Аутентификация и авторизация в Django: полное руководство пользователя

INSTALLED_APPS = [
# ...
'django.contrib.auth', # Система аутентификации
'django.contrib.contenttypes', # Необходима для работы auth
# ...
]

MIDDLEWARE = [
# ...
'django.contrib.sessions.middleware.SessionMiddleware', # Для работы с сессиями
# ...
'django.contrib.auth.middleware.AuthenticationMiddleware', # Для аутентификации
# ...
]

# URL для перенаправления после успешного входа
LOGIN_REDIRECT_URL = 'home'

# URL для перенаправления, если доступ запрещен
LOGIN_URL = 'login'

# URL для перенаправления после выхода
LOGOUT_REDIRECT_URL = 'home'

# Бэкенды аутентификации
AUTHENTICATION_BACKENDS = [
'django.contrib.auth.backends.ModelBackend',
# Здесь можно добавить кастомные бэкенды
]

# Хешеры паролей (в порядке их применения)
PASSWORD_HASHERS = [
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.Argon2PasswordHasher',
'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
]

python manage.py migrate

python manage.py createsuperuser

from django.db import models
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager, PermissionsMixin
from django.utils import timezone

class CustomUserManager(BaseUserManager):
def create_user(self, email, password=None, **extra_fields):
if not email:
raise ValueError('Email is required')
email = self.normalize_email(email)
user = self.model(email=email, **extra_fields)
user.set_password(password)
user.save(using=self._db)
return user

def create_superuser(self, email, password=None, **extra_fields):
extra_fields.setdefault('is_staff', True)
extra_fields.setdefault('is_superuser', True)
extra_fields.setdefault('is_active', True)

return self.create_user(email, password, **extra_fields)

class CustomUser(AbstractBaseUser, PermissionsMixin):
email = models.EmailField(unique=True)
first_name = models.CharField(max_length=30, blank=True)
last_name = models.CharField(max_length=30, blank=True)
is_active = models.BooleanField(default=True)
is_staff = models.BooleanField(default=False)
date_joined = models.DateTimeField(default=timezone.now)

# Дополнительные поля для вашего приложения
phone_number = models.CharField(max_length=15, blank=True)
bio = models.TextField(blank=True)
avatar = models.ImageField(upload_to='avatars/', blank=True, null=True)

objects = CustomUserManager()

USERNAME_FIELD = 'email' # Поле для аутентификации (вместо username)
REQUIRED_FIELDS = [] # Дополнительные обязательные поля

def __str__(self):
return self.email

def get_full_name(self):
return f"{self.first_name} {self.last_name}".strip() or self.email

def get_short_name(self):
return self.first_name or self.email

AUTH_USER_MODEL = 'accounts.CustomUser'

python manage.py makemigrations
python manage.py migrate

from django.contrib import admin
from django.contrib.auth.admin import UserAdmin
from django.utils.translation import gettext_lazy as _
from .models import CustomUser

class CustomUserAdmin(UserAdmin):
model = CustomUser
list_display = ('email', 'first_name', 'last_name', 'is_staff', 'is_active')
list_filter = ('is_staff', 'is_active')
fieldsets = (
(None, {'fields': ('email', 'password')}),
(_('Personal info'), {'fields': ('first_name', 'last_name', 'phone_number', 'bio', 'avatar')}),
(_('Permissions'), {'fields': ('is_active', 'is_staff', 'is_superuser', 'groups', 'user_permissions')}),
(_('Important dates'), {'fields': ('last_login', 'date_joined')}),
)
add_fieldsets = (
(None, {
'classes': ('wide',),
'fields': ('email', 'password1', 'password2', 'is_staff', 'is_active')}
),
)
search_fields = ('email', 'first_name', 'last_name')
ordering = ('email',)

admin.site.register(CustomUser, CustomUserAdmin)

from django import forms
from django.contrib.auth.forms import UserCreationForm, AuthenticationForm, UserChangeForm
from django.contrib.auth import get_user_model

