需要优化的部分

用户权限初始化代码需要单独放置在一个模块里，且放在rbac目录中

session的key键值需要配置化，在setting文件配置

用户权限校验中间件需要放在权限目录中，不能放置在业务代码中

优化后

优化后项目目录

具体代码
web/views/account.py

from django.shortcuts import HttpResponse, render, redirect
from rbac import models
from rbac.service.init_Permission import init_Permission


def login(request):
    # 1. 用户登录
    if request.method == 'GET':
        return render(request, 'login.html')
    user = request.POST.get('user')
    pwd = request.POST.get('pwd')

    current_user = models.UserInfo.objects.filter(name=user, password=pwd).first()
    if not current_user:
        return render(request, 'login.html', {'msg': '用户名或密码错误'})
    init_Permission(current_user,request)

    return redirect('/customer/list/')

rbac/service/init_Permission.py

# -*- encoding: utf-8 -*-
"""
@File    : init_Permission.py
@Time    : 2021-12-16 22:30
@Author  : tangsai
@Email   : 294168604@qq.com
@Software: PyCharm
"""
from luffy_permission_simon import settings


def init_Permission(current_user, request):
    # 2. 权限信息初始化
    # 根据当前用户信息获取此用户所拥有的所有权限，并放入session。
    # 当前用户所有权限
    permission_queryset = current_user.roles.filter(permissions__isnull=False).values("permissions__id",
                                                                                      "permissions__url").distinct()

    # 获取权限中所有的URL
    # permission_list = []
    # for item in permission_queryset:
    #     permission_list.append(item['permissions__url'])

    permission_list = [item['permissions__url'] for item in permission_queryset]
    # for item in permission_list:
    #     print(item)
    # request.session[settings.PERMISSION_SESSION_KEY] = permission_list
    request.session[settings.PERMISSION_SESSION_KEY] = permission_list

rbac/middlewares/rbac.py

# -*- encoding: utf-8 -*-
"""
@File    : rbac.py
@Time    : 2021-12-16 22:29
@Author  : tangsai
@Email   : 294168604@qq.com
@Software: PyCharm
"""
import re
from django.utils.deprecation import MiddlewareMixin
from django.shortcuts import HttpResponse
from luffy_permission_simon import settings


class RbacMiddleware(MiddlewareMixin):
    """
    用户权限信息校验
    """

    def process_request(self, request):
        """
        当用户请求刚进入时候出发执行
        :param request:
        :return:
        """

        """
        1. 获取当前用户请求的URL
        2. 获取当前用户在session中保存的权限列表 ['/customer/list/','/customer/list/(?P<cid>\\d+)/']
        3. 权限信息匹配
        """
        valid_url_list = [
            '/login/',
            '/admin/.*'
        ]

        current_url = request.path_info
        for valid_url in valid_url_list:
            if re.match(valid_url, current_url):
                # 白名单中的URL无需权限验证即可访问
                return None

        permission_list = request.session.get(settings.PERMISSION_SESSION_KEY)
        if not permission_list:
            return HttpResponse('未获取到用户权限信息，请登录！')

        flag = False

        for url in permission_list:
            reg = "^%s$" % url
            if re.match(reg, current_url):
                flag = True
                break

        if not flag:
            return HttpResponse('无权访问')

setting.py
中间件路径更改

新增配置

#######权限相关配置#######
#session的key键值
PERMISSION_SESSION_KEY = 'luffy_permission_url_list_key'
#白名单路径
VALID_URL_LIST = [
    '/login/',
    '/admin/.*'
]