = None

    def get_authenticators(self):
        """
        Instantiates and returns the list of authenticators that this view can use.
        """
        return [auth() for auth in self.authentication_classes]

‘DEFAULT_AUTHENTICATION_CLASSES‘: [
        ‘rest_framework.authentication.SessionAuthentication‘,
        ‘rest_framework.authentication.BasicAuthentication‘
    ]

class BasicAuthentication(BaseAuthentication):
    """
    HTTP Basic authentication against username/password.
    """
    www_authenticate_realm = ‘api‘

    def authenticate(self, request):
        """
        Returns a `User` if a correct username and password have been supplied
        using HTTP Basic authentication.  Otherwise returns `None`.
        """
        # 将请求头的 Authorization 参数值按空格拆分 成一个列表
        auth = get_authorization_header(request).split()

        # 若拆分的列表为空或者第一位不是basic, 则返回None
        if not auth or auth[0].lower() != b‘basic‘:
            return None

        # 若auth长度!=2则抛出异常
        if len(auth) == 1:
            msg = _(‘Invalid basic header. No credentials provided.‘)
            raise exceptions.AuthenticationFailed(msg)
        elif len(auth) > 2:
            msg = _(‘Invalid basic header. Credentials string should not contain spaces.‘)
            raise exceptions.AuthenticationFailed(msg)

        # 解密得到用户名和密码
        try:
            auth_parts = base64.b64decode(auth[1]).decode(HTTP_HEADER_ENCODING).partition(‘:‘)
        except (TypeError, UnicodeDecodeError, binascii.Error):
            msg = _(‘Invalid basic header. Credentials not correctly base64 encoded.‘)
            raise exceptions.AuthenticationFailed(msg)

        userid, password = auth_parts[0], auth_parts[2]
        # 将得到的用户名和密码进行认证
        return self.authenticate_credentials(userid, password, request)
        
    def get_authorization_header(request):
        """
        Return request‘s ‘Authorization:‘ header, as a bytestring.

        Hide some test client ickyness where the header can be unicode.
        """
        # 获取请求头中的Authorization参数值            
        #   在DRF中因为request已经是被封装过的, 因此获取请求头数据时, 可以使用原生的request._request.headers.get()
        #   也可以使用request.META.get(), 但是META中对原请求参数进行了改造:
        #      a) 将原中划线(-)改成了下划线(_)
        #      b) 将字母全都转成大写
        #      c) 原参数前都加上了HTTP_前缀
        auth = request.META.get(‘HTTP_AUTHORIZATION‘, b‘‘)
        # 将auth编码为 iso-8859-1
        if isinstance(auth, str):
            # Work around django test client oddness
            auth = auth.encode(HTTP_HEADER_ENCODING)
        return auth

    def authenticate_credentials(self, userid, password, request=None):
        """
        Authenticate the userid and password against username and password
        with optional request for context.
        """
        credentials = {
            get_user_model().USERNAME_FIELD: userid,
            ‘password‘: password
        }
        # 将用户密码进行认证, 得到User对象
        user = authenticate(request=request, **credentials)

        # 若用户对象为空, 则抛异常
        if user is None:
            raise exceptions.AuthenticationFailed(_(‘Invalid username/password.‘))

        # 若用户对象未激活, 则抛异常
        if not user.is_active:
            raise exceptions.AuthenticationFailed(_(‘User inactive or deleted.‘))

