Python Django 강좌 : 제 15강 - Authentication & Permission

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'rest_framework',
    'rest_framework.authtoken',
    'corsheaders',
    'first_app',
    'blog',
]

REST_FRAMEWORK = {
    "DEFAULT_AUTHENTICATION_CLASSES": [
        "rest_framework.authentication.TokenAuthentication",
        "rest_framework.authentication.SessionAuthentication",
    ],
    "DEFAULT_PERMISSION_CLASSES": [
        "rest_framework.permissions.IsAuthenticatedOrReadOnly",
    ],
}

python manage.py migrate

Operations to perform:
  Apply all migrations: admin, auth, authtoken, blog, contenttypes, first_app, sessions
Running migrations:
  Applying authtoken.0001_initial... OK
  Applying authtoken.0002_auto_20160226_1747... OK
  Applying authtoken.0003_tokenproxy... OK
  Applying authtoken.0004_alter_tokenproxy_options... OK

python manage.py createsuperuser

python manage.py drf_create_token daehee

## daehee/urls.py
from django.contrib import admin
from django.urls import include, path
from rest_framework.authtoken.views import obtain_auth_token
from rest_framework.routers import DefaultRouter

from first_app.views import UserViewSet
from blog.views import PostViewSet
from blog.views import CommentViewSet

router = DefaultRouter(use_regex_path=False)
router.register("users", UserViewSet)
router.register("post", PostViewSet)
router.register("comment", CommentViewSet)

urlpatterns = [
    path("admin/", admin.site.urls),
    path("api-token-auth/", obtain_auth_token),
    path("", include(router.urls)),
]

## blog/models.py
from django.conf import settings
from django.db import models


class Post(models.Model):
    id = models.BigAutoField(help_text="Post ID", primary_key=True)
    title = models.CharField(help_text="Post title", max_length=100, blank=False, null=False)
    contents = models.TextField(help_text="Post contents", blank=False, null=False)
    author = models.ForeignKey(settings.AUTH_USER_MODEL, related_name="posts", on_delete=models.CASCADE, null=True, blank=True)

python manage.py makemigrations blog
python manage.py migrate blog

Migrations for 'blog':
  blog\migrations\0002_post_author.py
    + Add field author to post
Operations to perform:
  Apply all migrations: blog
Running migrations:
  Applying blog.0002_post_author... OK

## blog/serializers.py
class PostSerializer(serializers.ModelSerializer):
    post = CommentSerializer(many=True, read_only=True)
    author = serializers.ReadOnlyField(source="author.username")

    class Meta:
        model = Post
        fields = ("id", "title", "contents", "author", "post")

## blog/permissions.py
from rest_framework import permissions


class IsAuthorOrReadOnly(permissions.BasePermission):
    message = "작성자만 수정하거나 삭제할 수 있습니다."

    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True

        return obj.author == request.user

## blog/views.py
from django.db import transaction
from rest_framework import status
from rest_framework import viewsets
from rest_framework.permissions import IsAuthenticatedOrReadOnly
from rest_framework.response import Response

from blog.models import Post
from blog.models import Comment
from blog.serializers import PostSerializer
from blog.serializers import CommentSerializer
from blog.permissions import IsAuthorOrReadOnly


class PostViewSet(viewsets.ModelViewSet):
    queryset = Post.objects.select_related("author").prefetch_related("post")
    serializer_class = PostSerializer
    permission_classes = [IsAuthenticatedOrReadOnly, IsAuthorOrReadOnly]

    def create(self, request, *args, **kwargs):
        with transaction.atomic():
            post_data = {
                "title": request.data.get("title"),
                "contents": request.data.get("contents"),
            }
            post_serializer = PostSerializer(data=post_data)
            post_serializer.is_valid(raise_exception=True)
            post_result = post_serializer.save(author=request.user)

            comment_data = {
                "post_id": post_result.id,
                "contents": request.data.get("post", {}).get("contents"),
            }
            comment_serializer = CommentSerializer(data=comment_data)
            comment_serializer.is_valid(raise_exception=True)
            comment_serializer.save()

        return Response({"message": "Operate successfully"}, status=status.HTTP_201_CREATED)


class CommentViewSet(viewsets.ModelViewSet):
    queryset = Comment.objects.select_related("post_id")
    serializer_class = CommentSerializer

## first_app/views.py
from rest_framework.permissions import AllowAny


class UserViewSet(viewsets.ModelViewSet):
    queryset = UserModel.objects.all()
    serializer_class = UserSerializer
    lookup_url_kwarg = "uuid"
    lookup_value_converter = "uuid"
    permission_classes = [AllowAny]

import requests

url = "http://127.0.0.1:8000/post/"
data = {
    "title": "제 15강 - Authentication & Permission",
    "contents": "장고에서 ...",
    "post": {"contents": "로그인 후 작성"}
}

response = requests.post(url, json=data)

print(response.status_code)
print(response.headers.get("WWW-Authenticate"))
print(response.json())

import requests

url = "http://127.0.0.1:8000/api-token-auth/"
data = {
    "username": "daehee",
    "password": "비밀번호"
}

response = requests.post(url, json=data)

print(response.status_code)
print(response.json())

import requests

url = "http://127.0.0.1:8000/post/"
headers = {
    "Authorization": "Token 14bc4f86b3d70c249620d8b74fe5e7c6a45746bf"
}
data = {
    "title": "제 15강 - Authentication & Permission",
    "contents": "장고에서 ...",
    "post": {"contents": "로그인 후 작성"}
}

response = requests.post(url, json=data, headers=headers)
print(response.status_code)

response = requests.get(url)
print(response.json()[-1])

import requests

url = "http://127.0.0.1:8000/post/6/"
headers = {
    "Authorization": "Token {다른 사용자의 토큰}"
}

response = requests.patch(url, json={"title": "제목 변경"}, headers=headers)

print(response.status_code)
print(response.json())

## blog/tests.py
from django.contrib.auth.models import User
from rest_framework import status
from rest_framework.test import APITestCase

from blog.models import Post


class PostPermissionTest(APITestCase):
    def setUp(self):
        self.author = User.objects.create_user("daehee", password="pw-12345678")
        self.other = User.objects.create_user("other", password="pw-12345678")
        self.data = {"title": "제목", "contents": "내용", "post": {"contents": "댓글"}}

    def test_anonymous_cannot_create(self):
        response = self.client.post("/post/", self.data, format="json")
        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

    def test_only_author_can_update(self):
        self.client.force_authenticate(user=self.author)
        self.client.post("/post/", self.data, format="json")
        post = Post.objects.get()

        self.client.force_authenticate(user=self.other)
        response = self.client.patch(f"/post/{post.id}/", {"title": "변경"}, format="json")
        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)

        self.client.force_authenticate(user=self.author)
        response = self.client.patch(f"/post/{post.id}/", {"title": "변경"}, format="json")
        self.assertEqual(response.status_code, status.HTTP_200_OK)