Django APIView源码解析

APIView使用：luffy项目中关于APIView的使用

在Django之 CBV和FBV中，我们是分析的from django.views import View下的执行流程，以下是代码

from django.views import  View
class IndexView(View):
    def get(self,request, *args, **kwargs):
        return HttpResponse("ok")

    def dispatch(self, request, *args, **kwargs):
        ret = super(IndexView,self).dispatch(request, *args, **kwargs)

        return  HttpResponse(ret)

这篇博客我们就来了解下APIView是如何执行的，跟django.views模块下的view有何关联？

from rest_framework.views import  APIView

我们依然从url配置入手分析

url(r"books/$",views.BookView.as_view())

as_view方法代码如下

原来APIView类是继承View类，view类正式from django.views import View下的View,

先看as_view方法中的view = super(APIView, cls).as_view(**initkwargs)的这行代码, 
是调用了父类View中的as_view方法，这里的initkwargs，及其父类的View中的as_view方法执行流程，之类就不在赘述了

具体流程去看我的博客链接

https://www.cnblogs.com/95lyj/p/9432750.html

所以在APIView类中，我们重点看下return csrf_exempt(view)做了什么操作？

def csrf_exempt(view_func):
    def wrapped_view(*args, **kwargs):
        return view_func(*args, **kwargs)
    wrapped_view.csrf_exempt = True
    return wraps(view_func, assigned=available_attrs(view_func))(wrapped_view)

wrapped_view.csrf_exempt = True意思是取消当前函数防跨站请求伪造功能，即便settings中设置了全局中间件，然后将csrf_exempt函数中的内置函数wrapped_view赋值wrapped_view.csrf_exempt = True，使其拥有该属性，

接下来看 wraps(view_func, assigned=available_attrs(view_func))(wrapped_view)函数之前， 
我们先看下assigned=available_attrs(view_func)

def available_attrs(fn):
    if six.PY3:
        return WRAPPER_ASSIGNMENTS
    else:
        return tuple(a for a in WRAPPER_ASSIGNMENTS if hasattr(fn, a))

大概意思就是针对py3或者其他版本做了一些判断处理，最后通过WRAPPER_ASSIGNMENTS定为到

WRAPPER_ASSIGNMENTS = ('__module__', '__name__', '__qualname__', '__doc__',
                       '__annotations__')

这个逻辑跟我们上一篇的CBV源码有共同之处，就是为某个方法或者函数，添加某些属性 
接下来我们看wraps函数吧

def wraps(wrapped,
          assigned = WRAPPER_ASSIGNMENTS,
          updated = WRAPPER_UPDATES):
    return partial(update_wrapper, wrapped=wrapped,
                   assigned=assigned, updated=updated) 

wrapped是我们在def csrf_exempt(view_func):函数中的参数，也就是as_view的返回值，

最后通过functools模块下的partial类进行装饰构造，partial 这个东西是针对函数起作用的，并且是部分的， 
场景：有这样的函数：get_useragent(request) 用来获取用户浏览器的ua信息，但是这个函数又不是在主体函数(执行页面渲染的函数）get时调用的，只在模板中的一个filter中调用的（可以理解是在模板渲染时调用的),而filter在执行的时候是不能添加参数的，哪你要怎么处理。

这时partial就得闪亮登场,如下是代码，

def __new__(*args, **keywords):
        if not args:
            raise TypeError("descriptor '__new__' of partial needs an argument")
        if len(args) < 2:
            raise TypeError("type 'partial' takes at least one argument")
        cls, func, *args = args
        if not callable(func):
            raise TypeError("the first argument must be callable")
        args = tuple(args)

        if hasattr(func, "func"):
            args = func.args + args
            tmpkw = func.keywords.copy()
            tmpkw.update(keywords)
            keywords = tmpkw
            del tmpkw
            func = func.func

        self = super(partial, cls).__new__(cls)

        self.func = func
        self.args = args
        self.keywords = keywords
        return self

    def __call__(*args, **keywords):
        if not args:
            raise TypeError("descriptor '__call__' of partial needs an argument")
        self, *args = args
        newkeywords = self.keywords.copy()
        newkeywords.update(keywords)
        return self.func(*self.args, *args, **newkeywords)

最后在csrf_exempt函数中的wraps(view_func, assigned=available_attrs(view_func))(wrapped_view)这里写代码片传入参数wrapped_view，通过对象可调用功能，进行调用__call__方法 
到此as_view分析完毕，以上代码好多有迷惑的点，我分析的时候也是很多猜想的

