Method, device and equipment for realizing flexible configuration of data authority based on data interface
By building an API resource library and adjusting the JSqlParser engine, combined with user sets, organization sets, and custom rule sets, the flexibility and efficiency issues of data permission configuration are solved, efficient data permission management is achieved, and multiple combination strategies and full-link closed-loop management are supported.
Patent Information
- Application Number
- CN202510777051.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-11
- Publication Date
- 2025-10-10
AI Technical Summary
The data permission configuration in the existing technology cannot be flexible and efficient, and requires manual configuration of the interface address and data permission entry point, which cannot meet the different requirements of the user objects and readable range of different business data.
By obtaining the key-value pair information of the database API interface, parsing the key information to build an API resource library, combining the user set, organization set and custom rule set, using vector space operations to build the data permission filtering SQL conditional logic, and adjusting the JSqlParser engine to insert the filtering condition logic before SQL execution to achieve flexible configuration of data permissions.
It achieves efficient and flexible configuration of data permissions, improves permission configuration efficiency by 20 times, supports up to 8 combination strategies, improves scalability by 300%, and establishes an API resource library through automatic scanning, transforms the SQL parsing engine, and forms a full-link closed-loop management.
Smart Images
Figure CN120763232A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data authority management, and particularly relates to a data authority flexible configuration implementation method, device and equipment based on a data interface. BACKGROUND
[0002] Business analysts need to obtain business data of various business systems for analyzing business conditions. For example, a business analyst needs to collect metadata of a library and a table of corresponding business data in advance according to a business type, so as to list data structure conditions of the business type for the business analyst, and then select and collect corresponding target business data according to metadata based on business requirements. However, the business system contains various business data, and the use objects of various business data are different, and the readable data ranges are different, so that data authority needs to be configured.
[0003] Currently, for data authority, configuration is generally based on roles and users, and interface addresses need to be manually configured, and data authority entry points need to be manually added, so that flexible and efficient data authority configuration management cannot be completely achieved. SUMMARY
[0004] The present application provides a data authority flexible configuration implementation method, device and equipment based on a data interface, which can achieve efficient and flexible configuration of data authority.
[0005] In a first aspect, the present application provides a data authority flexible configuration implementation method based on a data interface, which includes the following steps. Obtaining key-value pair information of an implementation method of a database API interface and performing parsing to obtain key information of each API interface, so as to implement construction of an API resource library; Implementing user authority division based on a user set, an organization set and a custom rule set, and constructing data authority filtering SQL condition calculation logic through vector space operation; Adjusting a JSqlParser engine to insert data authority filtering SQL condition calculation logic before SQL execution, and combining the API resource library to obtain final data authority filtering SQL conditions when accessing the API interface.
[0006] In combination with the first aspect, in an implementation manner, the key information includes a URL address, an interface name and a request mode of the API interface.
[0007] In combination with the first aspect, in an implementation manner, the step of obtaining key-value pair information of an implementation method of a database API interface and performing parsing to obtain key information of each API interface, so as to implement construction of an API resource library, specifically includes the following steps. Based on springboot and combined with the RequestMappingHandlerMapping component, call the getHandlerMethods function to obtain the key-value pair information of the implementation methods of all API interfaces in the database; Get the value of the key-value pair information of the current API interface, and get the name of the implementation method of the current API interface through the getMethodAnnotation function; Get the key of the key-value pair information of the current API interface, get the request method of the current API interface through the getMethodsCondition function and the getMethods function, and get the URL address of the current API interface through the getPatternValues function; Build an API resource library based on the URL address, interface name and request method of each API interface obtained.
[0008] In conjunction with the first aspect, in one embodiment, The filtering condition of the user set is to obtain the user ID bound to the role based on the createBy field carried by each data in the database, and match the obtained user ID with the createBy field to achieve filtering; The filtering condition of the organization set is to match the orgId field carried by each data in the database with the organizational structure as a condition to achieve filtering; The filtering condition of the custom rule set is to implement custom rule filtering based on the created custom SQL condition during execution.
[0009] In conjunction with the first aspect, in one embodiment, the data authority filtering SQL condition calculation logic is specifically as follows: Data permission filtering SQL condition calculation logic = (user set filtering condition ∨ organization set filtering condition) ∧ custom rule set filtering condition Among them, ∨ represents the OR operation, and ∧ represents the AND operation.
