Django 用户认证与授权

from django.contrib.auth.models import User

# 创建用户
user = User.objects.create_user(
    username='john',
    email='john@example.com',
    password='password123'
)

# 创建超级用户
admin_user = User.objects.create_superuser(
    username='admin',
    email='admin@example.com',
    password='admin123'
)

# 验证用户
from django.contrib.auth import authenticate
user = authenticate(username='john', password='password123')
if user is not None:
    # 用户认证成功
    print(f"用户 {user.username} 认证成功")
else:
    # 认证失败
    print("认证失败")

from django.contrib.auth.models import AbstractUser
from django.db import models

class CustomUser(AbstractUser):
    # 添加额外字段
    phone_number = models.CharField(max_length=15, blank=True)
    date_of_birth = models.DateField(null=True, blank=True)
    profile_picture = models.ImageField(
        upload_to='profile_pics/',
        null=True,
        blank=True
    )

    # 自定义方法
    def get_full_name(self):
        return f"{self.first_name} {self.last_name}".strip()

    def __str__(self):
        return self.email  # 使用邮箱作为标识

    class Meta:
        # 按邮箱排序
        ordering = ['email']

from django import forms
from django.contrib.auth.forms import UserCreationForm
from django.contrib.auth.models import User
from .models import CustomUser

class UserRegisterForm(UserCreationForm):
    email = forms.EmailField(required=True)

    class Meta:
        model = User
        # 或者使用自定义用户模型
        # model = CustomUser
        fields = ['username', 'email', 'password1', 'password2']

    def clean_email(self):
        email = self.cleaned_data.get('email')
        if User.objects.filter(email=email).exists():
            raise forms.ValidationError("该邮箱已被注册")
        return email

class CustomUserRegisterForm(UserCreationForm):
    class Meta:
        model = CustomUser
        fields = ['username', 'email', 'phone_number', 'password1', 'password2']

        widgets = {
            'username': forms.TextInput(attrs={'class': 'form-control'}),
            'email': forms.EmailInput(attrs={'class': 'form-control'}),
            'phone_number': forms.TextInput(attrs={'class': 'form-control'}),
        }

from django.shortcuts import render, redirect
from django.contrib.auth import login
from django.contrib import messages
from .forms import UserRegisterForm

def register(request):
    if request.method == 'POST':
        form = UserRegisterForm(request.POST)
        if form.is_valid():
            # 保存用户
            user = form.save()

            # 可选：立即登录用户
            login(request, user)

            # 发送欢迎消息
            messages.success(
                request,
                f'账户创建成功！欢迎 {user.username}'
            )

            return redirect('home')
    else:
        form = UserRegisterForm()

    return render(request, 'accounts/register.html', {'form': form})

# 基于类的注册视图
from django.views.generic import CreateView
from django.urls import reverse_lazy

class RegisterView(CreateView):
    form_class = UserRegisterForm
    template_name = 'accounts/register.html'
    success_url = reverse_lazy('login')

    def form_valid(self, form):
        response = super().form_valid(form)
        messages.success(
            self.request,
            '注册成功！请登录您的账户。'
        )
        return response

from django.contrib.auth.decorators import (
    login_required,
    permission_required,
    user_passes_test
)
from django.http import HttpResponseForbidden

# 要求登录
@login_required
def profile(request):
    return render(request, 'accounts/profile.html')

# 要求特定权限
@permission_required('myapp.change_article', raise_exception=True)
def edit_article(request, article_id):
    # 编辑文章逻辑
    pass

# 要求多个权限
@permission_required(['myapp.add_article', 'myapp.change_article'])
def manage_articles(request):
    pass

# 自定义测试函数
def is_staff_user(user):
    return user.is_staff

@user_passes_test(is_staff_user)
def staff_dashboard(request):
    return render(request, 'staff/dashboard.html')

# 组合装饰器
@login_required
@permission_required('myapp.can_publish')
def publish_article(request, article_id):
    pass

from django.contrib.auth.mixins import (
    LoginRequiredMixin,
    PermissionRequiredMixin,
    UserPassesTestMixin
)
from django.views.generic import ListView, CreateView, UpdateView
from django.urls import reverse_lazy

