如何在Django中设置模型限制？用户单条记录添加权限问题求解

Hey there! Let's walk through how to set up this one-record limit for your new users. It's a common requirement, and there are a few layers you can implement to make it solid:

First, you need a way to count how many records a user already has. This depends on your tech stack, but here are examples for common setups:

SQL Databases (MySQL/PostgreSQL) #

Run a count query before allowing a new record:

SELECT COUNT(*) FROM records WHERE user_id = ?;

Replace ? with the current logged-in user's ID.

ORM Examples #

If you're using an ORM like Django ORM or Sequelize:

• Django:

  record_count = Record.objects.filter(user=request.user).count()
  

• Sequelize (Node.js):

  const recordCount = await Record.count({ where: { userId: req.user.id } });
  

In your record-creation endpoint or view, add a check using the count you just fetched:

• If the count is 1 or more, return the error message immediately.
• If the count is 0, proceed to create the new record.

Example: Express.js API Endpoint #

app.post('/api/records', async (req, res) => {
  const userId = req.user.id; // Assume you've fetched the user via auth middleware
  const recordCount = await Record.count({ where: { userId } });

  if (recordCount >= 1) {
    return res.status(403).json({ message: "You are permited to add only one record" });
  }

  // Create the new record
  const newRecord = await Record.create(req.body);
  res.status(201).json(newRecord);
});

Example: Django View #

from django.http import JsonResponse
from .models import Record

def add_record(request):
    if request.method == 'POST':
        record_count = Record.objects.filter(user=request.user).count()
        if record_count >= 1:
            return JsonResponse(
                {"message": "You are permited to add only one record"}, 
                status=403
            )
        
        # Create the record with user association
        Record.objects.create(user=request.user, **request.POST.dict())
        return JsonResponse({"message": "Record added successfully"}, status=201)

To save users from waiting for an API response, add a quick check on the frontend before they submit:

async function canAddRecord() {
  const authToken = localStorage.getItem('authToken');
  const response = await fetch('/api/records/count', {
    headers: { 'Authorization': `Bearer ${authToken}` }
  });
  const { count } = await response.json();
  return count === 0;
}

// Attach to your "Add Record" button
document.getElementById('add-record-btn').addEventListener('click', async (e) => {
  e.preventDefault();
  const isAllowed = await canAddRecord();
  if (!isAllowed) {
    alert("You are permited to add only one record");
    return;
  }
  // Submit the form if allowed
  document.getElementById('record-form').submit();
});

To prevent anyone from bypassing your app's logic (e.g., direct database edits), add a database-level constraint. Here's a PostgreSQL trigger example:

-- Create a function to check the limit
CREATE OR REPLACE FUNCTION check_single_record_per_user()
RETURNS TRIGGER AS $$
BEGIN
  IF (SELECT COUNT(*) FROM records WHERE user_id = NEW.user_id) >= 1 THEN
    RAISE EXCEPTION 'You are permited to add only one record';
  END IF;
  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

-- Attach the trigger to the records table
CREATE TRIGGER record_limit_trigger
BEFORE INSERT ON records
FOR EACH ROW EXECUTE FUNCTION check_single_record_per_user();

This way, even if someone tries to insert a second record directly into the database, it'll throw an error.

内容的提问来源于stack exchange，提问作者killerbees