[0010] In conjunction with the first aspect, in one embodiment, the API resource library is combined to obtain the final data permission filtering SQL condition when accessing the API interface, specifically including: When logging into the database, obtain the permission configuration information of all API interfaces based on the API resource library; Perform user set analysis to obtain the corresponding relationship between API interfaces and user sets, and perform organization set analysis to obtain the corresponding relationship between API interfaces and organization sets; When accessing the API interface, the user set and organization set corresponding to the current API interface are obtained, and the custom rule set is also obtained. The final data permission filtering SQL condition is calculated according to the data permission filtering SQL condition calculation logic to implement permission configuration.
[0011] In conjunction with the first aspect, in one embodiment, performing user set parsing to obtain a correspondence between an API interface and a user set specifically includes: Get the current logged-in user ID and the current logged-in user's role list; Determine whether the current logged-in user ID exists in the authorized user ID rule of the permission configuration information of the current API interface, or whether the role of the current logged-in user exists in the authorized role rule. If so, establish a correspondence between the current API interface and the current logged-in user, and obtain a correspondence between the API interface and the user set.
[0012] In conjunction with the first aspect, in one embodiment, performing the organizational set and obtaining the corresponding relationship between the API interface and the organizational set specifically includes: Get the organization of the currently logged-in user; Determine whether the organization of the currently logged-in user exists in the authorized organization rules of the permission configuration information of the current API interface. If so, establish a correspondence between the current API interface and the organization of the currently logged-in user, and obtain a correspondence between the API interface and the organization set.
[0013] In a second aspect, an embodiment of the present application provides a device for implementing flexible configuration of data permissions based on a data interface, the device comprising: The acquisition module is used to obtain and parse the key-value pair information of the implementation method of the database API interface, and obtain the key information of each API interface to realize the construction of the API resource library; A construction module is used to implement user rights division based on user sets, organizational sets, and custom rule sets, and to construct the data rights filtering SQL condition calculation logic through vector space operations; The execution module is used to adjust the JSqlParser engine to insert the data permission filtering SQL condition calculation logic before SQL execution, and combine with the API resource library to obtain the final data permission filtering SQL condition when accessing the API interface.
[0014] In the third aspect, an embodiment of the present application provides a data interface-based data permission flexible configuration implementation device, wherein the data interface-based data permission flexible configuration implementation device includes a processor, a memory, and a data interface-based data permission flexible configuration implementation program stored on the memory and executable by the processor, wherein when the data interface-based data permission flexible configuration implementation program is executed by the processor, the steps of the above-mentioned data interface-based data permission flexible configuration implementation method are implemented.
[0015] The beneficial effects of the technical solutions provided in the embodiments of the present application include: By obtaining and parsing the key-value pair information of the implementation method of the database API interface, the key information of each API interface is obtained to realize the construction of the API resource library. Then, user permission division is implemented based on the user set, organization set and custom rule set, and the data permission filtering SQL condition calculation logic is constructed through vector space operation. Then, the JSqlParser engine is adjusted to insert the data permission filtering SQL condition calculation logic before SQL execution, and combined with the API resource library to obtain the final data permission filtering SQL condition when accessing the API interface. The API resource library is established through automatic scanning, the SQL parsing engine is transformed to realize conditional injection, and the permission feature vector is established to improve the authentication efficiency, forming a full-link closed-loop management to achieve efficient and flexible configuration of data permissions. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 This is a flowchart of the implementation method for flexible configuration of data permissions based on the data interface of this application; Figure 2 This is a schematic diagram of the functional modules of the device for implementing flexible configuration of data permissions based on the data interface of this application; Figure 3 This is a schematic diagram of the hardware structure of the device that implements flexible configuration of data permissions based on the data interface for this application. DETAILED DESCRIPTION
[0017] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0018] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.
[0019] On the first aspect, the embodiment of the present application provides a method for implementing flexible configuration of data permissions based on a data interface, a dynamic data permission system based on RBAC (Role-Based Access Control), and realizes the three-level linkage control of "interface-role / organization-data". It stipulates that each database business table must have creator and organization fields, establishes an API (Application Programming Interface) resource library through automatic scanning, transforms the SQL (Structured Query Language) parsing engine to realize conditional injection, establishes permission feature vectors to improve authentication efficiency, and forms a full-link closed-loop management.
