django rest framework 学习笔记-实战商城

01项目环境搭建_哔哩哔哩_bilibili 本博客借鉴至大佬的视频学习笔记

# 创建项目
django-admin startproject MyShop# 创建app
E:\desktop\my_drf\MyShop>django-admin startapp goodsE:\desktop\my_drf\MyShop>django-admin startapp orderE:\desktop\my_drf\MyShop>django-admin startapp cartE:\desktop\my_drf\MyShop>django-admin startapp users

创建apps文件夹放入的上面应用

# 注册应用
'rest_framework',
'corsheaders',
'apps.users',
'apps.goods',
'apps.cart',
'apps.order'# 配置mysql
DATABASES = {'default': {'ENGINE': 'django.db.backends.mysql','NAME': 'shop','USER': 'root','PASSWORD': 'pass','HOST': 'localhost','PORT': 3306}
}# 允许所有的用户跨域请求
CORS_ORIGIN_ALLOW_ALL = True# 中文及时区调整
LANGUAGE_CODE = 'zh-hans'TIME_ZONE = 'Asia/Shanghai'

创建shop数据库

mysql> create database shop charset=utf8;
Query OK, 1 row affected, 1 warning (0.01 sec)

公共表设计:

# 定义继承时，需要setting自定义用户类模型
AUTH_USER_MODEL = 'users.User'

# 创建 common目录下db.py文件
from django.db import modelsclass BaseModel(models.Model):""" 抽象的模型基类，定义公共模型字段 """create_time = models.DateTimeField(auto_now_add=True,verbose_name='创建时间')update_time = models.DateTimeField(auto_now=True,verbose_name='更新时间')is_delete = models.BooleanField(default=False,verbose_name='删除标记')class Meta:# 声明这个是抽象模型，生成迁移文件时，不会在数据库生成表abstract = Trueverbose_name_plural = '公共字段表'db_table = 'BaseTabel'

用户表结构设计

from django.db import models
from django.contrib.auth.models import AbstractUser  # django自带的用户认证模型
from common.db import BaseModel
# Create your models here.class User(AbstractUser,BaseModel):"""用户表"""mobile = models.CharField(verbose_name='手机号',help_text='手机号',max_length=11,default='',blank=True)avatar = models.ImageField(verbose_name='用户头像',help_text='用户头像',max_length=30,null=True,blank=True)class Meta:db_table = 'users'verbose_name = '用户表'class Addr(models.Model):"""收货地址模型"""user = models.ForeignKey('User',verbose_name='所属用户',on_delete=models.CASCADE)phone = models.CharField(verbose_name='手机号',help_text='手机号',max_length=11,null=True,blank=True)name = models.CharField(verbose_name='联系人',help_text='联系人',max_length=20,null=True,blank=True)province = models.CharField(verbose_name='省份',help_text='省份',max_length=20,null=True,blank=True)city = models.CharField(verbose_name='城市',help_text='城市',max_length=20,null=True,blank=True)country = models.CharField(verbose_name='区县',help_text='区县',max_length=20,null=True,blank=True)is_default = models.BooleanField(verbose_name='是否为默认地址',help_text='省份',max_length=30,default=False)class Meta:db_table = 'addr'verbose_name = '收货地址表'class Area(models.Model):"""省市区县地址模型"""pid = models.ImageField(verbose_name='上级ID',help_text='上级ID',max_length=20,null=True,blank=True)name = models.CharField(verbose_name='地区名',help_text='地区名',max_length=20,null=True,blank=True)level = models.CharField(verbose_name='区域等级',help_text='区域等级',max_length=20,null=True,blank=True)class Meta:db_table = 'area'verbose_name = '地区表'class VerifyCode(models.Model):"""验证码模型"""mobile = models.CharField(verbose_name='手机号码',help_text='手机号码',max_length=11,null=True,blank=True)code = models.CharField(verbose_name='验证码',help_text='验证码',max_length=6,null=True,blank=True)create_time = models.DateTimeField(auto_now_add=True,verbose_name='生成时间',help_text='生成时间')class Meta:db_table = 'verifycode'verbose_name = '手机验证码表'

执行迁移文件，生成表结构

E:\desktop\my_drf\MyShop>python manage.py makemigrations
Migrations for 'users':
apps\users\migrations\0001_initial.py
    - Create model User
    - Create model Area
    - Create model VerifyCode
    - Create model Addr