上篇CBV源码分析中我们知道，当as_view执行后，当浏览器访问某个api接口时候， 
就会先触发dispatch,然后在dispatch中，如下是父类的dispatch方法

def dispatch(self, request, *args, **kwargs):
        # Try to dispatch to the right method; if a method doesn't exist,
        # defer to the error handler. Also defer to the error handler if the
        # request method isn't on the approved list.

        if request.method.lower() in self.http_method_names:
            handler = getattr(self, request.method.lower(), self.http_method_not_allowed)
        else:
            handler = self.http_method_not_allowed

        return handler(request, *args, **kwargs)

然而API方法中也有自己的dispatch方法，会执行子类的方法，而不是去执行父类的dispatch方法，以下是代码

以上dispatch方法中，通过self.initialize_request(request, *args, **kwargs)

def initialize_request(self, request, *args, **kwargs):
        """
        Returns the initial request object.
        """
        #将请求变成字典格式返回了
        parser_context = self.get_parser_context(request)

        return Request(
            request,
            parsers=self.get_parsers(),  #解析数据，默认的有三种方式，可点进去看
            #self.get_authenticator优先找自己的，没有就找父类的
            authenticators=self.get_authenticators(), #获取认证相关的所有类并实例化，传入request对象供Request使用
            negotiator=self.get_content_negotiator(),
            parser_context=parser_context
        )

通过initialize_request的到一个Request类对象

在这过程中：

1、获取认证相关的类的具体   authenticators=self.get_authenticators(),

    def get_authenticators(self):
        """
        Instantiates and returns the list of authenticators that this view can use.
        """
        #返回的是对象列表
        return [auth() for auth in self.authentication_classes]  #[SessionAuthentication,BaseAuthentication]

2、查看认证的类：self.authentication_classes

authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES  #默认的，如果自己有会优先执行自己的

3、接着走进api_settings

api_settings = APISettings(None, DEFAULTS, IMPORT_STRINGS)  #点击继承的DEFAULTS类

DEFAULTS = {
    # Base API policies
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.SessionAuthentication',   #这时候就找到了他默认认证的类了，可以导入看看
        'rest_framework.authentication.BasicAuthentication'
    ),

4、导入了类看看类里面具体干了什么

from rest_framework.authentication import SessionAuthentication
from rest_framework.authentication import BaseAuthentication

5、看到里面有个authenticate方法和authenticate_header方法

class BaseAuthentication(object):
    """
    All authentication classes should extend BaseAuthentication.
    """

    def authenticate(self, request):
        """
        Authenticate the request and return a two-tuple of (user, token).
        """
        raise NotImplementedError(".authenticate() must be overridden.")

    def authenticate_header(self, request):
        """
        Return a string to be used as the value of the `WWW-Authenticate`
        header in a `401 Unauthenticated` response, or `None` if the
        authentication scheme should return `403 Permission Denied` responses.
        """
        pass

 6、具体处理认证，从headers里面能获取用户名和密码

class BasicAuthentication(BaseAuthentication):
    """
    HTTP Basic authentication against username/password.
    """
    www_authenticate_realm = 'api'

    def authenticate(self, request):
        """
        Returns a `User` if a correct username and password have been supplied
        using HTTP Basic authentication.  Otherwise returns `None`.
        """
        auth = get_authorization_header(request).split()

        if not auth or auth[0].lower() != b'basic':
            return None   #返回none不处理。让下一个处理

        if len(auth) == 1:
            msg = _('Invalid basic header. No credentials provided.')
            raise exceptions.AuthenticationFailed(msg)
        elif len(auth) > 2:
            msg = _('Invalid basic header. Credentials string should not contain spaces.')
            raise exceptions.AuthenticationFailed(msg)

        try:
            auth_parts = base64.b64decode(auth[1]).decode(HTTP_HEADER_ENCODING).partition(':')   #用partition切割冒号也包括
        except (TypeError, UnicodeDecodeError, binascii.Error):
            msg = _('Invalid basic header. Credentials not correctly base64 encoded.')
            raise exceptions.AuthenticationFailed(msg)

        userid, password = auth_parts[0], auth_parts[2]  # 返回用户和密码
        return self.authenticate_credentials(userid, password, request)

    def authenticate_credentials(self, userid, password, request=None):
        """
        Authenticate the userid and password against username and password
        with optional request for context.
        """
        credentials = {
            get_user_model().USERNAME_FIELD: userid,
            'password': password
        }
        user = authenticate(request=request, **credentials)

        if user is None:
            raise exceptions.AuthenticationFailed(_('Invalid username/password.'))

