怎么实现
这需要一个带参数的decorator类，需要传参。内部逻辑十分简单，检查token--检查用户--检查角色--检查权限匹配--搞定放行。
ps.抱歉我的英文十分chinglish哈哈。。
auth.py
class PrivilegeAuth(Resource):
"""
This class is used tobe a decoretor for other methods to check the
client's privilege by token.
Your method's 'required privilege' should be set as an argument of this
decoretor. And this 'required privilege' should have been in the
'privilege' table.
If your method's 'required privilege' is one of user's privileges,
user will be allowed to access the method, otherwise not.
ps. user's privilege is checked by his token.
"""
def __init__(self, privilegeRequired):
# argument 'privilegeRequired' is to set up your method's privilege
# name
self.privilegeRequired = privilegeRequired
super(PrivilegeAuth, self).__init__() def __call__(self, fn):
def wrapped(*args, **kwargs):
try:
rolesReq = Privilege.getFromPrivilegeName(
self.privilegeRequired).roles except:
msg = 'wrong privilege setting: privilege (' +\
self.privilegeRequired + ') doesnot set in any roles'
app.logger.error(utils.logmsg(msg)) raise utils.InvalidModuleUsage('wrong privilege setting') # get user's privileges by his token
# if token is in body, then:
# myreqparse = reqparse.RequestParser()
# myreqparse.add_argument('token')
# args = myreqparse.parse_args()
# if token is in headers, then:
token = request.headers.get('token') if not token:
msg = "you need a token to access"
raise utils.InvalidAPIUsage(msg)
[userId, roleIdList, msg] = User.tokenAuth(token) if not userId:
msg = msg + " when autherization"
raise utils.InvalidAPIUsage(msg) else:
currentUser = User.getValidUser(userId=userId) if not currentUser:
msg = "cannot find user when autherization"
raise utils.InvalidAPIUsage(msg) # user's privilege auth
for role in currentUser.roles: for roleReq in rolesReq: if role.role_id == roleReq.role_id: return fn(*args, **kwargs)
msg = "Privilege not Allowed."
app.logger.info(utils.logmsg(msg)) raise utils.InvalidAPIUsage(msg) return wrapped
作者：茶客furu声
链接：https://www.jianshu.com/p/5b1f69efefdf
