Django 权限拒绝时返回自定义响应

Question

我尝试在Django中通过一个装饰器类来实现权限控制。在这里，我检查用户是否已经登录，并且还要查看用户的角色是什么（比如ADMIN、HQ_ADMIN等）。

这是我的代码：

class UserPermissions(permissions.BasePermission):

    def has_permission(self, request, view):
        if not request.user and request.user.is_authenticated():
            return False

        method = request.method
        authenticator = request._authenticator

        response = self.check_permission_roles(request)

        if(response == None):
            if method == 'POST' and isinstance(authenticator, BasicAuthentication):
                return True

            if method == 'PUT' and isinstance(authenticator, BasicAuthentication):
                return True

            if method == 'DELETE' and isinstance(authenticator, BasicAuthentication):
                return True

            if method == 'GET':
                return True

        return False


    def check_permission_roles(self, request):
        """ checks the roles from the logged-in user """

        headers =  {'Access-Control-Allow-Origin':'*'}

        logged_in_user_roles = request.user.roles
        new_roles = request.DATA[models.ROLES]

        # check roles for create ADMIN
        if models.ADMIN in new_roles:
            if models.ADMIN not in logged_in_user_roles:
                return Response("no right to create role: ADMIN", status=400, headers=headers)

        # check roles for create HQ_ADMIN
        if models.HQ_ADMIN in new_roles:
            if models.ADMIN not in logged_in_user_roles:
                if models.HQ_ADMIN not in logged_in_user_roles:
                    return Response("no right to create role: HQ_ADMIN", status=400, headers=headers)

        # check roles for create HQ_USER
        if models.HQ_USER in new_roles:
            if models.ADMIN not in logged_in_user_roles:
                if models.HQ_ADMIN not in logged_in_user_roles:
                    return Response("no right to create role: HQ_USER", status=400, headers=headers)

        # check roles for create WORKSHOP_USER
        if models.WORKSHOP_USER in new_roles:
            if models.ADMIN not in logged_in_user_roles:
                if models.HQ_ADMIN not in logged_in_user_roles:
                    if models.HQ_USER not in logged_in_user_roles:
                        return Response("no right to create role: WORKSHOP_USER", status=400, headers=headers)

        # check roles for create DRIVER
        if models.DRIVER in new_roles:
            if models.ADMIN not in logged_in_user_roles:
                if models.HQ_ADMIN not in logged_in_user_roles:
                    if models.HQ_USER not in logged_in_user_roles:
                        if models.WORKSHOP_USER not in logged_in_user_roles:
                            return Response("no right to create role: DRIVER", status=400, headers=headers)

        return None

现在，如果我发送一个POST请求，并且check_permission_roles方法返回的结果不是None，我希望Django能返回check_permission_roles函数的响应，而不是默认的响应（403，您没有权限执行此操作）。

我该如何阻止Django返回默认的响应，而是返回自定义的响应呢？

Answer 1

回答一个老问题

你可以创建一个自定义的异常处理器，在里面处理'权限被拒绝'的异常，并给出你想要的错误代码和信息。

def core_exception_handler(exc, context):
    response = exception_handler(exc, context)
    handlers = {
        'PermissionDenied': _handle_error,
    }
    exception_class = exc.__class__.__name__

    if exception_class in handlers:
        return handlers[exception_class](exc, context, response)

    return response

def _handle_error(exc, context, response):
    response.status_code=401 #setting response code as 401
    response.data = {
        'errors': response.data
   }

   return response

大概就是这样的。