Flask 構建微電影視頻網站(五)

基於角色的訪問控制

權限管理

class AuthForm(FlaskForm):
    name = StringField(
        label='權限',
        validators=[
            DataRequired("請輸入權限!"),
        ],
        description='權限',
        render_kw={
            "class": "form-control",
            "placeholder": "請輸入權限！"
        }
    )

    url = StringField(
        label='權限地址',
        validators=[
            DataRequired("請輸入權限地址!"),
        ],
        description='權限地址',
        render_kw={
            "class": "form-control",
            "placeholder": "請輸入權限地址！"
        }
    )
    submit = SubmitField(
        '編輯',
        render_kw={
            "class": "btn btn-primary",
        }
    )

添加權限

@admin.route('/auth/add/', methods=['GET', 'POST'])
@admin_login_req
def auth_add():
    form= AuthForm()
    if form.validate_on_submit():
        data = form.data
        auth = Auth(
            name=data['name'],
            url=data['url']
        )

        db.session.add(auth)
        db.session.commit()

        flash('權限添加成功!', 'info')
    return render_template('admin/auth_add.html',form=form)

權限列表

@admin.route('/auth/list/<int:page>/')
@admin_login_req
def auth_list(page=1):
    if page <= 0:
        page = 1
    page_data = Auth.query.order_by(
        Auth.addtime.desc()
    ).paginate(page=page, per_page=10)
    return render_template('admin/auth_list.html',page_data=page_data)

刪除權限

@admin.route('/auth/del/<int:id>/')
@admin_login_req
def auth_del(id=None):
    auth = Auth.query.get_or_404(int(id))
    db.session.delete(auth)
    db.session.commit()
    flash('權限刪除成功!', 'info')
    return redirect(url_for('admin.auth_list', page=1))

編輯權限

@admin.route('/auth/edit/<int:id>/', methods=['GET', 'POST'])
@admin_login_req
def auth_edit(id=None):
    form = AuthForm()
    auth = Auth.query.get_or_404(int(id))

    if form.validate_on_submit():
        data = form.data
        auth.name =data['name']
        auth.url=data['url']

        db.session.add(auth)
        db.session.commit()

        flash('權限修改爲功!', 'info')
        return redirect(url_for('admin.auth_edit', id=id))
    return render_template('admin/auth_edit.html',form=form, auth=auth)

修改對應的前端文件

角色管理

class RoleForm(FlaskForm):
    name = StringField(
        label='角色名稱',
        validators=[
            DataRequired("請輸入角色名稱!"),
        ],
        description='角色名稱',
        render_kw={
            "class": "form-control",
            "placeholder": "請輸入角色名稱！"
        }
    )

    auths = SelectMultipleField(
        label='權限列表',
        validators=[
            DataRequired("請選擇權限!"),
        ],
        coerce=int,
        choices=[(v.id, v.name) for v in auths],
        description='權限列表',
        render_kw={
            "class": "form-control",
        }
    )
    submit = SubmitField(
        '編輯',
        render_kw={
            "class": "btn btn-primary",
        }
    )

添加角色

@admin.route('/role/add/', methods=['GET', 'POST'])
@admin_login_req
def role_add():
    form = RoleForm()
    if form.validate_on_submit():
        data=form.data
        role = Role(
            name=data['name'],
            auths=','.join(map(lambda v:str(v), data['auths']))
        )

        db.session.add(role)
        db.session.commit()
        flash('角色添加成功!', 'info')
    return render_template('admin/role_add.html',form=form)

角色列表

@admin.route('/role/list/<int:page>/')
@admin_login_req
def role_list(page=1):
    if page <= 0:
        page = 1
    page_data = Role.query.order_by(
        Role.addtime.desc()
    ).paginate(page=page, per_page=10)
    return render_template('admin/role_list.html',page_data=page_data)

刪除角色

@admin.route('/role/del/<int:id>/')
@admin_login_req
def role_del(id=None):
    role = Role.query.get_or_404(int(id))
    db.session.delete(role)
    db.session.commit()
    flash('角色刪除成功!', 'info')
    return redirect(url_for('admin.role_list', page=1))

