Django跨模型过滤：如何实现用户仅查看参与项目的新闻？

Hey there! Let's figure out how to make sure users only see news from projects they're part of. I'll walk you through common, practical approaches based on typical Django setups—feel free to adjust them to match your actual model structure.

First, Let's Assume a Typical Model Structure #

I'll start with a sample model setup (if yours is different, tweak the logic accordingly):

# models.py
from django.contrib.auth.models import User
from django.db import models

class Project(models.Model):
    name = models.CharField(max_length=100)
    # Add other project fields (like description, created_at, etc.)

# Join table for many-to-many relationship between users and projects
class UserProject(models.Model):
    user = models.ForeignKey(User, on_delete=models.CASCADE)
    project = models.ForeignKey(Project, on_delete=models.CASCADE)
    # Optional: add role (e.g., 'member', 'admin') or other association details

class News(models.Model):
    project = models.ForeignKey(Project, on_delete=models.CASCADE)
    title = models.CharField(max_length=200)
    content = models.TextField()
    created_at = models.DateTimeField(auto_now_add=True)
    # Add other news fields (like author, updated_at, etc.)

1. Filtering in Function-Based Views #

If you're using function-based views, you can directly filter the news queryset to only include entries from projects the current user is part of:

# views.py
from django.shortcuts import render
from .models import News

def user_news_list(request):
    # Get IDs of all projects the user is associated with
    user_project_ids = request.user.userproject_set.values_list('project_id', flat=True)
    # Filter news to only those linked to those projects
    user_news = News.objects.filter(project_id__in=user_project_ids)
    return render(request, 'news/news_list.html', {'news': user_news})

2. Filtering in Class-Based Views (e.g., ListView) #

For class-based views like ListView, override the get_queryset method to apply the filter:

# views.py
from django.views.generic import ListView
from .models import News

class UserNewsListView(ListView):
    model = News
    template_name = 'news/news_list.html'
    context_object_name = 'news'

    def get_queryset(self):
        # Get user's associated project IDs
        user_project_ids = self.request.user.userproject_set.values_list('project_id', flat=True)
        # Return only news from those projects
        return super().get_queryset().filter(project_id__in=user_project_ids)

3. Add Security for Detail Views #

To prevent users from accessing individual news items they shouldn't see (via direct URL), add a permission check in your detail view:

# views.py
from django.shortcuts import get_object_or_404
from django.http import HttpResponseForbidden
from .models import News

def news_detail(request, pk):
    news_item = get_object_or_404(News, pk=pk)
    # Check if the user is part of the news item's project
    user_project_ids = request.user.userproject_set.values_list('project_id', flat=True)
    if news_item.project.id not in user_project_ids:
        return HttpResponseForbidden("You don't have permission to view this news.")
    return render(request, 'news/news_detail.html', {'news': news_item})

4. Optional: Use a Custom Model Manager #

If you want to encapsulate the filtering logic at the model level (for reusability), create a custom manager:

# models.py
class UserNewsManager(models.Manager):
    def for_user(self, user):
        user_project_ids = user.userproject_set.values_list('project_id', flat=True)
        return self.filter(project_id__in=user_project_ids)

class News(models.Model):
    # ... existing fields ...
    objects = models.Manager()  # Keep the default manager
    user_specific = UserNewsManager()  # Your custom manager

Then use it in views like this:

# views.py
def user_news_list(request):
    user_news = News.user_specific.for_user(request.user)
    return render(request, 'news/news_list.html', {'news': user_news})

内容的提问来源于stack exchange，提问作者Tobi