Python 学习笔记（二十）--Django REST Framework之认证

        # Ensure that the incoming request is permitted
        ##认证组件：检验用户--游客、合法用户、非法用户
        ##游客：代表校验通过，直接进入下一步校验（权限校验）
        ##合法用户：代表校验通过，用户存储在request.user中，再进行下一步校验（权限校验）
        ##非法用户：代表校验失败，抛出异常，返回403权限异常结果。
        self.perform_authentication(request)
        ##权限组件：校验用户权限--必须登录、所有用户、登入只读游客自读、自定义用户角色
        ##认证通过，可以进入下一步校验（频率认证）
        ##认证失败，报错异常，返回403权限异常结果
        self.check_permissions(request)
        ##频率组件：限制视图接口被访问的频率次数--限制条件（IP、id、、唯一键）、频率周期时间（s、m、h）、频率次数（3/s）
        ##没有达到限制次数：正常访问接口
        ##达到限制次数：限制时间内不能访问，限制时间到达后，可以重新访问。
        self.check_throttles(request)

    def perform_authentication(self, request):
        """
        Perform authentication on the incoming request.

        Note that if you override this and simply 'pass', then authentication
        will instead be performed lazily, the first time either
        `request.user` or `request.auth` is accessed.
        """
        request.user   ###去Request类中去查找，方法属性user

    @property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, '_user'): ###判断self这个对象有没有_user属性
            with wrap_attributeerrors():  ##上下文管理器
                ## 没用户，认证出用户
                self._authenticate()
        return self._user  ##有用户，则直接返回用户

    def _authenticate(self): ##进行认证
        """
        Attempt to authenticate the request using each authentication instance
        in turn.
        """
        ## 遍历拿到一个个认证器，进行认证
        ##self.authenticators 在视图类中配置的一堆认证类产生的认证类对象组成的 list

        for authenticator in self.authenticators: 
            try:
                ## 认证器（对象）调用认证方法authenticate(认证类对象self,request请求对象)
                ## 返回值：登录的用户与认证的信息组成的 tuple
                ## 该方法被try包裹，代表该方法会抛异常，抛异常代表认证失败
                user_auth_tuple = authenticator.authenticate(self)  ###self 是request对象
            except exceptions.APIException:
                self._not_authenticated()
                raise
            ## 返回值的处理
            if user_auth_tuple is not None:
                self._authenticator = authenticator
                ## 如果有返回值，就将 登录用户 和 登录认证 分别保存到 request.user 和 request.auth中 
                self.user, self.auth = user_auth_tuple
                return

        self._not_authenticated()

    def _not_authenticated(self):
        """
        Set authenticator, user & authtoken representing an unauthenticated request.

        Defaults are None, AnonymousUser & None.
        """
        self._authenticator = None

        if api_settings.UNAUTHENTICATED_USER:
            self.user = api_settings.UNAUTHENTICATED_USER()
        else:
            self.user = None

        if api_settings.UNAUTHENTICATED_TOKEN:
            self.auth = api_settings.UNAUTHENTICATED_TOKEN()
        else:
            self.auth = None

    # Dispatch methods

    def initialize_request(self, request, *args, **kwargs):
        """
        Returns the initial request object.
        """
        parser_context = self.get_parser_context(request)

        return Request(
            request,
            parsers=self.get_parsers(),
            authenticators=self.get_authenticators(),  ##列表，存放的类的对象
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )

def get_authenticators(self):
        """
        Instantiates and returns the list of authenticators that this view can use.
        """
        return [auth() for auth in self.authentication_classes]  ##列表生成式；列表中是一堆对象，是视图类中配置的authentication_classes=[类名]对象

class APIView(View):

    # The following policies may be set at either globally, or per-view.
    renderer_classes = api_settings.DEFAULT_RENDERER_CLASSES
    parser_classes = api_settings.DEFAULT_PARSER_CLASSES
    authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES
    throttle_classes = api_settings.DEFAULT_THROTTLE_CLASSES
    permission_classes = api_settings.DEFAULT_PERMISSION_CLASSES
    content_negotiation_class = api_settings.DEFAULT_CONTENT_NEGOTIATION_CLASS
    metadata_class = api_settings.DEFAULT_METADATA_CLASS
    versioning_class = api_settings.DEFAULT_VERSIONING_CLASS