[0020] In one embodiment, referring to Figure 1 , Figure 1 This is a flow chart of the method for implementing flexible configuration of data permissions based on the data interface of this application. Figure 1 As shown, the flexible configuration implementation method of data permissions based on the data interface includes: S1: Obtain and parse the key-value pairs of the implementation methods of the database API interface to obtain the key information of each API interface to build the API resource library; the key information includes the URL address of the API interface, the interface name, and the request method; S2: Implements user rights division based on user sets, organizational sets, and custom rule sets, and constructs data rights filtering SQL condition calculation logic through vector space operations; S3: Adjust the JSqlParser engine to insert the data permission filtering SQL condition calculation logic before SQL execution, and combine it with the API resource library to obtain the final data permission filtering SQL condition when accessing the API interface.
[0021] Furthermore, in one embodiment, key-value pair information of implementation methods of database API interfaces is obtained and parsed to obtain key information of each API interface to implement the construction of an API resource library, specifically including: S101: Based on Spring Boot and combined with the RequestMappingHandlerMapping component, call the getHandlerMethods function to obtain the key-value pair information of the implementation methods of all API interfaces in the database; It should be noted that springboot is an open source application framework, which provides a container with inversion of control feature; RequestMappingHandlerMapping is a request mapping processor in Spring MVC, which is responsible for mapping HTTP requests to specific Controller methods; getHandlerMethods is used to obtain all processing methods and mapping objects using Spring MVC annotations; S102: Obtain the value of the key-value pair information of the current API interface, and obtain the name of the implementation method of the current API interface through the getMethodAnnotation function; It should be noted that getMethodAnnotation is used to obtain the annotation on the method; S103: Obtain the key of the key-value pair information of the current API interface, obtain the request method of the current API interface through the getMethodsCondition function and the getMethods function, and obtain the URL (Uniform Resource Locator, Uniform Resource Locator) address of the current API interface through the getPatternValues function; It should be noted that getMethodsCondition refers to the configuration of method-level security control in Spring Security, which allows or denies access to specific methods; getMethods is used to obtain all public methods in the current class, parent class or parent interface; getPatternValues is used to obtain the value of path pattern matching; S104: Based on the obtained URL address, interface name and request method of each API interface, an API resource library is constructed.
[0022] Specifically, this application adopts an intelligent interface discovery mechanism based on springboot, and calls the getHandlerMethods function through the RequestMappingHandlerMapping component to obtain the key-value pair information of the implementation methods of all API interfaces in the database, that is, Map<RequestMappingInfo, HandlerMethod> , then get the value of the key-value pair information, get the annotation through the getMethodAnnotation function, get the name of the implementation method through the annotation, then get the key of the key-value pair information, call the getMethodsCondition function and the getMethods function, you can get the request method of the API interface, call the getPatternValues function to get the URL address of the API interface, so far, you have successfully obtained the URL address, interface name, and request method of the API interface in the database. The three key information are used as the basis for building an API resource library. Compared with the traditional manual registration method, the efficiency can be increased by 20 times. This application analyzes the RequestMapping annotation through the AST syntax tree, intelligently extracts the URI path and request method, and solves the permission lag problem caused by dynamic interface updates.
[0023] Furthermore, this application adopts a multi-dimensional permission fusion algorithm to divide user permissions into user sets, organization sets and custom rule sets. Custom rules are data permission rules customized according to needs.
[0024] The filtering condition for the user set is to use the createBy field (the field used to record the creator in the database table) carried by each data entry in the database as the target of permission control. At the same time, when performing permission control based on roles, the user ID bound to the role is obtained through the role, and the obtained user ID is matched with the createBy field to achieve filtering. The filtering condition for the organization set is to match the orgId (organization identification code) field carried by each data in the database with the orgId field when the organizational structure is used as a condition to achieve filtering; The filtering conditions of a custom rule set are as follows: for the custom SQL conditions you create, custom rule filtering is implemented based on the custom SQL conditions during execution. That is, the custom rules are based on the custom SQL conditions, and the custom SQL conditions are directly spliced into the custom rules during execution to implement custom rule filtering.
[0025] In this application, the data permission filtering SQL condition calculation logic is as follows: Data permission filtering SQL condition calculation logic = (user set filtering condition ∨ organization set filtering condition) ∧ custom rule set filtering condition Here, ∨ represents an OR operation, and ∧ represents an AND operation. This is based on vector space calculations to derive the aforementioned data permission filtering SQL condition calculation logic. This supports up to eight combination strategies, increasing strategy scalability by 300% compared to traditional hard-coded strategies.
