class User(models.Model):

     username = models.CharField(max_length=32)

     password = models.CharField(max_length=32)

     user_type_entry = (

         (1,"Delux"),

         (2,"SVIP"),

         (3,"VVIP"),

     )

     user_type = models.IntegerField(choices=user_type_entry)

     def __str__(self):

         return self.username

 class UserToken(models.Model):

     user = models.OneToOneField("User",on_delete=models.CASCADE)

     token = models.CharField(max_length=128)

 from rest_framework.authentication import BaseAuthentication

 from rest_framework.exceptions import APIException

 from app01.models import UserToken

 class UserAuth(BaseAuthentication):

     # 所有认证的逻辑都在authenticate中

     def authenticate(self, request):

         user_token = request.GET.get("token")

         token = UserToken.objects.filter(token=user_token).first()

         if token:

             return token.user, token.token

         else:

             raise APIException("没有认证！")

 class UserView(APIView):

     def post(self,request):

         # 定义返回消息

         response = dict()

         # 定义需要的用户信息

         fields = {"username", "password"}

         # 定义一个用户信息字典

         user_info = dict()

         if fields.issubset(set(request.data.keys())):

             for key in fields:

                 user_info[key] = request.data[key]

         user_obj = User.objects.filter(**user_info).first()

         if user_obj:

             access_token = get_random_str()

             UserToken.objects.update_or_create(user=user_obj,defaults={

                 "token": access_token

             })

             response["status_code"] = 200

             response["status_message"] = "登录成功"

             response["access_token"] = access_token

             response["user_role"] = user_obj.get_user_type_display()

         else:

             response["status_code"] = 201

             response["status_message"] = "登录失败，用户名或密码错误"

         return Response(response)

 from rest_framework.permissions import BasePermission

 class UserPerm(BasePermission):

     message = "您没有查看数据的权限！"

     def has_permission(self,request,view):

         if request.user.user_type == 3:

             return True

         return False

 class BookView(ModelViewSet):

     authentication_classes = [UserAuth]

     permission_classes = [UserPerm]

     queryset = Book.objects.all()

     serializer_class = BookSerializer