        # 成功的到User对象, 则返回元组
        return (user, None)

class MyAuthentication(BaseAuthentication):
    def authenticate(self, request):
        """
        约定在请求头中带一个my-token参数, 格式为 auth_sort/username
        注意:
            1. 在HTTP请求头中的参数最好不要使用下划线, 否则有可能获取不到这个参数
            2. 在DRF中因为request已经是被封装过的, 因此获取请求头数据时, 可以使用原生的request._request.headers.get()
               也可以使用request.META.get(), 但是META中对原请求参数进行了改造:
                    a) 将原中划线(-)改成了下划线(_)
                    b) 将字母全都转成大写
                    c) 原参数前都加上了HTTP_前缀
                那么原参数 my-token 就变成了 HTTP_MY_TOKEN
        """
        # 获取token参数
        token = request.META.get(‘HTTP_MY_TOKEN‘)
        # print(request._request.headers.get(‘my-token‘))
        if not token:
            raise exceptions.AuthenticationFailed(‘无token, 认证失败‘)
        # 拆分token
        auth = token.split(‘/‘)
        if len(auth) != 2 or auth[0] != ‘auth_sort‘:
            raise exceptions.AuthenticationFailed(‘token格式错误‘)
        # 拿到用户名判断用户是否存在
        user = User.objects.filter(username=auth[1])
        if not user:
            raise exceptions.AuthenticationFailed(‘用户名不存在‘)
        # 认证成功
        return user, None


class BookAuthViewSet(mixins.ListModelMixin, GenericViewSet):
    queryset = Book.objects.filter(is_delete=False)
    serializer_class = BookSerializer
    authentication_classes = [BasicAuthentication, MyAuthentication, ]

    def list(self, request, *args, **kwargs):
        print(request.user)
        response = super().list(request, *args, **kwargs)
        return MyResponse(response.data)

‘DEFAULT_PERMISSION_CLASSES‘: [
        ‘rest_framework.permissions.AllowAny‘,
    ]

class AllowAny(BasePermission):
    """
    Allow any access.
    This isn‘t strictly required, since you could use an empty
    permission_classes list, but it‘s useful because it makes the intention
    more explicit.
    """

    def has_permission(self, request, view):
        return True

class MyPermission(BasePermission):
    """
    匿名用户不能查看book数据, 普通用户只能查看id为1的出版社出版的图书的详细信息, 管理员用户可以查看所有数据
    """
    message = ‘非管理员用户只能查看上海出版社的数据‘

    def has_permission(self, request, view):
        # 匿名用户返回False
        return not isinstance(request.user, AnonymousUser)

    def has_object_permission(self, request, view, obj):
        # 管理员或者非管理员且图书出版社ID为1, 返回True
        return bool(request.user.is_staff or (request.user.is_staff is False and obj.publish_id == 1))


class BookAuthViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, GenericViewSet):
    queryset = Book.objects.filter(is_delete=False)
    serializer_class = BookSerializer
    authentication_classes = [BasicAuthentication, MyAuthentication]
    permission_classes = [MyPermission, ]

    def list(self, request, *args, **kwargs):
        print(request.user)
        response = super().list(request, *args, **kwargs)
        return MyResponse(result=response.data)

    def check_throttles(self, request):
        """
        Check if request should be throttled.
        Raises an appropriate exception if the request is throttled.
        """
        throttle_durations = []
        for throttle in self.get_throttles():
            if not throttle.allow_request(request, self):
                throttle_durations.append(throttle.wait())

        if throttle_durations:
            # Filter out `None` values which may happen in case of config / rate
            # changes, see #1438
            durations = [
                duration for duration in throttle_durations
                if duration is not None
            ]

            duration = max(durations, default=None)
            self.throttled(request, duration)

    def allow_request(self, request, view):
        """
        Implement the check to see if the request should be throttled.

        On success calls `throttle_success`.
        On failure calls `throttle_failure`.
        """
        # 未设置频率, 则允许请求通过
        if self.rate is None:
            return True

        # 拿到缓存的key, 若key为空, 则允许请求通过
        self.key = self.get_cache_key(request, view)
        if self.key is None:
            return True

        # 拿到缓存key对应的缓存值
        self.history = self.cache.get(self.key, [])
        # 记录当前时间
        self.now = self.timer()
　　　　 ......代码省略

class AnonRateThrottle(SimpleRateThrottle):
    """
    Limits the rate of API calls that may be made by a anonymous users.

    The IP address of the request will be used as the unique cache key.
    """
    # 定义一个字符串前缀
    scope = ‘anon‘

    def get_cache_key(self, request, view):
        if request.user.is_authenticated:
            return None  # Only throttle unauthenticated requests.

        # 给cache_format字符串赋值
        return self.cache_format % {
            ‘scope‘: self.scope,
            ‘ident‘: self.get_ident(request)
        }

class UserRateThrottle(SimpleRateThrottle):
    """
    Limits the rate of API calls that may be made by a given user.

