如何基于时间过滤视图访问权限？预约页面权限管控技术求助

Hey Adam, let's break down how to get this time-gated access control working properly—this is a super common use case, so we can map out a clear, reliable path for you based on the Django files you mentioned (models.py, forms.py, views.py):

1. First, Lock Down Your Appointment Model Structure #

Start by making sure your Appointment model includes all the critical fields needed to validate access. Here's a solid baseline:

# models.py
from django.contrib.auth.models import User
from django.db import models
from datetime import datetime

class Appointment(models.Model):
    user = models.ForeignKey(User, on_delete=models.CASCADE)
    restricted_page_slug = models.CharField(max_length=100)  # Unique identifier for your restricted page
    start_time = models.DateTimeField()
    end_time = models.DateTimeField()
    is_active = models.BooleanField(default=True)  # Flag to cancel invalid appointments

    class Meta:
        # Prevent duplicate bookings for the same user + page + time slot
        unique_together = ['user', 'restricted_page_slug', 'start_time']

    def is_currently_valid(self):
        now = datetime.now()
        return self.start_time <= now <= self.end_time and self.is_active

Add the is_currently_valid method to keep access checks clean later on.

2. Build a Reusable Access Check (Decorator or Mixin) #

Don't repeat validation logic across views—create a reusable tool to enforce access. A decorator works great for function-based views, while a mixin fits class-based views:

Option A: Function View Decorator

# views.py
from django.shortcuts import redirect
from django.contrib import messages
from .models import Appointment

def require_valid_appointment(page_slug):
    def decorator(view_func):
        def wrapper(request, *args, **kwargs):
            # First, ensure the user is logged in
            if not request.user.is_authenticated:
                messages.error(request, "You need to log in to access this page.")
                return redirect('login')
            
            # Check for an active, time-matching appointment
            valid_appointment = Appointment.objects.filter(
                user=request.user,
                restricted_page_slug=page_slug
            ).filter(is_currently_valid=True).exists()

            if not valid_appointment:
                messages.error(request, "You don't have an active appointment for this page right now.")
                return redirect('appointment_booking')  # Send users to book an appointment
            
            return view_func(request, *args, **kwargs)
        return wrapper
    return decorator

Option B: Class View Mixin

from django.views.generic import TemplateView

class AppointmentRequiredMixin:
    restricted_page_slug = None

    def dispatch(self, request, *args, **kwargs):
        if not request.user.is_authenticated:
            messages.error(request, "Please log in first.")
            return redirect('login')
        
        valid_appointment = Appointment.objects.filter(
            user=request.user,
            restricted_page_slug=self.restricted_page_slug
        ).filter(is_currently_valid=True).exists()

        if not valid_appointment:
            messages.error(request, "No active appointment for this page.")
            return redirect('appointment_booking')
        
        return super().dispatch(request, *args, **kwargs)

3. Apply the Access Check to Your Restricted View #

Now hook up your decorator/mixin to the view that serves your restricted page:

For Function Views:

@require_valid_appointment(page_slug="special_consultation")
def restricted_consultation_page(request):
    # Your page logic here
    return render(request, 'restricted/consultation.html')

For Class Views:

class RestrictedConsultationView(AppointmentRequiredMixin, TemplateView):
    restricted_page_slug = "special_consultation"
    template_name = 'restricted/consultation.html'

4. Optional: Add Frontend UX Improvements #

While backend checks are non-negotiable, you can improve user experience with frontend checks:

• Show a countdown timer on the booking confirmation page for when access starts
• Add an AJAX pre-check before users try to navigate to the restricted page:

// frontend script (e.g., in base.html)
function checkAccess(pageSlug) {
    fetch(`/check-access/${pageSlug}/`)
        .then(res => res.json())
        .then(data => {
            if (!data.has_access) {
                alert("You don't have access to this page right now. Please book an appointment first.");
                window.location.href = '/book-appointment/';
            }
        });
}

// Run check when the restricted page loads
window.onload = () => checkAccess("special_consultation");

And the corresponding backend endpoint:

from django.http import JsonResponse

def check_access(request, page_slug):
    if not request.user.is_authenticated:
        return JsonResponse({"has_access": False})
    
    has_access = Appointment.objects.filter(
        user=request.user,
        restricted_page_slug=page_slug
    ).filter(is_currently_valid=True).exists()
    
    return JsonResponse({"has_access": has_access})

5. Test Critical Edge Cases #

Make sure to validate these scenarios to avoid gaps:

• User is not logged in: Should redirect to login
• User has a booking but it's not yet active: Access denied
• User's booking expired: Access denied
• User's booking was canceled (is_active=False): Access denied
• User is within their booked time window: Access granted

内容的提问来源于stack exchange，提问作者Adam Dalton