User = get_user_model()

class CustomUserCreationForm(UserCreationForm):
"""Форма для регистрации новых пользователей"""
email = forms.EmailField(
max_length=254,
widget=forms.EmailInput(attrs={'class': 'form-control', 'placeholder': 'Email'})
)

password1 = forms.CharField(
widget=forms.PasswordInput(attrs={'class': 'form-control', 'placeholder': 'Пароль'})
)

password2 = forms.CharField(
widget=forms.PasswordInput(attrs={'class': 'form-control', 'placeholder': 'Подтверждение пароля'})
)

class Meta:
model = User
fields = ('email', 'first_name', 'last_name', 'password1', 'password2')
widgets = {
'first_name': forms.TextInput(attrs={'class': 'form-control', 'placeholder': 'Имя'}),
'last_name': forms.TextInput(attrs={'class': 'form-control', 'placeholder': 'Фамилия'}),
}

def clean_email(self):
email = self.cleaned_data.get('email')
if User.objects.filter(email=email).exists():
raise forms.ValidationError("Пользователь с таким email уже существует")
return email


class CustomAuthenticationForm(AuthenticationForm):
"""Форма для аутентификации пользователей"""
username = forms.EmailField(
max_length=254,
widget=forms.EmailInput(attrs={'class': 'form-control', 'placeholder': 'Email'})
)

password = forms.CharField(
widget=forms.PasswordInput(attrs={'class': 'form-control', 'placeholder': 'Пароль'})
)

from django.contrib.auth import login, authenticate, logout
from django.contrib.auth.decorators import login_required
from django.shortcuts import render, redirect
from django.views import View
from django.utils.decorators import method_decorator
from django.urls import reverse_lazy
from django.contrib import messages
from django.views.generic import CreateView, TemplateView

from .forms import CustomUserCreationForm, CustomAuthenticationForm

class SignUpView(CreateView):
form_class = CustomUserCreationForm
template_name = 'accounts/signup.html'
success_url = reverse_lazy('login')

def form_valid(self, form):
response = super().form_valid(form)
messages.success(self.request, 'Регистрация успешна! Теперь вы можете войти.')
return response


class LoginView(View):
form_class = CustomAuthenticationForm
template_name = 'accounts/login.html'

def get(self, request):
form = self.form_class()
return render(request, self.template_name, {'form': form})

def post(self, request):
form = self.form_class(data=request.POST)
if form.is_valid():
email = form.cleaned_data.get('username') # В форме поле называется username
password = form.cleaned_data.get('password')
user = authenticate(username=email, password=password)
if user is not None:
login(request, user)
messages.success(request, f'Добро пожаловать, {user.get_short_name()}!')
return redirect('home')
return render(request, self.template_name, {'form': form})


def logout_view(request):
logout(request)
messages.success(request, 'Вы успешно вышли из системы.')
return redirect('home')


@method_decorator(login_required, name='dispatch')
class ProfileView(TemplateView):
template_name = 'accounts/profile.html'

from django.urls import path
from . import views

urlpatterns = [
path('signup/', views.SignUpView.as_view(), name='signup'),
path('login/', views.LoginView.as_view(), name='login'),
path('logout/', views.logout_view, name='logout'),
path('profile/', views.ProfileView.as_view(), name='profile'),
]

from django.urls import path, include

urlpatterns = [
# ...
path('accounts/', include('accounts.urls')),
# ...
]

{% extends 'base.html' %}

{% block content %}
<div class="container mt-5">
<div class="row justify-content-center">
<div class="col-md-6">
<div class="card">
<div class="card-header">Регистрация</div>
<div class="card-body">
<form method="post">
{% csrf_token %}

{% if form.non_field_errors %}
<div class="alert alert-danger">
{% for error in form.non_field_errors %}
{{ error }}
{% endfor %}
</div>
{% endif %}

<div class="form-group mb-3">
{{ form.email.label_tag }}
{{ form.email }}
{% if form.email.errors %}
<div class="text-danger">{{ form.email.errors }}</div>
{% endif %}
</div>

<div class="form-group mb-3">
{{ form.first_name.label_tag }}
{{ form.first_name }}
</div>

<div class="form-group mb-3">
{{ form.last_name.label_tag }}
{{ form.last_name }}
</div>

