drf-认证、权限、频率、过滤、排序、分页

1.认证组件

1.1 局部认证

1.首先写两个接口，一个查询单个一个查询所有，我们利用视图扩展类和视图子类写在一个视图类上:
views.py:
from rest_framework.viewsets import ViewSetMixin
from rest_framework.generics import ListAPIView
from rest_framework.mixins import RetrieveModelMixin

class BookView(ViewSetMixin,ListAPIView,RetrieveModelMixin):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
# ViewSetMixin:负责自动生成路由
# ListAPIView:继承扩展类ListModelMixin，里面有list方法
# RetrieveModelMixin:里面有retrieve方法

serializer.py:
from rest_framework import serializers
from .models import Book

class BookSerializer(serializers.ModelSerializer):
    class Meta:
        model = Book
        fields = ['name','price','publish','authors','publish_detail','author_detail']
        extra_kwargs = {
            'name':{'max_length':8},
            'price': {'max_length': 8},
            'publish_detail':{'read_only':True},
            'author_detail':{'read_only':True},
            'publish':{'write_only':True},
            'authors':{'write_only':True}
        }

models.py:
class User(models.Model):
    username = models.CharField(max_length=32)
    password = models.CharField(max_length=32)

class UserToken(models.Model):
    token = models.CharField(max_length=64)
    user = models.OneToOneField(to='User',on_delete=models.CASCADE)
"""
写在两个视图类上按照以下写法:
"""
views.py:
class BookView(ViewSetMixin,ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer

class BookDetailView(ViewSetMixin,RetrieveAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
#   RetrieveAPIView继承RetrieveModelMixin和GenericAPIView，GenericAPIView中有queryset和serializer_class方法，所以继承RetrieveAPIView不继承RetrieveModelMixin。
models.py、serializer.py和之前一样

2.接下来我们想在查询单个图书接口上加上认证组件:
	1.写一个认证类，继承BaseAuthentication
	2.重写authenticate方法，拿到请求的数据(GET请求请求体当中不能携带数据，一般选用在请求头和地址栏当中携带数据)，用该数据在数据库UserToken表中查找
	3.如果认证成功则返回两个值:用户对象和随机字符串token。认证失败则抛出异常AuthenticationFailed。
	4.局部使用:
		class BookDetailView(ViewSetMixin,RetrieveAPIView):   			authentication_classes = [LoginAuth]			    

3.代码:
authenticate.py:
from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed
from .models import UserToken

class LoginAuth(BaseAuthentication):
    def authenticate(self, request):
        token = request.query_params.get('token')
        if token:
            user_token = UserToken.objects.filter(token=token).first()
            if user_token:
                return user_token.user,token
            else:
                raise AuthenticationFailed('token认证失败')
        else:
            raise AuthenticationFailed('token未上传')

views.py:
class BookDetailView(ViewSetMixin,RetrieveAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    authentication_classes = [LoginAuth]
"""
authentication_classes是在:RetrieveAPIView>>>GenericAPIView>>>APIView中，在APIView中完成了三大认证。
"""
serializer.py和models.py中代码未变

1.2 全局认证

在setting.py中设置:
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': ['app01.authenticate.LoginAuth']
}
此时我们发现即使是登陆也需要上传uuid字符串，不符合逻辑，需要在登陆类免除登录设置:
views.py:
class UserView(ViewSet):
    # 局部解除全局限制
    authentication_classes = []
    @action(methods=['POST'],detail=False,url_path='login',url_name='login')
    def login(self,request):
        username = request.data.get('username')
        password = request.data.get('password')
        user_obj = User.objects.filter(username=username,password=password).first()
        if user_obj:
            token = str(uuid.uuid4())
            UserToken.objects.update_or_create(user=user_obj,defaults={'token':token})
            return Response({'code':100,'msg':'登陆成功','token':token})
        else:
            return Response({'code':101,'msg':'用户名或密码错误'})

class BookView(ViewSetMixin,ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer

class BookDetailView(ViewSetMixin,RetrieveAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer

2.权限组件

2.1 局部权限

1.在某些软件上即使登陆成功，也不能访问，因为没有权限。这是由于在user表中增加了一个字段，用来区分是普通用户还是管理员(会员)。

2.步骤:
	1 写一个权限类，继承BasePermission
	2 重写has_permission方法，在该方法在中实现权限认证，在这方法中，request.user就是当前登录用户
	3 如果有权限，返回True
	4 没有权限，返回False，定制返回的中文： self.message='中文'
	5 局部使用和全局使用

3.代码:
models.py:
class User(models.Model):
    username = models.CharField(max_length=32)
    password = models.CharField(max_length=32)
    user_type = models.IntegerField(choices=((1,'超级会员'),(2,'普通用户')),default=2)

permissions.py:
from rest_framework.permissions import BasePermission

class MyPermission(BasePermission):
    def has_permission(self, request, view):
        if request.user.user_type == 1:
            return True
        else:
            # self.message是定制的中文提示
            self.message = '您是%s,无权访问' % request.user.get_user_type_display()
        # get_字段名_display()可以拿到字段中choice中的注释
            return False

views.py:
class BookDetailView(ViewSetMixin,RetrieveAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    authentication_classes = [LoginAuth]
    permission_classes = [MyPermission]

2.2 全局权限

如果很多视图类都要执行该权限，可以在设置中设置全局权限，并且可以对指定的视图类免除该权限:
settings.py:
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': ['app01.permissions.MyPermission']
}

views.py:
class BookDetailView(ViewSetMixin,RetrieveAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    authentication_classes = [LoginAuth]
    # 局部禁用
    permission_classes = []
permissions.py同上

