FastAPI如何用角色权限让Web应用安全又灵活？
title: FastAPI如何用角色权限让Web应用安全又灵活？
pip install fastapi==0.95.2
pip install uvicorn==0.22.0
pip install python-jose[cryptography]==3.3.0
pip install passlib[bcrypt]==1.7.4
from pydantic import BaseModel
from typing import Optional
class User(BaseModel):
username: str
role: str # 角色字段：admin/user/guest
disabled: Optional[bool] = False
from fastapi import Depends, HTTPException, status
from fastapi.security import OAuth2PasswordBearer
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
async def get_current_user(token: str = Depends(oauth2_scheme)):
# 此处应实现JWT解码或数据库查询
# 示例直接返回模拟用户
return User(username="admin", role="admin")
def require_role(required_role: str):
async def role_checker(user: User = Depends(get_current_user)):
if user.role != required_role:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail="Insufficient permissions"
)
return user
return role_checker
from fastapi import APIRouter
router = APIRouter()
@router.get("/public")
async def public_data():
return {"message": "公共数据"}
@router.get("/user-data", dependencies=[Depends(require_role("user"))])
async def user_data():
return {"message": "用户专属数据"}
@router.get("/admin-data")
async def admin_data(user: User = Depends(require_role("admin"))):
return {"message": "管理员面板"}
# 在路由中使用try-except捕捉验证错误
from fastapi import Request
from fastapi.responses import JSONResponse
@app.exception_handler(RequestValidationError)
async def validation_exception_handler(request, exc):
return JSONResponse(
status_code=422,
content={"detail": "请求参数格式错误"}
)
def require_role(required_role: str):
async def role_checker(user: User = Depends(get_current_user)):
print(f"当前用户角色：{user.role}，要求角色：{required_role}") # 调试输出
# ...原有校验逻辑
评论
发表评论