INSTALLED_APPS = [
  'django.contrib.admin',
  'django.contrib.auth',
  'django.contrib.contenttypes',
  'django.contrib.sessions',
  'django.contrib.messages',
  'django.contrib.staticfiles',
  'app.apps.AppConfig',
  'rest_framework', #注冊(cè)
]

from django.conf.urls import url
from django.contrib import admin
from app import views
urlpatterns = [
  url(r'^admin/', admin.site.urls),
  url(r'^auth/', views.AuthView.as_view()), #驗(yàn)證
  url(r'^index/', views.IndexView.as_view()), #首頁
  url(r'^order/', views.OrderView.as_view()), #定單
]

from rest_framework.views import APIView
from rest_framework.request import Request
from django.http import JsonResponse,HttpResponse
from app.utils.commons import gen_token
from app.utils.auth import LuffyAuthentication
from app.utils.throttle import LuffyAnonRateThrottle,LuffyUserRateThrottle
from app.utils.permission import LuffyPermission
from . import models
class AuthView(APIView):
  """
  認(rèn)證相關(guān)視圖
  由于繼承了APIView,所以csrf就沒有了，具體的源代碼只是有一個(gè)裝飾器，
  加上了csrf_exempt裝飾器，屏蔽了csrf
  寫法是在return的時(shí)候csrf_exempt(view) 和@使用裝飾器效果是一樣的，這種寫法還可以寫在url路由中。
  """
  def post(self,request,*args,**kwargs):
    """
    用戶登錄功能
    :param request:
    :param args:
    :param kwargs:
    :return:
    """
    ret = {'code': 1000, 'msg': None}
    # 默認(rèn)要返回的信息
    user = request.data.get('username')
    # 這里的request已經(jīng)不是原來的request了
    pwd = request.data.get('password')
    user_obj = models.UserInfo.objects.filter(user=user, pwd=pwd).first()
    if user_obj:
      tk = gen_token(user) #返回一個(gè)哈希過得字符串
      #進(jìn)行token驗(yàn)證
      models.Token.objects.update_or_create(user=user_obj, defaults={'token': tk})
      # 數(shù)據(jù)庫存入一個(gè)token信息
      ret['code'] = 1001
      ret['token'] = tk
    else:
      ret['msg'] = "用戶名或密碼錯(cuò)誤"
    return JsonResponse(ret)

def gen_token(username):
  import time
  import hashlib
  ctime = str(time.time())
  hash = hashlib.md5(username.encode('utf-8'))
  hash.update(ctime.encode('utf-8'))
  return hash.hexdigest()

class IndexView(APIView):
  """
  用戶認(rèn)證
    http://127.0.0.1:8001/v1/index/?tk=sdfasdfasdfasdfasdfasdf
    獲取用戶傳入的Token
  首頁限制：request.user
    匿名：5/m
    用戶：10/m
  """
  authentication_classes = [LuffyAuthentication,]
  #認(rèn)證成功返回一個(gè)用戶名，一個(gè)對(duì)象，不成功就是None
  throttle_classes = [LuffyAnonRateThrottle,LuffyUserRateThrottle]
  #訪問次數(shù)限制，如果合格都為True
  def get(self,request,*args,**kwargs):
    return HttpResponse('首頁')

from rest_framework.authentication import BaseAuthentication
from rest_framework import exceptions
from app import models
class LuffyAuthentication(BaseAuthentication):
  def authenticate(self, request):
    tk = request.query_params.get('tk')
    if not tk:
      return (None,None)
      # raise exceptions.AuthenticationFailed('認(rèn)證失敗')
    token_obj = models.Token.objects.filter(token=tk).first()
    if not token_obj:
      return (None,None)
    return (token_obj.user,token_obj)

from rest_framework.throttling import BaseThrottle,SimpleRateThrottle
class LuffyAnonRateThrottle(SimpleRateThrottle):
  scope = "luffy_anon"
  def allow_request(self, request, view):
    """
    Return `True` if the request should be allowed, `False` otherwise.
    """
    if request.user:
      return True
    # 獲取當(dāng)前訪問用戶的唯一標(biāo)識(shí)
    self.key = self.get_cache_key(request, view)
    # 根據(jù)當(dāng)前用戶的唯一標(biāo)識(shí)，獲取所有訪問記錄
    # [1511312683.7824545, 1511312682.7824545, 1511312681.7824545]
    self.history = self.cache.get(self.key, [])
    # 獲取當(dāng)前時(shí)間
    self.now = self.timer()
    # Drop any requests from the history which have now passed the
    # throttle duration
    while self.history and self.history[-1] <= self.now - self.duration:
      self.history.pop()
    if len(self.history) >= self.num_requests:  #判斷訪問次數(shù)是否大于限制次數(shù)
      return self.throttle_failure()
    return self.throttle_success() #返回True
  def get_cache_key(self, request, view):
    return 'throttle_%(scope)s_%(ident)s' % {
      'scope': self.scope,
      'ident': self.get_ident(request),
      # 判斷是否為代理等等
    }
class LuffyUserRateThrottle(SimpleRateThrottle):
  scope = "luffy_user"
  def allow_request(self, request, view):
    """
    Return `True` if the request should be allowed, `False` otherwise.
    """
    if not request.user:  #判斷登錄直接返回True
      return True
    # 獲取當(dāng)前訪問用戶的唯一標(biāo)識(shí)
    # 用戶對(duì)所有頁面
    # self.key = request.user.user
    self.key = request.user.user + view.__class__.__name__
    # 用戶對(duì)單頁面的訪問限制
    # 根據(jù)當(dāng)前用戶的唯一標(biāo)識(shí)，獲取所有訪問記錄
    # [1511312683.7824545, 1511312682.7824545, 1511312681.7824545]
    self.history = self.cache.get(self.key, [])
    # 獲取當(dāng)前時(shí)間
    self.now = self.timer()
    # Drop any requests from the history which have now passed the
    # throttle duration
    while self.history and self.history[-1] <= self.now - self.duration:
      self.history.pop()
    if len(self.history) >= self.num_requests:  #訪問次數(shù)的限制
      return self.throttle_failure()
    return self.throttle_success()  #返回True

from rest_framework.permissions import BasePermission
class LuffyPermission(BasePermission):
  def has_permission(self, request, view):
    """
    Return `True` if permission is granted, `False` otherwise.
    """
    if request.user:
      return True
    return False

class OrderView(APIView):
  """
  訂單頁面：只有登錄成功后才能訪問
    - 認(rèn)證(匿名和用戶)
    - 權(quán)限(用戶)
    - 限制（）
  """
  authentication_classes = [LuffyAuthentication, ]
  permission_classes = [LuffyPermission,] #登錄就返回True
  throttle_classes = [LuffyAnonRateThrottle, LuffyUserRateThrottle]
  def get(self,request,*args,**kwargs):
    return HttpResponse('訂單')

REST_FRAMEWORK = {
  'UNAUTHENTICATED_USER': None,
  'UNAUTHENTICATED_TOKEN': None,
  "DEFAULT_THROTTLE_RATES": {
    'luffy_anon': '3/m', #匿名用戶一分鐘訪問3次
    'luffy_user': '6/m'　　#登錄用戶一分鐘訪問6次
  },
}