E:\desktop\my_drf\MyShop>python manage.py migrate

结果展示：

用户鉴权：使用JWT认证

创建超级管理员用户

E:\desktop\my_drf\MyShop>python manage.py createsuperuser
用户名: pass
电子邮件地址: pass@qq.com
Password:
Password (again):

JWT权限认证配置

# 注册jwt
'rest_framework_simplejwt',# 配置setting
REST_FRAMEWORK = {# DRF配置鉴权方式'DEFAULT_AUTHENTICATION_CLASSES': ('rest_framework_simplejwt.authentication.JWTAuthentication','rest_framework.authentication.BasicAuthentication',  # Basic 认证'rest_framework.authentication.SessionAuthentication',  # Session 认证),
}# 配置总路由urlspath('api/users/',include('apps.users.urls'))# user url 配置
from rest_framework_simplejwt.views import TokenVerifyView, TokenRefreshView, TokenObtainPairViewurlpatterns = [path('login/', TokenObtainPairView.as_view(), name='login'),  # 登录path('token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),  # token 刷新path('token/verify/', TokenVerifyView.as_view(), name='token_verify'),  # token 效验
]

配置Postman环境变量

Postman运行示图：

自定义用户登录功能的实现

from rest_framework_simplejwt.views import TokenObtainPairView# Create your views here.
class LoginView(TokenObtainPairView):def post(self, request, *args, **kwargs):serializer = self.get_serializer(data=request.data)try:serializer.is_valid(raise_exception=True)except TokenError as e:raise InvalidToken(e.args[0])# 自定义登录成功后返回的数据信息result = serializer.validated_dataresult['id'] = serializer.user.idresult['email'] = serializer.user.emailresult['mobile'] = serializer.user.mobileresult['username'] = serializer.user.usernameresult['token'] = result.pop('access')return Response(serializer.validated_data, status=status.HTTP_200_OK)

运行结果：

用户注册功能的实现

import re
from rest_framework import status
from rest_framework.response import Response
from rest_framework_simplejwt.exceptions import TokenError, InvalidToken
from rest_framework_simplejwt.views import TokenObtainPairView
from rest_framework.views import APIView
from .models import User
# Create your views here.
class RegisterView(APIView):def post(self,request):"""注册：接收参数并校验、创建用户 """username = request.data.get('username')password = request.data.get('password')email = request.data.get('email')password_confirmation = request.data.get('password_confirmation')# 检验print(all([username,password,email,password_confirmation]))print([username,password,email,password_confirmation])if not all([username,password,email,password_confirmation]):return Response({'error':'所有参数不能为空'},status=status.HTTP_422_UNPROCESSABLE_ENTITY)# 检验用户是否已存在if User.objects.filter(username=username).exists():return Response({'error':'用户名已存在'},status=status.HTTP_422_UNPROCESSABLE_ENTITY)# check passwordif password !=password_confirmation:return Response({'error':'两次输入的密码不一致'},status=status.HTTP_422_UNPROCESSABLE_ENTITY)if not (6<len(password)<18):return Response({'error':'密码长度需要在6-18位之间'},status=status.HTTP_422_UNPROCESSABLE_ENTITY)# check emailif User.objects.filter(email=email).exists():return Response({'error':'该邮箱已被他人注册'},status=status.HTTP_422_UNPROCESSABLE_ENTITY)if not re.match(r'^[a-z0-9][\w.\-]*@[a-z0-9\-]+(\.[a-z]{2,5}){1,2}$',email):return Response({'error':'邮箱格式有误'},status=status.HTTP_422_UNPROCESSABLE_ENTITY)# 创建用户obj = User.objects.create_user(username=username,email=email,password=password)res = {'username':username,'id':obj.id,'email':obj.email}return Response(res,status=status.HTTP_201_CREATED)# url 配置
path('register/', RegisterView.as_view(), name='register'),  # 注册

多字段用户登录功能支持

# 规范化格式，创建authentication.py放于common目录下from django.contrib.auth.backends import ModelBackend
from apps.users.models import User
from django.db.models import Q
from rest_framework import serializersclass Authentication(ModelBackend):"""自定义用户登录的认证类，实现多字段登录"""def authenticate(self, request, username=None, password=None, **kwargs):"""支持使用手机号/邮箱/用户名登录"""try:user = User.objects.get(Q(username=username) | Q(mobile=username) | Q(email=username))except:raise serializers.ValidationError({'error':'未找到该用户!'})# check passwordif user.check_password(password):return userraise serializers.ValidationError({'error':'密码错误'})# 配置setting 使用
# 使用自定义的认证类进行身份登录,登录时验证信息
AUTHENTICATION_BACKENDS =['common.authentication.Authentication',
]

