Flask 构建微电影视频网站(五)

基于角色的访问控制

权限管理

class AuthForm(FlaskForm):
    name = StringField(
        label='权限',
        validators=[
            DataRequired("请输入权限!"),
        ],
        description='权限',
        render_kw={
            "class": "form-control",
            "placeholder": "请输入权限！"
        }
    )

    url = StringField(
        label='权限地址',
        validators=[
            DataRequired("请输入权限地址!"),
        ],
        description='权限地址',
        render_kw={
            "class": "form-control",
            "placeholder": "请输入权限地址！"
        }
    )
    submit = SubmitField(
        '编辑',
        render_kw={
            "class": "btn btn-primary",
        }
    )

添加权限

@admin.route('/auth/add/', methods=['GET', 'POST'])
@admin_login_req
def auth_add():
    form= AuthForm()
    if form.validate_on_submit():
        data = form.data
        auth = Auth(
            name=data['name'],
            url=data['url']
        )

        db.session.add(auth)
        db.session.commit()

        flash('权限添加成功!', 'info')
    return render_template('admin/auth_add.html',form=form)

权限列表

@admin.route('/auth/list/<int:page>/')
@admin_login_req
def auth_list(page=1):
    if page <= 0:
        page = 1
    page_data = Auth.query.order_by(
        Auth.addtime.desc()
    ).paginate(page=page, per_page=10)
    return render_template('admin/auth_list.html',page_data=page_data)

删除权限

@admin.route('/auth/del/<int:id>/')
@admin_login_req
def auth_del(id=None):
    auth = Auth.query.get_or_404(int(id))
    db.session.delete(auth)
    db.session.commit()
    flash('权限删除成功!', 'info')
    return redirect(url_for('admin.auth_list', page=1))

编辑权限

@admin.route('/auth/edit/<int:id>/', methods=['GET', 'POST'])
@admin_login_req
def auth_edit(id=None):
    form = AuthForm()
    auth = Auth.query.get_or_404(int(id))

    if form.validate_on_submit():
        data = form.data
        auth.name =data['name']
        auth.url=data['url']

        db.session.add(auth)
        db.session.commit()

        flash('权限修改成功!', 'info')
        return redirect(url_for('admin.auth_edit', id=id))
    return render_template('admin/auth_edit.html',form=form, auth=auth)

修改对应的前端文件

角色管理

class RoleForm(FlaskForm):
    name = StringField(
        label='角色名称',
        validators=[
            DataRequired("请输入角色名称!"),
        ],
        description='角色名称',
        render_kw={
            "class": "form-control",
            "placeholder": "请输入角色名称！"
        }
    )

    auths = SelectMultipleField(
        label='权限列表',
        validators=[
            DataRequired("请选择权限!"),
        ],
        coerce=int,
        choices=[(v.id, v.name) for v in auths],
        description='权限列表',
        render_kw={
            "class": "form-control",
        }
    )
    submit = SubmitField(
        '编辑',
        render_kw={
            "class": "btn btn-primary",
        }
    )

添加角色

@admin.route('/role/add/', methods=['GET', 'POST'])
@admin_login_req
def role_add():
    form = RoleForm()
    if form.validate_on_submit():
        data=form.data
        role = Role(
            name=data['name'],
            auths=','.join(map(lambda v:str(v), data['auths']))
        )

        db.session.add(role)
        db.session.commit()
        flash('角色添加成功!', 'info')
    return render_template('admin/role_add.html',form=form)

角色列表

@admin.route('/role/list/<int:page>/')
@admin_login_req
def role_list(page=1):
    if page <= 0:
        page = 1
    page_data = Role.query.order_by(
        Role.addtime.desc()
    ).paginate(page=page, per_page=10)
    return render_template('admin/role_list.html',page_data=page_data)

