Python Django 装饰器权限控制

import requests
from ldap3 import Server, Connection, ALL, SUBTREE, NTLM,BASE
import random
import re
import string
from pyzbar.pyzbar import decode
from PIL import Image



def authenticate_ad(username, password):

    server_address = "ldap://192.168.1.2"
    domain = "xxx.com"
    server = Server(server_address, get_info=ALL)

    user = f'{domain}\\{username}'

    conn = Connection(server, user=user, password=password, authentication=NTLM)
    if conn.bind():
        conn.search(search_base='dc=morglory,dc=com',
                    search_filter=f'(sAMAccountName={username})',
                    search_scope=SUBTREE,
                    attributes=['cn', 'mail', 'memberOf',])  # 新增 memberOf 属性

        if len(conn.entries) > 0:
            user_info = conn.entries[0]
            user_dn = user_info.entry_dn
            user_cn = user_info.cn.value
            user_mail = user_info.mail.value if user_info.mail else 'N/A'

            # 新增群组解析逻辑
            groups = []
            if hasattr(user_info, 'memberOf'):
                for group_dn in user_info.memberOf.values:
                    conn.search(
                        search_base=group_dn,
                        search_filter='(objectClass=group)',
                        search_scope=BASE,
                        attributes=['objectGUID']  # 修改1：改为获取GUID属性
                    )
                    if conn.entries:
                        group_id = str(conn.entries[0].objectGUID.value).lower()  # 修改2：转换GUID格式
                        groups.append(group_id.replace("{","").replace("}",""))

            conn.unbind()
            return {
                'username': user_cn,
                'email': user_mail,
                'dp': get_info(user_dn),
                'groups': groups  # 新增群组字段
            }
        else:
            conn.unbind()
            return None
    else:
        return None

class userlogin(models.Model):
    username = models.CharField(max_length=25,verbose_name='用戶名')
    useremail = models.EmailField(verbose_name='用戶郵箱')
    department = models.CharField(max_length=10, verbose_name='部門')
    code = models.CharField(max_length=32,verbose_name='登錄識別')
    logintime = models.DateTimeField(auto_now_add=True,verbose_name='登錄時間')
    ad_groups = models.TextField(verbose_name='Ad群组')


class Adgroup(models.Model):
    groupname = models.CharField(max_length=30,verbose_name='AD群组名称',unique=True)
    groupid = models.CharField(max_length=128,primary_key=True,verbose_name="AD群组ID")


class Web(models.Model):
    webname = models.CharField(max_length=30,verbose_name='urlname',unique=True)
    webcname = models.CharField(max_length=30,verbose_name='网页中文名',unique=True)


class WebPermissions(models.Model):
    webname = models.ForeignKey("Web",on_delete=models.CASCADE, related_name='permissions')
    permissionname = models.ForeignKey('Adgroup',on_delete=models.CASCADE, related_name='permissions')
    isTure = models.BooleanField(default=False)

from django.shortcuts import render
from django.urls import resolve
# Create your views here.
from IT.models import *
from user.models import *
from django.urls import resolve
from django.http import HttpResponseForbidden, JsonResponse
import ast

def cheackpermission(func):
    def wrapper(request,*args, **kwargs):
        result = func(request,*args, **kwargs)
        # 访问的URL地址
        url_name = resolve(request.path_info).url_name
        print(url_name)
        # 获取用户权限
        usercookei = request.COOKIES.get('userid')
        # 查询用户群组
        userworkid = userlogin.objects.filter(code=usercookei)
        if userworkid.exists():
            userworkid = userlogin.objects.get(code=usercookei)
            res = ast.literal_eval(userworkid.ad_groups)
            # print(res)
            for i in res:
                permissioninfo = WebPermissions.objects.filter(permissionname=i, isTure=True)
                if permissioninfo.exists():
                    return result
                else:
                    continue
            return render(request, "nopermission.html", {'userinfo': userworkid})
        else:
            return render(request, "login.html", )
    return wrapper

@cheackpermission
def permissions(request):
    return render(request,"permission.html")