Restframework的认证，权限，限制，分页

from django.db import models

# 用户信息
class UserInfo(models.Model):
	username = models.CharField(max_length=32, unique=True)
	password = models.CharField(max_length=32)
	# 小整数字段
	type = models.SmallIntegerField(
		choices=((1,"普通用户"),(2,"VIP用户")),
		default=1
	)


# 用户认证
class Token(models.Model):
	token = models.CharField(max_length=32)
	user = models.OneToOneField(to="UserInfo")


# 评论表
class Comment(models.Model):
	content = models.CharField(max_length=128)
	user = models.ForeignKey(to='UserInfo', on_delete=models.CASCADE, default=1)　

from django.conf.urls import url
from django.contrib import admin
from app01 import views

urlpatterns = [
    url(r'^admin/', admin.site.urls),
    url(r'login/$', views.LoginView.as_view()),
]


from rest_framework.routers import DefaultRouter
router = DefaultRouter()
# 注册路由,表示路径comment对应视图函数CommentViewSet
router.register(r'comment', views.CommentViewSet)
urlpatterns += router.urls　　

import time
import hashlib
from app01 import models
from rest_framework.views import APIView
from rest_framework.response import Response
from app01 import app01_serializers     # 自定义的序列化
from rest_framework.viewsets import ModelViewSet

# 生成token函数
def get_token_code(username):
	"""
	根据用户名和时间戳生成用户登陆成功的随机字符串
	:param username:字符串格式的用户名
	:return:字符串格式的token
	"""
	timestamp = str(time.time())
	m = hashlib.md5(bytes(username,encoding="utf-8"))
	m.update(bytes(timestamp,encoding="utf-8"))
	return m.hexdigest()


class LoginView(APIView):
	"""
	1. 接收用户发过来(POST)的用户名和密码数据
	2. 校验用户名密码是否正确
		- 成功就返回登陆成功（发Token）
		- 失败就返回错误提示
	"""
	def post(self,request):
		res = {"code":0}
		username = request.data.get("username")
		password = request.data.get("password")
		user_obj = models.UserInfo.objects.filter(
			username=username,
			password=password,
		).first()
		if user_obj:
			token = get_token_code(username)
			# 保存token
			# 如果有记录就更新defaults里传的参数, 没有记录就用defaults里传的参数创建一条数据
			models.Token.objects.update_or_create(defaults={"token": token}, user=user_obj)
			# 将token返回给用户
			res["token"] = token
		else:
			res["token"] = 1
			res["error"] = "用户名或密码错误"
		return 	Response(res)


# 对文章进行增删改查操作
class CommentViewSet(ModelViewSet):
	queryset = models.Comment.objects.all()
	serializer_class = app01_serializers.CommentSerializer

from app01.models import Comment
from rest_framework import serializers


class CommentSerializer(serializers.ModelSerializer):
	class Meta:
		model = Comment
		fields = "__all__"

from app01 import models
from rest_framework.authentication import BaseAuthentication
# 导入处理REST框架引发的异常的模块
from rest_framework.exceptions import AuthenticationFailed


class MyAuth(BaseAuthentication):
	# 重写BaseAuthentication里的方法
	def authenticate(self, request):
		if request.method in ["POST","PUT",]:
			# 取token值
			token = request.data.get("token")
			# 去数据库查询有没有这个token
			token_obj = models.Token.objects.filter(token=token).first()
			if token_obj:
				# token_obj有2个属性,详见models.py中的Token。
				# return后面的代码，相当于分别赋值。例如a=1,b=2等同于a,b=1,2
				# return多个值，返回一个元组
				# 在rest framework内部会将这两个字段赋值给request，以供后续操作使用
				return token_obj.user, token
			else:
				raise AuthenticationFailed("无效的token")
		else:
			return None, None　　

# app01.utils.auth表示app01目录下的utils下的auth.py
from app01.utils.auth import MyAuth

class CommentViewSet(ModelViewSet):
	queryset = models.Comment.objects.all()
	serializer_class = app01_serializers.CommentSerializer
	authentication_classes = [MyAuth, ]  # 局部使用认证方法MyAuth

REST_FRAMEWORK = {
    # 表示app01-->utils下的auth.py里面的MyAuth类
    "DEFAULT_AUTHENTICATION_CLASSES": ["app01.utils.auth.MyAuth", ]
}