Django用户认证系统 组与权限解析

groups = models.ManyToManyField(Group, verbose_name=_('groups'),
  blank=True, help_text=_('The groups this user belongs to. A user will '
              'get all permissions granted to each of '
              'their groups.'),
  related_name="user_set", related_query_name="user")
user_permissions = models.ManyToManyField(Permission,
  verbose_name=_('user permissions'), blank=True,
  help_text=_('Specific permissions for this user.'),
  related_name="user_set", related_query_name="user")

myuser.groups = [group_list]
myuser.groups.add(group, group, ...)
myuser.groups.remove(group, group, ...)
myuser.groups.clear()
myuser.user_permissions = [permission_list]
myuser.user_permissions.add(permission, permission, ...)
myuser.user_permissions.remove(permission, permission, ...)
myuser.user_permissions.clear()

@python_2_unicode_compatible
class Permission(models.Model):
  """
  The permissions system provides a way to assign permissions to specific
  users and groups of users.
 
  The permission system is used by the Django admin site, but may also be
  useful in your own code. The Django admin site uses permissions as follows:
 
    - The "add" permission limits the user's ability to view the "add" form
     and add an object.
    - The "change" permission limits a user's ability to view the change
     list, view the "change" form and change an object.
    - The "delete" permission limits the ability to delete an object.
 
  Permissions are set globally per type of object, not per specific object
  instance. It is possible to say "Mary may change news stories," but it's
  not currently possible to say "Mary may change news stories, but only the
  ones she created herself" or "Mary may only change news stories that have a
  certain status or publication date."
 
  Three basic permissions -- add, change and delete -- are automatically
  created for each Django model.
  """
  name = models.CharField(_('name'), max_length=255)
  content_type = models.ForeignKey(ContentType)
  codename = models.CharField(_('codename'), max_length=100)
  objects = PermissionManager()
 
  class Meta:
    verbose_name = _('permission')
    verbose_name_plural = _('permissions')
    unique_together = (('content_type', 'codename'),)
    ordering = ('content_type__app_label', 'content_type__model',
          'codename')
 
  def __str__(self):
    return "%s | %s | %s" % (
      six.text_type(self.content_type.app_label),
      six.text_type(self.content_type),
      six.text_type(self.name))
 
  def natural_key(self):
    return (self.codename,) + self.content_type.natural_key()
  natural_key.dependencies = ['contenttypes.contenttype']

from django.db import models
 
class Vote(models.Model):
  ... 
  class Meta:
    permissions = (("can_vote", "Can Vote"),)

@python_2_unicode_compatible
class Group(models.Model):
  """
  Groups are a generic way of categorizing users to apply permissions, or
  some other label, to those users. A user can belong to any number of
  groups.
 
  A user in a group automatically has all the permissions granted to that
  group. For example, if the group Site editors has the permission
  can_edit_home_page, any user in that group will have that permission.
 
  Beyond permissions, groups are a convenient way to categorize users to
  apply some label, or extended functionality, to them. For example, you
  could create a group 'Special users', and you could write code that would
  do special things to those users -- such as giving them access to a
  members-only portion of your site, or sending them members-only email
  messages.
  """
  name = models.CharField(_('name'), max_length=80, unique=True)
  permissions = models.ManyToManyField(Permission,
    verbose_name=_('permissions'), blank=True)
 
  objects = GroupManager()
 
  class Meta:
    verbose_name = _('group')
    verbose_name_plural = _('groups')
 
  def __str__(self):
    return self.name
 
  def natural_key(self):
    return (self.name,)

group.permissions = [permission_list]
group.permissions.add(permission, permission, ...)
group.permissions.remove(permission, permission, ...)
group.permissions.clear()

from myapp.models import BlogPost
from django.contrib.auth.models import Group, Permission
from django.contrib.contenttypes.models import ContentType
 
content_type = ContentType.objects.get_for_model(BlogPost)
permission = Permission.objects.create(codename='can_publish',
                    name='Can Publish Posts',
                    content_type=content_type)

from django.contrib.auth.models import Permission, User
from django.shortcuts import get_object_or_404 
def user_gains_perms(request, user_id):
  user = get_object_or_404(User, pk=user_id)
  #权限检查会缓存现在的权限集
  user.has_perm('myapp.change_bar')
 
  permission = Permission.objects.get(codename='change_bar')
  user.user_permissions.add(permission) 
  # 检查权限缓存集
  user.has_perm('myapp.change_bar') # False 
  # 请求新实例
  user = get_object_or_404(User, pk=user_id) 
  # Permission cache is repopulated from the database
  user.has_perm('myapp.change_bar') # True 
  ...

from django.contrib.auth.decorators import permission_required
@permission_required('polls.can_vote', login_url='/loginpage/')
def my_view(request):
  ...

{{ perms.foo }}

{{ perms.foo.can_vote }}

{% if perms.foo %}
  <p>You have permission to do something in the foo app.</p>
  {% if perms.foo.can_vote %}
    <p>You can vote!</p>
  {% endif %}
  {% if perms.foo.can_drive %}
    <p>You can drive!</p>
  {% endif %}
{% else %}
  <p>You don't have permission to do anything in the foo app.</p>
{% endif %}

{% if 'foo' in perms %}
  {% if 'foo.can_vote' in perms %}
    <p>In lookup works, too.</p>
  {% endif %}
{% endif %}