如何在 DRF 中有效地检查对象级权限？

Question

场景：在 DRF 中，我必须编写以下代码行为用户检查权限

class RetrieveCampaignListView(APIView) :

authentication_classes = [TokenAuthentication]
permission_classes = [IsAuthenticated]


def get(self, request , *args, **kwargs):

    if request.user.has_perm('campaign.view_campaign'):

        try:
            #some view code
        
        except:

            return Response({"status":False}, status=status.HTTP_404_NOT_FOUND)
    else:
        return Response({"status":"Sorry User is not permitted"})

但我想缩短

request.user.has_perm('campaign.view_camapign') and it's else condition

变成这样。

@check_permission('campaign.view_campaign') 

任何帮助都将受到高度重视。

Answer 1

您可以使用 DRF 自定义权限：

from rest_framework import permissions


class ViewCampaignPermission(permissions.BasePermission):
    message = 'Sorry User is not permitted'

    def has_permission(self, request, view):
        return request.user.has_perm('campaign.view_campaign'):

class RetrieveCampaignListView(APIView) :
    authentication_classes = [TokenAuthentication]
    permission_classes = [IsAuthenticated, ViewCampaignPermission]
    ...

见：https://www.django-rest-framework.org/api-guide/permissions/#custom-permissions

或者如果你真的想要一个装饰器，你可以使用类似的东西：

from functools import wraps
from rest_framework.views import APIView

def has_permission(permission):
    def has_permission_decorator(func):
        @wraps(func)
        def has_permission_wrapper(*args, **kwargs):
            request = args[0].request
            if not request.user.has_perm(permission):
                return Response(status='Sorry User is not permitted'})
            return func(*args, **kwargs)
        return has_permission_wrapper
    return has_permission_decorator


class RetrieveCampaignListView(APIView):
    @has_permission('campaign.view_campaign')
    def get(self, request, *args, **kwargs):
        pass

但这仅适用于一个权限字符串。