Django角色权限管理：实现不同用户角色的仪表盘访问控制

from django.db import models
from django.contrib.auth.models import User

class Department(models.Model):
    name = models.CharField(max_length=100, unique=True)

    def __str__(self):
        return self.name

class UserProfile(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    department = models.ForeignKey(Department, on_delete=models.SET_NULL, null=True, blank=True)

    def __str__(self):
        return self.user.username + "'s Profile"

# 信号量：在创建User时自动创建UserProfile
from django.db.models.signals import post_save
from django.dispatch import receiver

@receiver(post_save, sender=User)
def create_user_profile(sender, instance, created, **kwargs):
    if created:
        UserProfile.objects.create(user=instance)

@receiver(post_save, sender=User)
def save_user_profile(sender, instance, **kwargs):
    instance.userprofile.save()

from django.db import models

class DashboardData(models.Model):
    title = models.CharField(max_length=200)
    value = models.DecimalField(max_digits=10, decimal_places=2)
    department = models.ForeignKey('accounts.Department', on_delete=models.CASCADE)
    created_at = models.DateTimeField(auto_now_add=True)

    def __str__(self):
        return f"{self.title} ({self.department.name})"

from django.shortcuts import render
from django.contrib.auth.decorators import login_required, user_passes_test
from django.contrib.auth.mixins import LoginRequiredMixin
from django.views import View
from .models import DashboardData
from django.http import HttpResponseForbidden

# 辅助函数：检查用户是否为经理
def is_manager(user):
    return user.groups.filter(name='Manager').exists()

# 辅助函数：检查用户是否为普通用户
def is_normal_user(user):
    return user.groups.filter(name='Normal User').exists()

# 函数式视图示例
@login_required
def dashboard_view(request):
    if is_manager(request.user):
        # 经理可以查看所有部门的仪表盘数据
        dashboard_items = DashboardData.objects.all().order_by('-created_at')
        context = {
            'dashboard_items': dashboard_items,
            'role': 'Manager',
            'department_filter': '所有部门'
        }
        return render(request, 'dashboard/manager_dashboard.html', context)
    elif is_normal_user(request.user):
        # 普通用户只能查看自己部门的仪表盘数据
        try:
            user_department = request.user.userprofile.department
            if user_department:
                dashboard_items = DashboardData.objects.filter(department=user_department).order_by('-created_at')
                context = {
                    'dashboard_items': dashboard_items,
                    'role': 'Normal User',
                    'department_filter': user_department.name
                }
                return render(request, 'dashboard/normal_user_dashboard.html', context)
            else:
                # 用户没有关联部门，不允许访问
                return HttpResponseForbidden("您未关联任何部门，无法查看仪表盘。")
        except AttributeError:
            # 用户没有UserProfile，处理异常
            return HttpResponseForbidden("您的账户信息不完整，请联系管理员。")
    else:
        # 其他角色或未分配角色的用户
        return HttpResponseForbidden("您没有权限访问此仪表盘。")

# 类视图示例
class DashboardView(LoginRequiredMixin, View):
    def get(self, request, *args, **kwargs):
        if is_manager(request.user):
            dashboard_items = DashboardData.objects.all().order_by('-created_at')
            context = {
                'dashboard_items': dashboard_items,
                'role': 'Manager',
                'department_filter': '所有部门'
            }
            return render(request, 'dashboard/manager_dashboard.html', context)
        elif is_normal_user(request.user):
            try:
                user_department = request.user.userprofile.department
                if user_department:
                    dashboard_items = DashboardData.objects.filter(department=user_department).order_by('-created_at')
                    context = {
                        'dashboard_items': dashboard_items,
                        'role': 'Normal User',
                        'department_filter': user_department.name
                    }
                    return render(request, 'dashboard/normal_user_dashboard.html', context)
                else:
                    return HttpResponseForbidden("您未关联任何部门，无法查看仪表盘。")
            except AttributeError:
                return HttpResponseForbidden("您的账户信息不完整，请联系管理员。")
        else:
            return HttpResponseForbidden("您没有权限访问此仪表盘。")

<!-- manager_dashboard.html -->
<h1>经理仪表盘 - 所有部门数据</h1>
<p>当前角色: {{ role }}</p>
<p>显示数据: {{ department_filter }}</p>

<table>
    <thead>
        <tr>
            <th>标题</th>
            <th>数值</th>
            <th>部门</th>
            <th>创建时间</th>
        </tr>
    </thead>
    <tbody>
        {% for item in dashboard_items %}
        <tr>
            <td>{{ item.title }}</td>
            <td>{{ item.value }}</td>
            <td>{{ item.department.name }}</td>
            <td>{{ item.created_at }}</td>
        </tr>
        {% endfor %}
    </tbody>
</table>

<!-- normal_user_dashboard.html -->
<h1>普通用户仪表盘 - {{ department_filter }} 部门数据</h1>
<p>当前角色: {{ role }}</p>
<p>显示数据: {{ department_filter }}</p>

<table>
    <thead>
        <tr>
            <th>标题</th>
            <th>数值</th>
            <!-- 普通用户可能不需要看到部门列，因为他们只看自己部门的 -->
            <th>创建时间</th>
        </tr>
    </thead>
    <tbody>
        {% for item in dashboard_items %}
        <tr>
            <td>{{ item.title }}</td>
            <td>{{ item.value }}</td>
            <td>{{ item.created_at }}</td>
        </tr>
        {% endfor %}
    </tbody>
</table>

{% comment %}
    在模板中也可以进行权限检查，但请记住，这仅用于UI显示，
    真正的安全检查必须在后端视图层完成。
{% endcomment %}
{% if request.user.is_authenticated and request.user.groups.filter(name='Manager').exists %}
    <p>您是经理，可以访问所有部门的原始数据。</p>
    <!-- 可以在这里添加一个指向经理完整仪表盘的链接 -->
{% endif %}