Django中实现基于角色的权限管理与访问控制

# myapp/models.py
from django.db import models
from django.contrib.auth.models import User

class Department(models.Model):
    name = models.CharField(max_length=100, unique=True)

    def __str__(self):
        return self.name

class UserProfile(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    department = models.ForeignKey(Department, on_delete=models.SET_NULL, null=True, blank=True)

    def __str__(self):
        return self.user.username

class Dashboard(models.Model):
    name = models.CharField(max_length=200)
    description = models.TextField(blank=True)
    department = models.ForeignKey(Department, on_delete=models.CASCADE, related_name='dashboards')
    # 其他仪表盘相关字段

    class Meta:
        # 可以为仪表盘模型定义自定义权限，例如 'can_view_finance_dashboard'
        permissions = [
            ("can_view_finance_dashboard", "Can view finance department dashboard"),
            ("can_view_sales_dashboard", "Can view sales department dashboard"),
            # ... 其他部门仪表盘权限
        ]

    def __str__(self):
        return f"{self.name} ({self.department.name})"

# myapp/views.py
from django.contrib.auth.decorators import login_required, permission_required
from django.contrib.auth.mixins import PermissionRequiredMixin
from django.shortcuts import render, get_object_or_404
from .models import Dashboard, UserProfile

@login_required
@permission_required('myapp.view_dashboard', raise_exception=True) # 检查是否有查看任何Dashboard的权限
def company_dashboard_list(request):
    # 对于经理，他们将拥有此权限，可以查看所有仪表盘
    dashboards = Dashboard.objects.all()
    return render(request, 'myapp/dashboard_list.html', {'dashboards': dashboards})

# 对于普通用户，此方法不足以实现部门级限制，需要结合方法二

# myapp/views.py
from django.shortcuts import render, get_object_or_404
from django.contrib.auth.decorators import login_required
from django.http import Http404, HttpResponseForbidden
from .models import Dashboard, UserProfile, Department

@login_required
def department_dashboard_list(request):
    try:
        user_profile = request.user.userprofile
        user_department = user_profile.department
    except UserProfile.DoesNotExist:
        # 如果用户没有UserProfile，或者UserProfile没有关联部门，则禁止访问
        return HttpResponseForbidden("您没有关联的部门信息，无法查看仪表盘。")

    if not user_department:
        return HttpResponseForbidden("您的部门信息缺失，无法查看仪表盘。")

    # 经理可以查看所有仪表盘，但这里我们假设此视图专为普通用户设计
    # 如果是经理，可以重定向到company_dashboard_list或在这里显示所有
    # 简单起见，我们假设经理不会进入此视图，或者此视图会根据部门过滤

    # 过滤出用户所属部门的仪表盘
    department_dashboards = Dashboard.objects.filter(department=user_department)

    return render(request, 'myapp/department_dashboard_list.html', {
        'dashboards': department_dashboards,
        'user_department': user_department
    })

@login_required
def view_specific_dashboard(request, dashboard_id):
    dashboard = get_object_or_404(Dashboard, pk=dashboard_id)

    try:
        user_profile = request.user.userprofile
        user_department = user_profile.department
    except UserProfile.DoesNotExist:
        return HttpResponseForbidden("您没有关联的部门信息，无法查看此仪表盘。")

    # 检查用户是否是经理（假设经理组名为'Managers'）
    if request.user.groups.filter(name='Managers').exists():
        # 经理可以查看所有仪表盘
        pass
    elif user_department and dashboard.department == user_department:
        # 普通用户只能查看自己部门的仪表盘
        pass
    else:
        # 否则，禁止访问
        return HttpResponseForbidden("您无权访问此仪表盘。")

    return render(request, 'myapp/dashboard_detail.html', {'dashboard': dashboard})

# myapp/permissions.py
from django.contrib.auth.mixins import AccessMixin

class IsManagerOrDepartmentMember(AccessMixin):
    """
    允许经理访问，或者允许用户访问其所属部门的资源。
    """
    def dispatch(self, request, *args, **kwargs):
        if not request.user.is_authenticated:
            return self.handle_no_permission()

        # 检查用户是否是经理
        if request.user.groups.filter(name='Managers').exists():
            return super().dispatch(request, *args, **kwargs)

        # 检查用户是否有UserProfile和部门信息
        try:
            user_profile = request.user.userprofile
            user_department = user_profile.department
        except UserProfile.DoesNotExist:
            return self.handle_no_permission()

        if not user_department:
            return self.handle_no_permission()

        # 检查请求的资源是否属于用户的部门
        # 这里的逻辑需要根据具体的视图来调整
        # 例如，如果是针对某个Dashboard实例的视图
        dashboard_id = kwargs.get('dashboard_id')
        if dashboard_id:
            dashboard = get_object_or_404(Dashboard, pk=dashboard_id)
            if dashboard.department == user_department:
                return super().dispatch(request, *args, **kwargs)

        return self.handle_no_permission()

# myapp/views.py (使用mixin)
from django.views.generic import DetailView
from .permissions import IsManagerOrDepartmentMember

class DashboardDetailView(IsManagerOrDepartmentMember, DetailView):
    model = Dashboard
    template_name = 'myapp/dashboard_detail.html'
    pk_url_kwarg = 'dashboard_id' # 确保URL参数名匹配

    # get_object 方法可以进一步优化，避免不必要的数据库查询
    def get_object(self, queryset=None):
        obj = super().get_object(queryset)
        # 权限已经在dispatch中检查，这里仅返回对象
        return obj

<!-- myapp/dashboard_list.html 或 dashboard_detail.html -->
{% if user.is_authenticated %}
    {% if user.groups.filter(name='Managers').exists %}
        <p>您是经理，可以访问所有管理功能。</p>
        <!-- 显示经理专属内容 -->
    {% else %}
        <p>您是普通用户，只能查看您部门的仪表盘。</p>
        <!-- 显示普通用户专属内容 -->
    {% endif %}

    {% comment %}
    更精细的部门级权限检查，需要确保user.userprofile和user.userprofile.department存在
    {% endcomment %}
    {% if user.userprofile.department.name == 'Finance' %}
        <p>您是财务部的用户。</p>
    {% endif %}

    {% comment %} 检查用户是否有特定权限 (例如，自定义权限) {% endcomment %}
    {% if perms.myapp.can_view_finance_dashboard %}
        <p>您拥有查看财务仪表盘的权限。</p>
    {% endif %}

{% else %}
    <p>请登录以查看仪表盘。</p>
{% endif %}