django認證系統和itsdangerous

django內置認證系統

1. create_user：創建用戶
2. authenticate：登錄驗證，用戶名密碼正確返回user對象，返回none
3. login: 記錄登錄狀態
4. logout: 退出用戶登錄
5. is_authenticated: 判斷用戶是否登錄, 主語是request.user
6. login_required裝飾器: 進行登錄判斷

django內置中間件： django.contrib.sessions.middleware.SessionMiddleware 就是用來給request加一個user屬性的，所以在后端views的request.user總有內容

自定義權限認證系統

models.py

from django.contrib.auth.models import User, Group
from django.contrib.auth.models import (
    BaseUserManager, AbstractBaseUser, PermissionsMixin
)
class PoliceManager(BaseUserManager):
    def create_user(self, number, name, department,password='1234qwer'):
        """
        Creates and saves a User with the given email, date of
        birth and password.
        """
        if not number:
            raise ValueError('Users must have an email address')

        user = self.model(
            number=number,
            name=name,
            department=department
        )

        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_superuser(self, number, name, department,password):
        """
        Creates and saves a superuser with the given email, date of
        birth and password.
        """
        user = self.create_user(
            number,
            password=password,
            name=name,
            department=department
        )
        user.is_superuser = True
        user.save(using=self._db)
        return user


class Police(AbstractBaseUser, PermissionsMixin):
    number = models.CharField(
        verbose_name='編號',
        max_length=255,
        unique=True,

    )
    name = models.CharField(max_length=64, verbose_name="姓名")
    department = models.CharField(max_length=64, verbose_name="部門")
    is_active = models.BooleanField(default=True)
    is_staff = models.BooleanField(default=True)
    #is_admin = models.BooleanField(default=False)
    # role = models.ManyToManyField("Role", blank=True, null=True)

    objects = PoliceManager()

    USERNAME_FIELD = 'number'
    REQUIRED_FIELDS = ['name']

    def get_full_name(self):
        # The user is identified by their email address
        return self.name

    def get_short_name(self):
        # The user is identified by their email address
        return self.name

    def __str__(self):              # __unicode__ on Python 2
        return self.name

    class Meta:
        db_table = 'police'

settings.py

AUTH_USER_MODEL = "phone_call.Police"

LOGIN_URL = '/account/login/'

itsdangerous

我們發送郵件的時候，可以把郵件和用戶關聯的信息放到數據庫存起來，也可以把用戶信息放到url里面，而且這個信息又得滿足時間會失效的問題，itsdangerous模塊可以完成這個功能。

from itsdangerous import TimedJSONWebSignatureSerializer as Serializer
from itsdangerous import SignatureExpired

serializer = Serializer(settings.SECRET_KEY, 3600)
try:
	info = serializer.loads(token)
	# 獲取待激活用戶的id
	user_id = info['confirm']

	# 根據id獲取用戶信息
	user = User.objects.get(id=user_id)
	user.is_active = 1
	user.save()

	# 跳轉到登錄頁面
	return redirect(reverse('user:login'))
except SignatureExpired as e:
	# 激活鏈接已過期
	return HttpResponse('激活鏈接已過期')