Django员工管理模型优化：实现个人数据专属查看权限

一、模型一致性修正 #

首先统一Breaks和Attendance的关联逻辑，当前Breaks直接关联User，而Attendance关联Employee，建议统一关联Employee（因为Employee已经和User绑定），同时移除硬编码的默认值：

修改后的Breaks模型：

class Breaks(models.Model):
    employee = models.ForeignKey(Employee, on_delete=models.CASCADE)
    break_in = models.TimeField(null=True)
    break_out = models.TimeField(null=True)

    def __str__(self):
        return f"{self.employee} - 休假记录"

二、视图层实现数据权限控制 #

模型仅定义数据结构，核心权限控制需要在视图层完成，确保登录用户只能操作自己的记录：

1. 列表/详情页面过滤数据

无论是函数视图还是类视图，都要过滤出当前用户关联的Employee对应的记录：

# Attendance列表视图（类视图示例）
from django.views.generic import ListView
from .models import Attendance

class AttendanceListView(ListView):
    model = Attendance

    def get_queryset(self):
        # 只返回当前用户的考勤记录
        return Attendance.objects.filter(employee__user=self.request.user)

# 函数视图版本
from django.shortcuts import render
from .models import Attendance

def attendance_list(request):
    attendance_records = Attendance.objects.filter(employee__user=request.user)
    return render(request, 'attendance/list.html', {'attendance_records': attendance_records})

2. 新增/编辑页面自动填充员工字段

禁止用户手动选择其他员工，在表单提交时自动赋值为当前用户对应的Employee：

首先定义表单时排除employee字段：

from django import forms
from .models import Attendance, Breaks

class AttendanceForm(forms.ModelForm):
    class Meta:
        model = Attendance
        exclude = ['employee']  # 不让用户选择员工

class BreaksForm(forms.ModelForm):
    class Meta:
        model = Breaks
        exclude = ['employee']

然后在创建视图中自动填充：

from django.views.generic.edit import CreateView
from .models import Attendance
from .forms import AttendanceForm

class AttendanceCreateView(CreateView):
    model = Attendance
    form_class = AttendanceForm
    success_url = '/attendance/'

    def form_valid(self, form):
        # 自动绑定当前用户的Employee实例
        form.instance.employee = Employee.objects.get(user=self.request.user)
        return super().form_valid(form)

三、可选模型优化 #

• 将Employee的email字段改为EmailField，自带格式校验：

  email = models.EmailField(max_length=30)
  

• 若eid是业务员工编号则保留，若仅作为主键可改为AutoField自动生成：

  eid = models.AutoField(primary_key=True)
  

• 移除Employee和原Breaks中的default=1，改用信号自动为新注册用户创建Employee实例：

  from django.db.models.signals import post_save
  from django.contrib.auth.models import User
  from django.dispatch import receiver
  from .models import Employee
  
  @receiver(post_save, sender=User)
  def create_employee(sender, instance, created, **kwargs):
      if created:
          Employee.objects.create(user=instance)
  

四、权限加固 #

在详情/编辑视图中同样添加过滤逻辑，防止用户通过URL篡改ID访问他人数据：

class AttendanceDetailView(DetailView):
    model = Attendance

    def get_queryset(self):
        return Attendance.objects.filter(employee__user=self.request.user)

内容的提问来源于stack exchange，提问作者kritika