修改權限

@admin.route('/role/edit/<int:id>/', methods=['GET', 'POST'])
@admin_login_req
def role_edit(id=None):
    form = RoleForm()
    role = Role.query.get_or_404(int(id))

    if request.method == 'GET':
        auths = role.auths
        form.auths.data = list(map(lambda x: int(x), auths.split(',')))

    if form.validate_on_submit():
        data=form.data
        role.name = data['name']
        role.auths = ','.join(map(lambda v:str(v), data['auths']))

        db.session.add(role)
        db.session.commit()
        flash('角色修改爲功!', 'info')
    return render_template('admin/role_edit.html',form=form,role=role)

修改對應的前端文件

管理員管理

class AdminForm(FlaskForm):
    name = StringField(
        label='管理員名稱',
        validators=[
            DataRequired("請輸入管理員名稱!"),
        ],
        description='管理員名稱',
        render_kw={
            "class": "form-control",
            "placeholder": "請輸入管理員名稱！"
        }
    )

    pwd = PasswordField(
        label='管理員密碼',
        validators=[
            DataRequired("請輸入管理員密碼!")
        ],
        description="管理員密碼",
        render_kw={
            "class": "form-control",
            "placeholder": "請輸入管理員密碼！",
            "required": "required"
        }
    )

    repwd = PasswordField(
        label='管理員重複密碼',
        validators=[
            DataRequired("請輸入管理員重複密碼!"),
            EqualTo('pwd', message='兩次密碼不一致!'),
        ],
        description="管理員重複密碼",
        render_kw={
            "class": "form-control",
            "placeholder": "請輸入管理員重複密碼！",
            "required": "required"
        }
    )

    role_id=SelectField(
        label='所屬角色',
        validators=[
            DataRequired("請選擇角色!")
        ],
        coerce=int,
        choices=[(v.id, v.name) for v in roles],
        description="所屬角色",
        render_kw={
            "class": "form-control",
        }
    )

    submit = SubmitField(
        '編輯',
        render_kw={
            "class": "btn btn-primary",
        }
    )

添加管理員

@admin.route('/admin/add/', methods=['GET', 'POST'])
@admin_login_req
def admin_add():
    form = AdminForm()

    from werkzeug.security import generate_password_hash

    if form.validate_on_submit():
        data = form.data
        admin = Admin(
            name=data['name'],
            pwd=generate_password_hash(data['pwd']),
            role_id=data['role_id'],
            is_super=1,
        )

        db.session.add(admin)
        db.session.commit()

        flash('管理員添加成功!', 'info')

    return render_template('admin/admin_add.html',form=form)

管理員列表

@admin.route('/admin/list/<int:page>/')
@admin_login_req
def admin_list(page=1):
    if page <= 0:
        page = 1
    page_data = Admin.query.join(
        Role
    ).filter(
        Role.id==Admin.role_id
    ).order_by(
        Admin.addtime.desc()
    ).paginate(page=page, per_page=10)
    return render_template('admin/admin_list.html',page_data=page_data)

修改對應的前端代碼

訪問權限控制

def admin_auth(func):
    @wraps(func)
    def decorated_function(*args, **kwargs):
        admin = Admin.query.join(
            Role
        ).filter(
            Role.id == Admin.role_id,
            Admin.id==session['admin_id']
        ).first()

        auths = admin.role.auths
        auths = list(map(lambda x: int(x), auths.split(',')))

        auth_list = Auth.query.all()
        urls = [v.url for v in auth_list for val in auths if val == v.id]
        rule = request.url_rule

        print(urls)
        print(rule)

        if str(rule) not in urls:
            abort(404)
        return func(*args, **kwargs)
    return decorated_function

給視圖函數添加裝飾器,像這樣

@admin.route('/tag/list/<int:page>/')
@admin_login_req
@admin_auth
def tag_list(page=1):
    ...