注意上述代码使用 User 的导包方式

from apps.users.models import User √

from django.contrib.auth.models import User ×

因当前在setting设置的规范 AUTH_USER_MODEL = 'users.User'

第二行代码可能会导致找不到用户而抛出异常，此时的解决方法

from django.contrib.auth.models import User
from django.contrib.auth import get_user_modelUser= get_user_model()  # 重写获取注册的app模型类

运行结果展示：

刷新 jwt token：当上述token失效时可以通过刷新refresh得到新的token

要求：检查参数不为空、检验密码账号正确、登录成功返回token，支持多字段登录

# 配置urls文件
from rest_framework_simplejwt.views import TokenRefreshView,TokenVerifyViewurlpatterns = [path('token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),  # 刷新tokenpath('token/verify/', TokenVerifyView.as_view(), name='token_verify'),  # 检验token
]

获取用户信息，要求如下

获取用户信息时进行权限检验，需要在请求中添加认证字段
防止越权篡改数据

# 定义序列化器
from rest_framework import serializers
from apps.users.models import Userclass UserSerializer(serializers.ModelSerializer):"""用户的模型序列化器"""class Meta:model = Userfields = ['id','username','email','mobile','avatar','last_name']# 定义视图
from .models import User
from .serializers import UserSerializer
from rest_framework.viewsets import GenericViewSet,mixins# Create your views here.
class UserView(GenericViewSet,mixins.RetrieveModelMixin):"""用户相关的操作视图集"""queryset = User.objects.all()serializer_class = UserSerializer# 配置urls
path('users/<int:pk>/',UserView.as_view({'get':'retrieve'}), name='user_get'),  # 检验token

运行结果展示：

增加权限管理，防止当前用户访问其他用户

from rest_framework import permissions
class UserPermissions(permissions.BasePermission):"""Custom permission to only allow owners of an object to edit it."""def has_object_permission(self, request, view, obj):# 判断是否是管理员if request.user.is_superuser:return True# 判断当前的用户对象和登录的用户对象是否是同一个，防止越权return obj == request.user# 更新配置视图文件
permission_classes = [IsAuthenticated,UserPermissions] # 设置权限认证

更多详细权限配置：4 - Authentication and permissions - Django REST framework

上传用户头像-

要求：检验参数avatar、文件大小不超过300kb、返回的url可以访问图片，防止用户越权

# 头像文件上传视图
class UserView(GenericViewSet,mixins.RetrieveModelMixin):"""用户相关的操作视图集"""queryset = User.objects.all()serializer_class = UserSerializerpermission_classes = [IsAuthenticated,UserPermissions] # 设置权限认证def upload_avatar(self,request,*args,**kwargs):"""上传头像"""obj= self.get_object()avatar = request.data.get('avatar')if not avatar:return Response({'error':'上传文件不可为空!'},status=status.HTTP_400_BAD_REQUEST)size = avatar.sizeif size >1024*300:return Response({'error': '上传文件大小不可超过300kb!'}, status=status.HTTP_400_BAD_REQUEST)# partial 只对部分字段（上传的字段）进行校验serializer = self.get_serializer(obj,data={'avatar':avatar},partial=True)serializer.is_valid(raise_exception=True)serializer.save()return Response({'url':serializer.data['avatar']})# setting配置
# 文件上传的路径
MEDIA_ROOT = BASE_DIR / 'file/image'
# 文件的url路径
MEDIA_URL = 'file/image/'# 配置url
path('<int:pk>/avatar/upload/',UserView.as_view({'post':'upload_avatar'}), name='avatar_post')

头像文件获取

# 头像文件获取
class FileView(APIView):def get(self,request,name):path  = MEDIA_ROOT / nameif os.path.isfile(path):return FileResponse(open(path,'rb'))return Response({"error":'没有找到该文件!'},status=status.HTTP_400_BAD_REQUEST)# 配置总路由url
re_path(r'file/image/(.+?)/', FileView.as_view()),