如何在Django Rest框架mongoengine中管理角色和权限

from mongoengine import Document, StringField, ListField

class Role(Document):
    name = StringField(required=True, unique=True)
    permissions = ListField(StringField())

class Permission(Document):
    name = StringField(required=True, unique=True)

admin_role = Role(name='admin', permissions=['create', 'read', 'update', 'delete'])
admin_role.save()

read_permission = Permission(name='read')
read_permission.save()

from mongoengine import Document, StringField, ReferenceField

class User(Document):
    username = StringField(required=True, unique=True)
    role = ReferenceField(Role)

# 查询用户角色和权限
user = User.objects(username='john').first()
role = user.role
permissions = role.permissions

# 更新用户角色
new_role = Role.objects(name='editor').first()
user.role = new_role
user.save()