# 要求登录
class UserProfileView(LoginRequiredMixin, ListView):
    model = User
    template_name = 'accounts/profile.html'

# 要求权限
class ArticleCreateView(PermissionRequiredMixin, CreateView):
    model = Article
    fields = ['title', 'content']
    template_name = 'articles/create.html'
    permission_required = 'myapp.add_article'
    success_url = reverse_lazy('article_list')

# 自定义测试
class StaffOnlyView(UserPassesTestMixin, ListView):
    model = User
    template_name = 'staff/users.html'

    def test_func(self):
        return self.request.user.is_staff

# 组合混入类
class ArticleUpdateView(LoginRequiredMixin, PermissionRequiredMixin, UpdateView):
    model = Article
    fields = ['title', 'content', 'is_published']
    template_name = 'articles/update.html'
    permission_required = 'myapp.change_article'
    success_url = reverse_lazy('article_list')

    # 对象级权限检查
    def get_queryset(self):
        queryset = super().get_queryset()
        if not self.request.user.is_staff:
            queryset = queryset.filter(author=self.request.user)
        return queryset

{% if user.is_authenticated %}
    <p>欢迎, {{ user.username }}!</p>
    <a href="{% url 'logout' %}">退出登录</a>
{% else %}
    <a href="{% url 'login' %}">登录</a>
    <a href="{% url 'register' %}">注册</a>
{% endif %}

{# 检查特定权限 #}
{% if perms.myapp.add_article %}
    <a href="{% url 'article_create' %}" class="btn btn-primary">
        写文章
    </a>
{% endif %}

{# 检查多个权限 #}
{% if perms.myapp.change_article or perms.myapp.delete_article %}
    <div class="admin-actions">
        {% if perms.myapp.change_article %}
            <a href="{% url 'article_edit' article.id %}">编辑</a>
        {% endif %}
        {% if perms.myapp.delete_article %}
            <a href="{% url 'article_delete' article.id %}">删除</a>
        {% endif %}
    </div>
{% endif %}

{# 检查用户组 #}
{% if user.groups.all.0.name == "Editors" %}
    <div class="editor-tools">
        <!-- 编辑工具 -->
    </div>
{% endif %}

# settings.py
INSTALLED_APPS = [
    # ...
    'django.contrib.sites',
    'allauth',
    'allauth.account',
    'allauth.socialaccount',
    'allauth.socialaccount.providers.google',
    'allauth.socialaccount.providers.github',
    # ...
]

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'allauth.account.auth_backends.AuthenticationBackend',
]

SITE_ID = 1

# allauth 配置
ACCOUNT_EMAIL_REQUIRED = True
ACCOUNT_EMAIL_VERIFICATION = 'mandatory'
ACCOUNT_AUTHENTICATION_METHOD = 'username_email'
LOGIN_REDIRECT_URL = '/'

# 社交账号配置
SOCIALACCOUNT_PROVIDERS = {
    'google': {
        'SCOPE': ['profile', 'email'],
        'AUTH_PARAMS': {'access_type': 'online'},
    },
    'github': {
        'SCOPE': ['user:email'],
    }
}

from django.urls import path, include

urlpatterns = [
    path('accounts/', include('allauth.urls')),
    # ...
]

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework_simplejwt.authentication.JWTAuthentication',
    ],
}

SIMPLE_JWT = {
    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=5),
    'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
    'ROTATE_REFRESH_TOKENS': True,
}

# views.py
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.permissions import IsAuthenticated

class ProtectedView(APIView):
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({"message": "这是受保护的数据"})

from django.contrib.auth.backends import BaseBackend
from django.contrib.auth import get_user_model

class EmailBackend(BaseBackend):
    def authenticate(self, request, username=None, password=None, **kwargs):
        UserModel = get_user_model()
        try:
            # 尝试通过邮箱查找用户
            user = UserModel.objects.get(email=username)
        except UserModel.DoesNotExist:
            try:
                # 回退到用户名
                user = UserModel.objects.get(username=username)
            except UserModel.DoesNotExist:
                return None

        # 验证密码
        if user.check_password(password):
            return user
        return None

    def get_user(self, user_id):
        UserModel = get_user_model()
        try:
            return UserModel.objects.get(pk=user_id)
        except UserModel.DoesNotExist:
            return None

AUTHENTICATION_BACKENDS = [
    'myapp.backends.EmailBackend',  # 自定义后端
    'django.contrib.auth.backends.ModelBackend',  # 默认后端
]