如何在PythonEveAPI中创建新的用户帐户，并使用受用户限制的资源访问进行保护

我首先使用PythonEVE框架创建了一个web api，没有身份验证或用户帐户，它工作得非常好！我现在正在尝试添加身份验证和用户帐户，但遇到了一些困难。我想使用用户受限的资源访问，但如果资源受限，用户如何创建新的用户帐户？我错过了什么

我一直在努力学习python-eve.org上的和介绍，我搜索了stackoverflow，包括这个

以下是我的实现：

run.py

import os.path
from eve import Eve
import my_auth
from flask.ext.bootstrap import Bootstrap
from eve_docs import eve_docs

app = Eve(auth=my_auth.BCryptAuth, settings = 'deployed_settings.py')

app.on_insert_accounts += my_auth.create_user
Bootstrap(app)
app.register_blueprint(eve_docs, url_prefix='/docs')

if __name__ == '__main__':
    app.run()

我的_auth.py

import bcrypt
from eve import Eve
from eve.auth import BasicAuth 

class BCryptAuth(BasicAuth):
    def check_auth(self, username, password, allowed_roles, resource, method):
         # use Eve's own db driver; no additional connections/resources are used
         accounts = Eve.app.data.driver.db['accounts']
         account = accounts.find_one({'username': username})
         if account and 'user_id' in account:
             self.set_request_auth_value(account['user_id'])
         return account and bcrypt.hashpw(
             password.encode('utf-8'),account['salt'].encode('utf-8')) == account['password']

def create_user(documents):
    for document in documents:
        document['salt'] = bcrypt.gensalt().encode('utf-8')
        password = document['password'].encode('utf-8')
        document['password'] = bcrypt.hashpw(password, document['salt'])

已部署的_settings.py

# We are running on a local machine, so just use the local mongod instance.
# Note that MONGO_HOST and MONGO_PORT could very well be left
# out as they already default to a bare bones local 'mongod' instance.
MONGO_HOST = 'localhost'
MONGO_PORT = 27017
MONGO_USERNAME = ''
MONGO_PASSWORD = ''
MONGO_DBNAME = 'practice'

# Name of the field used to store the owner of each document
AUTH_FIELD = 'user_id'

# Enable reads (GET), inserts (POST) and DELETE for resources/collections
# (if you omit this line, the API will default to ['GET'] and provide
# read-only access to the endpoint).
RESOURCE_METHODS = ['GET', 'POST', 'DELETE']

# Enable reads (GET), edits (PATCH), replacements (PUT) and deletes of
# individual items  (defaults to read-only item access).
ITEM_METHODS = ['GET', 'PATCH', 'PUT', 'DELETE']
IF_MATCH = False  # When set to false, older versions may potentially replace newer versions

XML = False  # disable xml output

# Schemas for data objects are defined here:

classes = {
# ... Contents omitted for this question
}

people = {
# ... Contents omitted for this question
}

logs = {
# ... Contents omitted for this question
}

sessions = {
# ... Contents omitted for this question
}


accounts = {
    # the standard account entry point is defined as '/accounts/<ObjectId>'.
    # an additional read-only entry point is accessible at '/accounts/<username>'.
    'additional_lookup': {
        'url': 'regex("[\w]+")',
        'field': 'username',
    },

    # disable endpoint caching to prevent apps from caching account data
    'cache_control': '',
    'cache_expires': 0,

    # schema for the accounts endpoint
    'schema': {
        'username': {
            'type': 'string',
            'required': True,
            'unique': True,
        },
        'password': {
            'type': 'string',
            'required': True,
        },
    },
}

# The DOMAIN dict explains which resources will be available and how they will
# be accessible to the API consumer.
DOMAIN = {
    'classes': classes,
    'people': people,
    'logs': logs,
    'sessions': sessions,
    'accounts': accounts,
}

#我们在本地机器上运行，所以只需使用本地mongod实例即可。
#请注意，MONGO_主机和MONGO_端口可以很好地保留
#因为它们已经默认为一个裸体本地“mongod”实例。
MONGO_主机='localhost'
MONGO_港=27017
MONGO_用户名=“”
MONGO_密码=“”
MONGO_DBNAME=‘实践’
#用于存储每个文档所有者的字段的名称
身份验证字段='user\u id'
#为资源/集合启用读取（获取）、插入（发布）和删除
#（如果省略这一行，API将默认为['GET']，并提供
#对端点的只读访问）。
资源_方法=['GET'，'POST'，'DELETE']
#启用对的读取（获取）、编辑（修补）、替换（放置）和删除
#单个项目（默认为只读项目访问）。
ITEM_METHODS=['GET'，'PATCH'，'PUT'，'DELETE']
如果_MATCH=False#设置为False时，旧版本可能会替换新版本
XML=False#禁用XML输出
#数据对象的架构定义如下：
类别={
#…此问题省略的内容
}
人={
#…此问题省略的内容
}
日志={
#…此问题省略的内容
}
会话={
#…此问题省略的内容
}
账户={
#标准帐户入口点定义为“/accounts/”。
#可以在“/accounts/”访问另一个只读入口点。
“附加查找”：{
“url”：“regex（[\w]+”，
'字段'：'用户名'，
},
#禁用端点缓存以防止应用缓存帐户数据
“缓存控制”：“，
“缓存\u过期”：0，
#帐户终结点的架构
“架构”：{
“用户名”：{
'类型'：'字符串'，
“必需”：True，
“独特”：正确，
},
“密码”：{
'类型'：'字符串'，
“必需”：True，
},
},
}
#域dict解释了哪些资源可用以及如何使用
#API使用者可以访问。
域={
“类”：类，
"人":人,，
“日志”：日志，
“会话”：会话，
“账户”：账户，
}

一个简单的解决方案是不限制您的用户创建方法。大概是这样的：

class BCryptAuth(BasicAuth):
    def check_auth(self, username, password, allowed_roles, resource, method):

        # allow anyone to create a new account.
        if resource == 'accounts' and method == 'POST':
            return True

        accounts = Eve.app.data.driver.db['accounts']
        account = accounts.find_one({'username': username})
        if account and 'user_id' in account:
           self.set_request_auth_value(account['user_id'])
        return account and bcrypt.hashpw(password.encode('utf-8'),account['salt'].encode('utf-8')) == account['password']

或者，尤其是如果您只允许向

帐户

端点进行过帐，您可以选择退出端点的身份验证：

'accounts': {
    # or you could provide a different custom class here, 
    # so you don't need the guard in the general-purpose auth class.
    'authentication': None,
    ...
}

---

希望这有帮助。

如果我们不限制帐户资源，有人可以获取api url并发布一个具有超级用户角色的用户并操纵整个数据库？我不确定？