drf-access-policy 0.4.2

django rest-访问策略

该项目为django rest框架项目中的访问控制管理带来了一种去极化的、有组织的方法。每个视图集或基于函数的视图都可以为公开的资源分配显式策略。不再需要深入查看视图或seralizer来理解访问逻辑——这都是一种不太技术涉众能够理解的格式。如果您熟悉其他去极化访问模型，例如aws的iam，那么语法将非常熟悉。

简而言之，您可以开始这样表达访问规则：

classArticleAccessPolicy(AccessPolicy):statements=[{"action":["list","retrieve"],"principal":"*","effect":"allow"},{"action":["publish","unpublish"],"principal":["group:editor"],"effect":"allow"}]

这个项目有完整的测试覆盖范围，基本的accesspolicy类只有大约150行代码：这里没有魔法。

目录：

• 安装
• 示例1:viewset的策略
• example 2:基于功能的视图的策略
• 文档
  • 语句元素
    • 主体
    • 操作
    • 效果
    • 条件
  • 策略评估逻辑
  • 对象级权限/条件
  • 多租户数据-限制查询集rel="nofollow">多租户数据/限制查询集
  • 附加到视图集和基于功能的视图
  • 从外部源加载语句
  • 定制用户组/角色值
  • 定制主体前缀
• 更改日志
• 测试
• 许可证

设置

pip install drf-access-policy

要定义策略，请导入accesspolicy并将其子类化：

fromrest_access_policyimportAccessPolicyclassShoppingCartAccessPolicy(AccessPolicy):statements=[]# Now read on...

示例1:viewset的策略

简而言之，策略由声明"主体"可以或不能在资源上执行什么"操作"的"语句"组成，并带有可选的自定义检查，可以检查当前请求的任何细节。

下面还有两个关键点需要记住：

• 默认情况下，所有访问都被隐式拒绝
• 任何具有"deny"效果的语句都将覆盖任何和所有"allow"语句

现在让我们看看文章端点下面的策略，它是通过视图集提供的。

classArticleAccessPolicy(AccessPolicy):statements=[{"action":["list","retrieve"],"principal":"*","effect":"allow"},{"action":["publish","unpublish"],"principal":["group:editor"],"effect":"allow"},{"action":["delete"],"principal":["*"],"effect":"allow","condition":"is_author"},{"action":["*"],"principal":["*"],"effect":"deny","condition":"is_happy_hour"}]defis_author(self,request,view,action)->bool:article=view.get_object()returnrequest.user==article.authordefis_happy_hour(self,request,view,action)->bool:now=datetime.datetime.now()returnnow.hour>=17andnow.hour<=18:@classmethoddefscope_queryset(cls,request,queryset):ifrequest.user.groups.filter(name='editor').exists():returnquerysetreturnqueryset.filter(status='published')classArticleViewSet(ModelViewSet):# Just stick the policy here, as you would do with# regular DRF "permissions"permission_classes=(ArticleAccessPolicy,)# Helper property here to make get_queryset logic# more explicit@propertydefaccess_policy(self):returnself.permission_classes[0]# Ensure that current user can only see the models # they are allowed to seedefget_queryset(self):returnself.access_policy.scope_queryset(self.request,Articles.objects.all())@action(method="POST")defpublish(self,request,*args,**kwargs):pass@action(method="POST")defunpublish(self,request,*args,**kwargs):pass# the rest of you view set definition...

这些操作对应于视图集中方法的名称。

在上面的示例中，设置了以下规则：

• 任何人都可以列出和检索文章
• 编辑组中的用户可以发布和取消发布文章
• 为了删除一篇文章，用户必须是文章的作者。注意condition方法是如何在视图上调用get_object（）来获取当前文章的。
• 如果条件是"快乐时光"，计算结果为true，则不允许任何人执行任何操作。

此外，我们在scope\u queryset方法中有一些逻辑，用于筛选哪些模型对当前用户可见。在这里，我们希望用户只看到已发布的文章，除非他们是一个编辑器，在这种情况下，他们可以看到任何状态的文章。您必须记住从视图中调用此方法，因此我建议将其作为安全审核清单的一部分进行查看。

示例2：基于功能的视图的策略

您还可以使用基于功能的视图制定策略。要在策略语句中引用的操作是函数的名称。您还可以将多个功能捆绑到同一策略中，如下例所示。

classAuditLogsAccessPolicy(AccessPolicy):statements=[{"action":["search_logs"],"principal":"group:it_staff","effect":"allow"},{"action":["download_logs"],"principal":["group:it_admin"],"effect":"allow"}]@api_view(["GET"])@permission_classes((AuditLogsAccessPolicy,))defsearch_logs(request):## you logic here...pass@api_view(["GET"])@permission_classes((AuditLogsAccessPolicy,))defdownload_logs(request):## you logic here...pass

文档

语句元素

校长

classAccountAccessPolicy(AccessPolicy):statements=[## ... other statements ...{"action":["withdraw"],"principal":["*"],"effect":"allow","condition":["balance_is_positive","user_must_be:owner"]},{"action":["upgrade_to_gold_status"],"principal":["*"],"effect":"allow","condition":["user_must_be:account_advisor"]}## ... other statements ...]defbalance_is_positive(self,request,view,action)->bool:account=view.get_object()returnaccount.balance>0defuser_must_be(self,request,view,action,field:str)->bool:account=view.get_object()returngetattr(account,field)==request.user

classPhotoAlbumAccessPolicy(AccessPolicy):# ... statements, etc ...# Users can only access albums they have created@classmethoddefscope_queryset(cls,request,qs):returnqs.filter(creator=request.user)classTodoListAccessPolicy(AccessPolicy):# ... statements, etc ...# Users can only access todo lists owned by their organization@classmethoddefscope_queryset(cls,request,qs):user_orgs=request.user.organizations.all()returnqs.filter(org__id__in=user_orgs)

classArticleViewSet(ModelViewSet):permission_classes=(ArticleAccessPolicy,)

@api_view(["GET"])@permission_classes((ArticleAccessPolicy,))defcreate_article(request):## you logic here...pass

classArticleAccessPolicy(AccessPolicy):statements=[{"action":["list","retrieve"],"principal":"*","effect":"allow"},{"action":["publish","unpublish"],"principal":["group:editor"],"effect":"allow"}]

classArticleAccessPolicy(AccessPolicy):statements=[{"action":["list","retrieve"],"principal":"*","effect":"allow"},{"action":["publish","unpublish"],"principal":["group:editor"],"effect":"allow"}]

classArticleAccessPolicy(AccessPolicy):statements=[{"action":["list","retrieve"],"principal":"*","effect":"allow"},{"action":["publish","unpublish"],"principal":["group:editor"],"effect":"allow"}]