3.频率组件

3.1 局部频率限制

1.方法:
	1.写一个频率类，继承SimpleRateThrottle
	2.重写get_cache_key方法，返回什么，就以什么做限制(一般以用户ip地址和id做限制)
	3.配置一个类属性：scope = 'zkz'
	4.在配置文件中配置:m:每分钟;h:每小时;d:每天
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {
        'zkz': '3/m',
    }
}
2.代码:
throttling.py:
from rest_framework.throttling import SimpleRateThrottle

class MyThrottle(SimpleRateThrottle):
    scope = 'zkz'
    def get_cache_key(self, request, view):
        # 拿到客户端的ip地址
        #  print(request.META.get('REMOTE_ADDR'))  # 127.0.0.1 本机访问是127.0.0.1
        return request.META.get('REMOTE_ADDR')
"""
从地址栏取数据:request.query_params.get('token')
从原生django的cookie中取:request.COOKIE.get('sessioned')
get请求从请求头中取:request.META.get('HTTP_TOKEN')(前端的请求头键是token,经过了包装)
"""

views.py:
class BookDetailView(ViewSetMixin,RetrieveAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    authentication_classes = [LoginAuth]
    permission_classes = [MyPermission]
    throttle_classes = [MyThrottle]

settings.py:
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {
        'zkz': '3/m',
    }
}

3.2 全局频率限制

settings.py:
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {
        'zkz': '3/m',
    },
    'DEFAULT_THROTTLE_CLASSES':
        ['app01.throttling.MyThrottle'],
}
视图类中如果不需要频率限制只需要修改:throttle_classes = []

4.过滤

4.1 过滤

只有查询所有才有过滤
方式一:必须要继承GenericAPIView及其子类:
from rest_framework.filters import SearchFilter
class BookView(ViewSetMixin,ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    filter_backends = [SearchFilter]
    search_fields=['name']
访问的路由要修改成:?search=xxx
eg:?search=三:表示name字段中带有san自的数据对象都可以被筛选出来

"""
search_fields也可以上传多个字段，多个字段内如果都有待匹配的字段，都可以匹配得到:
search_fields=['name','price']
"""

方式二:
利用django-filter模块:可以多个条件同时匹配:
views.py:
from django_filters.rest_framework import DjangoFilterBackend
class BookView(ViewSetMixin, ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    filter_backends = [DjangoFilterBackend]
    filterset_fields = ['name', 'price']

方式三:利用自定义过滤器:自定义一个py文件:filter.py，在里面编写过去条件，返回值是queryset
filter.py:
from rest_framework.filters import BaseFilterBackend

class MyFilter(BaseFilterBackend):
    def filter_queryset(self, request, queryset, view):
        # 可以自定义大于或者小于
        price = request.query_params.get('price__gt',None)
        if price:
            return queryset.filter(price__gt=price)
        else:
            return queryset

views.py:
class BookView(ViewSetMixin, ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    filter_backends = [MyFilter]  # 可以定制多个，从左往右排

5.排序

from rest_framework.filters import OrderingFilter

class BookView(ViewSetMixin, ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    # 可以先过滤在排序，也可以先排序在过滤，也可以只排序或过滤
    filter_backends = [MyFilter,OrderingFilter]
    ordering_fields = ['price']
# 路由:http://127.0.0.1:8000/api/v1/books/?ordering=price:升序
#http://127.0.0.1:8000/api/v1/books/?ordering=-price:降序

"""
也可以按照多个字段排序:
ordering_fields = ['id','price']
路由:http://127.0.0.1:8000/api/v1/books/?ordering=price,-id:按照价格升序，按照id降序
"""

6.分页

方式一:自定义一个分页类:
mypage.py:
from rest_framework.pagination import PageNumberPagination

class MyPage(PageNumberPagination):
    page_size = 2  # 每页显示2条
    page_query_param = 'page'  # page=10:查询第10页的数据
    page_size_query_param = 'size'  # page=10&size=5:查询10页每页显示5条
    max_page_size = 5  # 每页最大显示条数

views.py:
class BookView(ViewSetMixin, ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    filter_backends = [MyFilter,OrderingFilter]
    ordering_fields = ['id','price']
    # pagination_class只能选一种，所以不能加列表
    pagination_class = MyPage

方式二:
LimitOffset
class CommonLimitOffsetPagination(LimitOffsetPagination):
    default_limit = 3  # 每页显示2条
    limit_query_param = 'limit'  # limit=3   取3条
    offset_query_param = 'offset'  # offset=1  从第一个位置开始，取limit条
    max_limit = 5
    # offset=3&limit=2      0  1 2 3 4 5

方式三:
class CommonCursorPagination(CursorPagination):
    cursor_query_param = 'cursor'  # 查询参数
    page_size = 2  # 每页多少条
    ordering = 'id'  # 排序字段
# 配置在视图类上即可
class BookView(ViewSetMixin, ListAPIView):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    permission_classes = []
    authentication_classes = []
    throttle_classes = []
    # 之前的东西一样用 ,内置的分页类不能直接使用，需要继承，定制一些参数后才能使用
    # pagination_class = PageNumberPagination
    #基本分页方式(基本是这种，网页端)：http://127.0.0.1:8000/api/v1/books/?page=2&size=3

    # pagination_class = LimitOffsetPagination
    # 偏移分页 http://127.0.0.1:8000/api/v1/books/?limit=4&offset=1
    # 从第一条开始，取4条

    pagination_class = CommonCursorPagination
    # 游标分页，只能下一页，上一页，不能跳到中间，但它的效率最高，大数据量分页，使用这种较好