Django中实现基于角色与部门的精细化权限管理

# myapp/models.py
from django.db import models
from django.contrib.auth.models import User

class Department(models.Model):
    name = models.CharField(max_length=100, unique=True)

    def __str__(self):
        return self.name

class UserProfile(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    department = models.ForeignKey(Department, on_delete=models.SET_NULL, null=True, blank=True)
    # 可以添加其他角色信息，或者通过Django内置的Group来管理角色

    def __str__(self):
        return self.user.username + " - " + (self.department.name if self.department else "无部门")

class Dashboard(models.Model):
    name = models.CharField(max_length=200)
    description = models.TextField(blank=True)
    department = models.ForeignKey(Department, on_delete=models.CASCADE) # 仪表盘属于哪个部门

    def __str__(self):
        return f"{self.name} ({self.department.name})"

    class Meta:
        verbose_name = "仪表盘"
        verbose_name_plural = "仪表盘"
        # 可以添加自定义权限，但在这里我们主要通过视图逻辑控制
        # permissions = [
        #     ("can_view_own_department_dashboard", "Can view own department dashboard"),
        # ]

# myapp/views.py
from django.shortcuts import render, get_object_or_404, redirect
from django.contrib.auth.decorators import login_required, user_passes_test
from django.contrib.auth.mixins import LoginRequiredMixin
from django.views.generic import ListView, DetailView
from .models import Dashboard, UserProfile

# 辅助函数：检查用户是否为经理
def is_manager(user):
    # 假设经理用户属于名为 'Manager' 的组
    return user.groups.filter(name='Manager').exists()

# 辅助函数：检查用户是否属于特定部门
def user_in_department(user, department):
    try:
        user_profile = user.userprofile
        return user_profile.department == department
    except UserProfile.DoesNotExist:
        return False

# 普通用户仪表盘列表视图 (函数视图)
@login_required
def normal_user_dashboard_list(request):
    if is_manager(request.user):
        # 如果是经理，重定向到经理仪表盘视图
        return redirect('manager_dashboard_list')

    try:
        user_department = request.user.userprofile.department
        if not user_department:
            # 用户没有部门，显示无权访问或空列表
            return render(request, 'no_department_access.html')

        # 普通用户只能看到自己部门的仪表盘
        dashboards = Dashboard.objects.filter(department=user_department)
        return render(request, 'normal_user_dashboard_list.html', {'dashboards': dashboards})
    except UserProfile.DoesNotExist:
        # 用户没有UserProfile，处理错误或重定向
        return render(request, 'no_profile_access.html')

# 普通用户仪表盘详情视图 (函数视图)
@login_required
def normal_user_dashboard_detail(request, pk):
    dashboard = get_object_or_404(Dashboard, pk=pk)

    if is_manager(request.user):
        # 经理可以查看任何仪表盘
        return render(request, 'dashboard_detail.html', {'dashboard': dashboard})

    try:
        user_department = request.user.userprofile.department
        if not user_department or dashboard.department != user_department:
            # 普通用户只能查看自己部门的仪表盘
            return render(request, 'permission_denied.html', status=403)

        return render(request, 'dashboard_detail.html', {'dashboard': dashboard})
    except UserProfile.DoesNotExist:
        return render(request, 'no_profile_access.html')


# 经理仪表盘列表视图 (类视图)
class ManagerDashboardListView(LoginRequiredMixin, ListView):
    model = Dashboard
    template_name = 'manager_dashboard_list.html'
    context_object_name = 'dashboards'

    def get_queryset(self):
        # 确保只有经理可以访问此视图
        if not is_manager(self.request.user):
            # 如果不是经理，可以重定向到普通用户视图或显示无权限
            return Dashboard.objects.none() # 或者 raise Http404, redirect etc.
        return Dashboard.objects.all()

# 经理仪表盘详情视图 (类视图)
class ManagerDashboardDetailView(LoginRequiredMixin, DetailView):
    model = Dashboard
    template_name = 'dashboard_detail.html'
    context_object_name = 'dashboard'

    def get_object(self, queryset=None):
        # 确保只有经理可以访问此视图
        if not is_manager(self.request.user):
            # 如果不是经理，可以重定向到普通用户视图或显示无权限
            raise Http404("You do not have permission to view this page.")
        return super().get_object(queryset)

# myproject/urls.py (或 myapp/urls.py)
from django.urls import path
from . import views
from .views import ManagerDashboardListView, ManagerDashboardDetailView

urlpatterns = [
    path('dashboard/normal/', views.normal_user_dashboard_list, name='normal_user_dashboard_list'),
    path('dashboard/normal/<int:pk>/', views.normal_user_dashboard_detail, name='normal_user_dashboard_detail'),
    path('dashboard/manager/', ManagerDashboardListView.as_view(), name='manager_dashboard_list'),
    path('dashboard/manager/<int:pk>/', ManagerDashboardDetailView.as_view(), name='manager_dashboard_detail'),
    # ... 其他URL
]

<h1>我的部门仪表盘</h1>
{% if dashboards %}
    <ul>
        {% for dashboard in dashboards %}
            <li><a href="{% url 'normal_user_dashboard_detail' dashboard.pk %}">{{ dashboard.name }}</a> - {{ dashboard.department.name }}</li>
        {% endfor %}
    </ul>
{% else %}
    <p>您所属部门暂无仪表盘。</p>
{% endif %}

<h1>所有部门仪表盘</h1>
{% if dashboards %}
    <ul>
        {% for dashboard in dashboards %}
            <li><a href="{% url 'manager_dashboard_detail' dashboard.pk %}">{{ dashboard.name }}</a> - {{ dashboard.department.name }}</li>
        {% endfor %}
    </ul>
{% else %}
    <p>暂无仪表盘。</p>
{% endif %}

<h1>{{ dashboard.name }}</h1>
<p>部门: {{ dashboard.department.name }}</p>
<p>描述: {{ dashboard.description }}</p>

<h1>权限不足</h1>
<p>您没有权限访问此仪表盘。</p>