レッスン 10: 権限と認可

Django: 基本から上級まで

パート 3: 認証とセキュリティ

xdev.asia

1. DRF 組み込み権限

from rest_framework.permissions import (
    IsAuthenticated, IsAdminUser, IsAuthenticatedOrReadOnly,
)

class ProductViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticatedOrReadOnly]

# Global default
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.IsAuthenticated',
    ],
}

2. カスタム権限

from rest_framework.permissions import BasePermission, SAFE_METHODS

class IsOwnerOrReadOnly(BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True
        return obj.owner == request.user

class IsStaffOrAdmin(BasePermission):
    def has_permission(self, request, view):
        return request.user.role in ('admin', 'staff')

class ProductViewSet(viewsets.ModelViewSet):
    def get_permissions(self):
        if self.action in ['create', 'update', 'destroy']:
            return [IsAuthenticated(), IsStaffOrAdmin()]
        return [IsAuthenticatedOrReadOnly()]

3. Django グループと権限

from django.contrib.auth.models import Group, Permission

# Tạo group và gán permissions
editors = Group.objects.create(name='Editors')
perm = Permission.objects.get(codename='change_product')
editors.permissions.add(perm)

# Gán user vào group
user.groups.add(editors)

# Kiểm tra permission
user.has_perm('products.change_product')

# Custom model permission
class Product(models.Model):
    class Meta:
        permissions = [
            ('publish_product', 'Can publish product'),
            ('feature_product', 'Can feature product'),
        ]

4. オブジェクトレベルの権限

# pip install django-guardian
INSTALLED_APPS = [..., 'guardian']
AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'guardian.backends.ObjectPermissionBackend',
]

from guardian.shortcuts import assign_perm, get_objects_for_user

# Gán quyền cho object cụ thể
assign_perm('change_product', user, product)
assign_perm('view_product', group, product)

# Query objects user có quyền
products = get_objects_for_user(user, 'products.view_product')

5. 役割ベースのアクセス制御

class RoleBasedPermission(BasePermission):
    role_permissions = {
        'admin': ['*'],
        'manager': ['list', 'retrieve', 'create', 'update'],
        'staff': ['list', 'retrieve'],
        'customer': ['list', 'retrieve'],
    }

    def has_permission(self, request, view):
        if not request.user.is_authenticated:
            return False
        allowed = self.role_permissions.get(request.user.role, [])
        if '*' in allowed:
            return True
        return view.action in allowed

次の記事: ソーシャル認証とOAuth2。