        if not user.is_active:
            raise exceptions.AuthenticationFailed(_('User inactive or deleted.'))

        return (user, None)

    def authenticate_header(self, request):
        return 'Basic realm="%s"' % self.www_authenticate_realm

当然restfulframework默认定义了两个类。我们也可以自定制类，自己有就用自己的了，自己没有就去找父类的了，但是里面必须实现authenticate方法，不然会报错。

然后self.initial(request, *args, **kwargs)，

• 处理版权信息
• 认证
• 权限
• 请求用户进行访问频率的限制

1、首先 self.initial(request, *args, **kwargs)可以看到做了以下操作

    def initial(self, request, *args, **kwargs):
        """
        Runs anything that needs to occur prior to calling the method handler.
        """
        self.format_kwarg = self.get_format_suffix(**kwargs)

        # Perform content negotiation and store the accepted info on the request
        neg = self.perform_content_negotiation(request)
        request.accepted_renderer, request.accepted_media_type = neg

        # Determine the API version, if versioning is in use.
        #2.1 处理版本信息
        version, scheme = self.determine_version(request, *args, **kwargs)
        request.version, request.versioning_scheme = version, scheme

        # Ensure that the incoming request is permitted
        #2.2 认证
        self.perform_authentication(request)
        # 2.3 权限
        self.check_permissions(request)
        # 2.4 请求用户进行访问频率的限制
        self.check_throttles(request)

 2、我们先来看认证，self.perform_authentication(request) 具体干了什么，按住ctrl点击进去

    def perform_authentication(self, request):
        """
        Perform authentication on the incoming request.

        Note that if you override this and simply 'pass', then authentication
        will instead be performed lazily, the first time either
        `request.user` or `request.auth` is accessed.
        """
        request.user   #执行request的user，这是的request已经是加工后的request了

3、那么我们可以从视图里面导入一下Request，找到request对象的user方法

from rest_framework.views import Request

    @property
    def user(self):
        """
        Returns the user associated with the current request, as authenticated
        by the authentication classes provided to the request.
        """
        if not hasattr(self, '_user'):
            with wrap_attributeerrors():
                self._authenticate()  #
        return self._user  #返回user

4、执行self._authenticate() 开始用户认证，如果验证成功后返回元组： (用户,用户Token)

 def _authenticate(self):
        """
        Attempt to authenticate the request using each authentication instance
        in turn.
        """
        #循环对象列表
        for authenticator in self.authenticators:
            try:
                #执行每一个对象的authenticate 方法
                user_auth_tuple = authenticator.authenticate(self)
            except exceptions.APIException:
                self._not_authenticated()
                raise

            if user_auth_tuple is not None:
                self._authenticator = authenticator
                self.user, self.auth = user_auth_tuple  #返回一个元组，user，和auth，赋给了self,
                # 只要实例化Request，就会有一个request对象，就可以request.user,request.auth了
                return

        self._not_authenticated() 

5、在user_auth_tuple = authenticator.authenticate(self) 进行验证，如果验证成功，执行类里的authenticatie方法

6、如果用户没有认证成功：self._not_authenticated()

 def _not_authenticated(self):
        """
        Set authenticator, user & authtoken representing an unauthenticated request.

        Defaults are None, AnonymousUser & None.
        """
        #如果跳过了所有认证，默认用户和Token和使用配置文件进行设置
        self._authenticator = None  #

        if api_settings.UNAUTHENTICATED_USER:
            self.user = api_settings.UNAUTHENTICATED_USER() # 默认值为：匿名用户AnonymousUser
        else:
            self.user = None  # None 表示跳过该认证

        if api_settings.UNAUTHENTICATED_TOKEN:
            self.auth = api_settings.UNAUTHENTICATED_TOKEN()  # 默认值为：None
        else:
            self.auth = None

    # (user, token)
    # 表示验证通过并设置用户名和Token；
    # AuthenticationFailed异常

完善request请求的一些注意事项，例如用户登录、检测权限等等

然后response = handler(request, *args, **kwargs)这里面是执行了对应的请求操作，如get\post请求，也就是执行了我们自定义视图里面的get方法等，在处理完毕后，赋值response然后作为参数进行如下的操作

随后self.response = self.finalize_response(request, response, *args, **kwargs)返回，这一部操作，跟它的父类View是不同的， 
在继承APIView的视图中，get\post需要返回HttpResponse,然后在通过self.finalize_response进一步封装，最后返回

最后在dispatch中

self.response = self.finalize_response(request, response, *args, **kwargs)
        return self.response