From 1b6eb7147bf66f7190daa919fdfc96be962e5bad Mon Sep 17 00:00:00 2001
From: chenzuoqing <chenzuoqing@126.com>
Date: Wed, 1 Dec 2021 11:01:14 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E9=9D=99=E6=80=81token=20hea?=
 =?UTF-8?q?der=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C=EF=BC=8C=E5=90=88?=
 =?UTF-8?q?=E5=B9=B6gitignore?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore               |  4 ----
 settings/dev.py          |  7 +++++++
 src/common/permission.py | 17 +++++++++++++++++
 src/common/views.py      | 28 ++++++++++++++++++++++++++++
 src/project/views.py     |  2 ++
 5 files changed, 54 insertions(+), 4 deletions(-)
 create mode 100644 src/common/permission.py

diff --git a/.gitignore b/.gitignore
index 8c3d35f..6a7b364 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-<<<<<<< HEAD
 .idea
 .vscode
 
@@ -11,7 +10,6 @@ __pycache__
 logs/
 
 *.swap
-=======
 # ---> Python
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -151,5 +149,3 @@ dmypy.json
 
 # Cython debug symbols
 cython_debug/
-
->>>>>>> 47d098bb512e8791ebaa211917636f2e7f13a6f6
diff --git a/settings/dev.py b/settings/dev.py
index 4689602..a5c2f66 100644
--- a/settings/dev.py
+++ b/settings/dev.py
@@ -3,11 +3,18 @@ import os.path
 # 项目目录
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 
+SECRET_KEY = 'cf036e50524a11ecb4a618c04d9eb245'
+
 # mongodb 地址
 MONGODB_SETTINGS = {
     'host': 'mongodb://admin:111111@10.2.2.10:27017/ops_api?authSource=admin',
 }
 
+# API static token 允许请求的静态token
+X_TOKEN_SET = (
+    "51ab21fa323a11eca1af000c2993d583",  #
+)
+
 LOGGING = {
     'version': 1,
     'disable_existing_loggers': True,
diff --git a/src/common/permission.py b/src/common/permission.py
new file mode 100644
index 0000000..2d640a5
--- /dev/null
+++ b/src/common/permission.py
@@ -0,0 +1,17 @@
+from functools import wraps
+
+from flask import request, current_app as app
+from flask_restful import abort
+
+
+def token_header_required(func):
+    """获取请求头携带的 token，简单的过滤请求"""
+    @wraps(func)
+    def wrap_func(*args, **kwargs):
+        token = request.headers.get("X-Token")
+        token_set = app.config.get("X_TOKEN_SET", [])
+
+        if token not in token_set:
+            abort(403, msg="permission denied", code=1403)
+        return func(*args, **kwargs)
+    return wrap_func
diff --git a/src/common/views.py b/src/common/views.py
index bf7992f..7974831 100644
--- a/src/common/views.py
+++ b/src/common/views.py
@@ -3,6 +3,7 @@ from flask_restful import abort, Resource, marshal, fields, reqparse
 
 
 class ModelViewBase(Resource):
+    """Mongodb 模型视图相关方法的扩展集合"""
     # 模型
     model = None
     # marshal 字段
@@ -12,6 +13,12 @@ class ModelViewBase(Resource):
     # 是否分页
     paging = True
 
+    # method_decorators 可以用作权限校验，参考 `flask_restful.Resource`
+    # 参数是装饰器列表（未指定方法将会对所有请求方法生效）
+    # 也可以为指定请求设置: {"get": [wrap_func1, ..], "post": []}
+    # method_decorators = [token_header_required, ]
+    method_decorators = []
+
     def get_object(self, pk):
         try:
             return self.model.objects(id=pk).first_or_404(message="resource not found")
@@ -74,6 +81,9 @@ class CreateMixin(ModelViewBase):
 
     def post(self):
         """创建对象"""
+
+        assert self.request_parse is not None, "缺少校验规则"
+
         # 解析参数
         args = self.request_parse.parse_args()
 
@@ -88,6 +98,24 @@ class CreateMixin(ModelViewBase):
         return marshal(obj, self.fields)
 
 
+# TODO 模型校验
+# class CreateFormMixin(ModelViewBase):
+#
+#     def pre_create(self, args):
+#         """创建前钩子，接收参数，可以对参数进行处理，最后保存此方法返回的数据"""
+#         return args
+#
+#     def post(self):
+#         """创建对象"""
+#         self.form = self.form if self.form else model_form(self.model)
+#         print("===> json", request.json)
+#         form = self.form(request.json, meta={'csrf': False})
+#         if not form.validate():
+#             print(form.errors)
+#             return {"msg": "error"}
+#         return {"msg": "ok"}
+
+
 class RetrieveMixin(ModelViewBase):
 
     def get(self, pk):
diff --git a/src/project/views.py b/src/project/views.py
index e053a18..a16a2ba 100644
--- a/src/project/views.py
+++ b/src/project/views.py
@@ -7,6 +7,7 @@ from asset.models import Host
 from project import fields
 from project.models import Project, Channel, Server, Version
 from common.views import ListMixin, CreateMixin, ListCreateViewSet, DetailViewSet
+from common.permission import token_header_required
 
 
 class ProjectViews(ListMixin, CreateMixin):
@@ -45,6 +46,7 @@ class ServerSyncView(CreateMixin):
     model = Server
     fields = fields.ServerFields
     project: Project = None
+    method_decorators = [token_header_required]
 
     def __init__(self):
         # 参数定义，json来源