删除角色

@admin.route('/role/del/<int:id>/')
@admin_login_req
def role_del(id=None):
    role = Role.query.get_or_404(int(id))
    db.session.delete(role)
    db.session.commit()
    flash('角色删除成功!', 'info')
    return redirect(url_for('admin.role_list', page=1))

修改权限

@admin.route('/role/edit/<int:id>/', methods=['GET', 'POST'])
@admin_login_req
def role_edit(id=None):
    form = RoleForm()
    role = Role.query.get_or_404(int(id))

    if request.method == 'GET':
        auths = role.auths
        form.auths.data = list(map(lambda x: int(x), auths.split(',')))

    if form.validate_on_submit():
        data=form.data
        role.name = data['name']
        role.auths = ','.join(map(lambda v:str(v), data['auths']))

        db.session.add(role)
        db.session.commit()
        flash('角色修改成功!', 'info')
    return render_template('admin/role_edit.html',form=form,role=role)

修改对应的前端文件

管理员管理

class AdminForm(FlaskForm):
    name = StringField(
        label='管理员名称',
        validators=[
            DataRequired("请输入管理员名称!"),
        ],
        description='管理员名称',
        render_kw={
            "class": "form-control",
            "placeholder": "请输入管理员名称！"
        }
    )

    pwd = PasswordField(
        label='管理员密码',
        validators=[
            DataRequired("请输入管理员密码!")
        ],
        description="管理员密码",
        render_kw={
            "class": "form-control",
            "placeholder": "请输入管理员密码！",
            "required": "required"
        }
    )

    repwd = PasswordField(
        label='管理员重复密码',
        validators=[
            DataRequired("请输入管理员重复密码!"),
            EqualTo('pwd', message='两次密码不一致!'),
        ],
        description="管理员重复密码",
        render_kw={
            "class": "form-control",
            "placeholder": "请输入管理员重复密码！",
            "required": "required"
        }
    )

    role_id=SelectField(
        label='所属角色',
        validators=[
            DataRequired("请选择角色!")
        ],
        coerce=int,
        choices=[(v.id, v.name) for v in roles],
        description="所属角色",
        render_kw={
            "class": "form-control",
        }
    )

    submit = SubmitField(
        '编辑',
        render_kw={
            "class": "btn btn-primary",
        }
    )

添加管理员

@admin.route('/admin/add/', methods=['GET', 'POST'])
@admin_login_req
def admin_add():
    form = AdminForm()

    from werkzeug.security import generate_password_hash

    if form.validate_on_submit():
        data = form.data
        admin = Admin(
            name=data['name'],
            pwd=generate_password_hash(data['pwd']),
            role_id=data['role_id'],
            is_super=1,
        )

        db.session.add(admin)
        db.session.commit()

        flash('管理员添加成功!', 'info')

    return render_template('admin/admin_add.html',form=form)

管理员列表

@admin.route('/admin/list/<int:page>/')
@admin_login_req
def admin_list(page=1):
    if page <= 0:
        page = 1
    page_data = Admin.query.join(
        Role
    ).filter(
        Role.id==Admin.role_id
    ).order_by(
        Admin.addtime.desc()
    ).paginate(page=page, per_page=10)
    return render_template('admin/admin_list.html',page_data=page_data)

修改对应的前端代码

访问权限控制

def admin_auth(func):
    @wraps(func)
    def decorated_function(*args, **kwargs):
        admin = Admin.query.join(
            Role
        ).filter(
            Role.id == Admin.role_id,
            Admin.id==session['admin_id']
        ).first()

        auths = admin.role.auths
        auths = list(map(lambda x: int(x), auths.split(',')))

        auth_list = Auth.query.all()
        urls = [v.url for v in auth_list for val in auths if val == v.id]
        rule = request.url_rule

        print(urls)
        print(rule)

        if str(rule) not in urls:
            abort(404)
        return func(*args, **kwargs)
    return decorated_function

给视图函数添加装饰器,像这样

@admin.route('/tag/list/<int:page>/')
@admin_login_req
@admin_auth
def tag_list(page=1):
    ...