<div class="form-group mb-3">
{{ form.password1.label_tag }}
{{ form.password1 }}
{% if form.password1.errors %}
<div class="text-danger">{{ form.password1.errors }}</div>
{% endif %}
<small class="form-text text-muted">{{ form.password1.help_text }}</small>
</div>

<div class="form-group mb-3">
{{ form.password2.label_tag }}
{{ form.password2 }}
{% if form.password2.errors %}
<div class="text-danger">{{ form.password2.errors }}</div>
{% endif %}
</div>

<button type="submit" class="btn btn-primary">Зарегистрироваться</button>
</form>
</div>
<div class="card-footer">
Уже есть аккаунт? <a href="{% url 'login' %}">Войти</a>
</div>
</div>
</div>
</div>
</div>
{% endblock %}

from django.contrib.auth.decorators import login_required

@login_required
def profile_view(request):
# Доступно только аутентифицированным пользователям
return render(request, 'profile.html')

from django.contrib.auth.decorators import user_passes_test

def is_staff_user(user):
return user.is_authenticated and user.is_staff

@user_passes_test(is_staff_user)
def staff_dashboard(request):
# Доступно только сотрудникам
return render(request, 'staff_dashboard.html')

from django.contrib.auth.decorators import permission_required

@permission_required('app.add_model')
def create_view(request):
# Доступно только пользователям с правом 'app.add_model'
return render(request, 'create.html')

# Проверка нескольких разрешений
@permission_required(['app.add_model', 'app.change_model'])
def advanced_view(request):
# Пользователь должен иметь оба разрешения
return render(request, 'advanced.html')

from django.views.generic import ListView, DetailView, CreateView
from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin, PermissionRequiredMixin
from .models import Article

class ArticleListView(ListView):
model = Article
# Доступно всем пользователям

class ArticleDetailView(LoginRequiredMixin, DetailView):
model = Article
# Доступно только аутентифицированным пользователям
login_url = '/accounts/login/' # URL для перенаправления неаутентифицированных пользователей

class StaffArticleCreateView(LoginRequiredMixin, UserPassesTestMixin, CreateView):
model = Article
fields = ['title', 'content']

def test_func(self):
# Проверка, является ли пользователь сотрудником
return self.request.user.is_staff

def handle_no_permission(self):
# Кастомная обработка при отсутствии прав
return redirect('access_denied')

class ArticleUpdateView(PermissionRequiredMixin, UpdateView):
model = Article
fields = ['title', 'content']
permission_required = 'app.change_article'

from django.db import models
from django.contrib.auth import get_user_model

User = get_user_model()

class Article(models.Model):
title = models.CharField(max_length=200)
content = models.TextField()
author = models.ForeignKey(User, on_delete=models.CASCADE)
published = models.BooleanField(default=False)
created_at = models.DateTimeField(auto_now_add=True)

class Meta:
permissions = [
("publish_article", "Can publish article"),
("feature_article", "Can feature article on homepage"),
]

def user_can_edit(self, user):
# Автор или сотрудник может редактировать
return user == self.author or user.is_staff

def user_can_delete(self, user):
# Только автор или админ может удалить
return user == self.author or user.is_superuser

def user_can_view(self, user):
# Неопубликованные статьи видны только автору и сотрудникам
return self.published or user == self.author or user.is_staff

class ArticleDetailView(LoginRequiredMixin, UserPassesTestMixin, DetailView):
model = Article

def test_func(self):
article = self.get_object()
return article.user_can_view(self.request.user)

# myapp/permissions.py
class CustomPermissionBackend:
def has_perm(self, user_obj, perm, obj=None):
# Пример: проверка принадлежности к определенному отделу
if not user_obj.is_authenticated:
return False

if perm == 'app.special_action':
return hasattr(user_obj, 'department') and user_obj.department == 'special'

return False

def has_module_perms(self, user_obj, app_label):
return user_obj.is_authenticated

AUTHENTICATION_BACKENDS = [
'django.contrib.auth.backends.ModelBackend', # Стандартный бэкенд
'myapp.permissions.CustomPermissionBackend', # Наш кастомный бэкенд
]