    The user id will be used as a unique cache key if the user is
    authenticated.  For anonymous requests, the IP address of the request will
    be used.
    """
    scope = ‘user‘

    def get_cache_key(self, request, view):
        if request.user.is_authenticated:
            ident = request.user.pk
        else:
            ident = self.get_ident(request)

        return self.cache_format % {
            ‘scope‘: self.scope,
            ‘ident‘: ident
        }

    def allow_request(self, request, view):
        """
        Implement the check to see if the request should be throttled.

        On success calls `throttle_success`.
        On failure calls `throttle_failure`.
        """
        # 未设置频率, 则允许请求通过
        if self.rate is None:
            return True

        # 拿到缓存的key, 若key为空, 则允许请求通过
        self.key = self.get_cache_key(request, view)
        if self.key is None:
            return True

        # 拿到缓存key对应的缓存值, 第一次拿到的是一个空列表
        self.history = self.cache.get(self.key, [])
        # 记录当前时间
        self.now = self.timer()

        # Drop any requests from the history which have now passed the
        # throttle duration
        # 循环history列表, 当列表最后一个元素小于当前时间减去过期时间, 就把最后一个元素弹出
　　　　 #  即当前时间减去最早的history时间大于等于过期时间, 说明最早的history时间已经超过了频率限制的时间, 就把该时间弹出, 不记为限制的次数

        while self.history and self.history[-1] <= self.now - self.duration:
            self.history.pop()
        # 如果history长度大于等于限制的请求次数, 则说明请求次数太多了, 没有通过频率验证
        if len(self.history) >= self.num_requests:
            return self.throttle_failure()
        # 否则通过了频率验证, 允许请求
        return self.throttle_success()

# Throttling
    ‘DEFAULT_THROTTLE_RATES‘: {
        ‘user‘: None,
        ‘anon‘: None,
    }

    def parse_rate(self, rate):
        """
        Given the request rate string, return a two tuple of:
        <allowed number of requests>, <period of time in seconds>
        """
        if rate is None:
            return (None, None)
        num, period = rate.split(‘/‘)
        num_requests = int(num)
        duration = {‘s‘: 1, ‘m‘: 60, ‘h‘: 3600, ‘d‘: 86400}[period[0]]
        return (num_requests, duration)

    def throttle_success(self):
        """
        Inserts the current request‘s timestamp along with the key
        into the cache.
        """
        # 在history列表的第一位插入当前的时间
        self.history.insert(0, self.now)
        # 在缓存中也设置一条数据, 键为get_cache_key返回的key, 值为history列表, 过期时间为rate设置的xxx秒
        self.cache.set(self.key, self.history, self.duration)
        return True

    def wait(self):
        """
        Returns the recommended next request time in seconds.
        """
        if self.history:
            # 下一次访问需要等待的时间=过期时间-(当前时间-最早的history时间)
            remaining_duration = self.duration - (self.now - self.history[-1])
        else:
            remaining_duration = self.duration

        # 剩余可访问的次数=限制总次数-已访问的次数, 按实际情况算这个值结果应该都为1
        available_requests = self.num_requests - len(self.history) + 1
        if available_requests <= 0:
            return None

        # 返回需要等待的时间
        return remaining_duration / float(available_requests)

class BookAuthViewSet(mixins.ListModelMixin, mixins.RetrieveModelMixin, GenericViewSet):
    # 查询结果集
    queryset = Book.objects.filter(is_delete=False)
    # 序列化类
    serializer_class = BookSerializer
    # 认证类列表
    authentication_classes = [BasicAuthentication, MyAuthentication]
    # 权限类列表
    permission_classes = [MyPermission, ]
    # 限流/频率类列表
    throttle_classes = [UserRateThrottle, AnonRateThrottle]

REST_FRAMEWORK = {
    # 限流频率
    ‘DEFAULT_THROTTLE_RATES‘: {
        ‘user‘: ‘5/m‘,
        ‘anon‘: ‘3/m‘,
    }
}