class User(models.Model):

    # 用户表

    username = models.CharField(max_length=16)

    password = models.CharField(max_length=16)

    # 多对多的外键一般写在查询方便的那一边

    roles = models.ManyToManyField('Role', verbose_name='用户和角色关系表',blank=True)

class Role(models.Model):

    # 角色表

    username = models.CharField('角色',max_length=16)

    permissions = models.ManyToManyField('Permission', verbose_name='角色和权限关系表', blank=True)

class Permission(models.Model):

    # 权限表

    url = models.CharField('权限', max_length=64)

    title = models.CharField('标题', max_length=16)

# 权限表里面的url一定要加上 / / , 这样用正则的时候才能匹配成功

# 创建超级用户的命令

python manage.py createsuperuser

# 然后在admin文件中创建表

from django.contrib import admin

admin.site.register(models.Permission)

admin.site.register(models.User)

admin.site.register(models.Role

# 视图函数

def login(request):

    if request.method == 'POST':

        username = request.POST.get('username')

        password = request.POST.get('password')

        obj = models.User.objects.filter(username=username, password=password).first()

        if not obj:

            return render(request, 'login.html', {'error': '用户名或密码错误'})

        # 跨表查询用双下划线  ORM获取到权限信息 过滤掉权限为空的 去重

        permission_query = obj.roles.filter(permissions__url__isnull=False).values('permissions__url', 'permissions__title').distinct()

        # session的值需要是可序列化的, 需要把QuerySet变成列表

        request.session['permission'] = list(permission_query)

        request.session['is_login'] = True

        return redirect('index')

    return render(request,'login.html')

 from django.utils.deprecation import MiddlewareMixin

 from django.shortcuts import HttpResponse, redirect

 from django.conf import settings

 import re

 class RbacMiddleWare(MiddlewareMixin):

     def process_request(self,request):

         # 获取当前访问的页面

         url = request.path

         # 白名单

         for i in settings.WHITE_LIST:

             # match 匹配上得到一个对象,匹配不上返回None

             if re.match(i, url):

                 return

         # 获取登录状态

         is_login = request.session['is_login']

         # 没有登录跳转登录页面

         if not is_login:

             return redirect('login')

         # 免认证

         for i in settings.NO_PERMISSION_LIST:

             # match 匹配上得到一个对象,匹配不上返回None

             if re.match(i, url):

                 return

         # 获取当前用户的权限, 要用get去拿,没有显示None,[]就会报错

         permission_list = request.session.get('permission')

         # print(permission_list)

         # 权限的校验

         for permission in permission_list:

             # print('>>>>',permission)

             if re.match(f'^{permission["permissions__url"]}$', url):

                 return

         # 没有匹配成功

         return HttpResponse('你的level不够!!')

权限认证中间件

from django.conf import settings