[0026] Furthermore, in this application, the JSqlParser (a Java library for parsing SQL statements) engine is adjusted to insert data permission filtering SQL condition calculation logic before SQL execution. Specifically, zero-intrusive SQL rewriting is achieved, and the JSqlParser engine is enhanced to insert the above-mentioned data permission filtering SQL condition calculation logic before SQL execution without the need for business layer code modification.
[0027] Furthermore, in one embodiment, the API resource library is combined to obtain the final data permission filtering SQL conditions when accessing the API interface, specifically including: S301: Obtaining permission configuration information of all API interfaces based on the API resource library when logging into the database; S302: Perform user set analysis to obtain the corresponding relationship between API interfaces and user sets, and perform organization set analysis to obtain the corresponding relationship between API interfaces and organization sets; S303: When accessing the API interface, the user set and organization set corresponding to the current API interface are obtained, and the custom rule set is obtained at the same time, so as to obtain the final data permission filtering SQL condition according to the data permission filtering SQL condition calculation logic to implement permission configuration.
[0028] Furthermore, user set parsing is performed to obtain the corresponding relationship between API interfaces and user sets, including: a1: Get the current logged-in user ID and the role list of the current logged-in user; a2: Determine whether the current logged-in user ID exists in the authorized user ID rule of the permission configuration information of the current API interface, or whether the current logged-in user's role exists in the authorized role rule. If so, establish a correspondence between the current API interface and the current logged-in user, and obtain a correspondence between the API interface and the user set.
[0029] Furthermore, the organization set is performed to obtain the corresponding relationship between the API interface and the organization set, including: b1: Get the organization of the currently logged-in user; b2: Determine whether the organization of the currently logged-in user exists in the authorized organization rules of the permission configuration information of the current API interface. If so, establish a correspondence between the current API interface and the organization of the currently logged-in user, and obtain a correspondence between the API interface and the organization set.
[0030] Specifically, for the 4. permission analysis preprocessing of the application, the permission configuration is configured according to roles and organizations, the user obtains the permission configuration information of all API interfaces based on the API resource library when logging into the database, then the user set is analyzed to obtain the current login user ID and the role list of the current login user, it is judged whether the current login user ID exists in the authorized user ID rule of the permission configuration information of the current API interface, or whether the role of the current login user exists in the authorized role rule, if so, the corresponding relationship between the current API interface and the current login user is established, the corresponding relationship between the API interface and the user set is obtained and cached, then the organization set is analyzed to obtain the organization of the current login user, it is judged whether the organization of the current login user exists in the authorized organization rule of the permission configuration information of the current API interface, if so, the corresponding relationship between the current API interface and the organization of the current login user is established, the corresponding relationship between the API interface and the organization set is obtained and cached; When the user accesses the API interface later, the user set and the organization set corresponding to the current API interface can be obtained according to the corresponding relationship obtained by the previous analysis, and the custom rule set is obtained at the same time, the data permission filtering SQL condition calculation logic is used for calculation, the final data permission filtering SQL condition is quickly obtained, and the permission configuration is realized.
[0031] That is, the application can realize highly flexible permission rule configuration, and can specify various rules flexibly based on data interfaces, and can grant data generated by a certain role or a certain organization to a certain role or a certain organization.
[0032] The application solves the problem of API interface input through automatic scanning, and binds the organization to which each piece of data belongs, so that when the permission is granted according to the organization, people who should not see the data in the organization can also see the data. At the same time, related concepts such as database and table are hidden, reducing the difficulty of user use, and providing flexible configuration of permission rule configuration intuitively.
[0033] The method for flexibly configuring data authority based on a data interface according to the embodiments of the present application obtains key-value pair information of an implementation method of a database API interface and parses the information to obtain key information of each API interface to implement construction of an API resource library, then divides user authority based on a user set, an organization set and a custom rule set, and constructs data authority filtering SQL condition calculation logic through vector space operation, then adjusts the JSqlParser engine to insert the data authority filtering SQL condition calculation logic before SQL execution, and combines the API resource library to obtain final data authority filtering SQL conditions when accessing the API interface, and the API resource library is automatically scanned to be established, the SQL parsing engine is modified to implement condition injection, the authority feature vector is established to improve authentication efficiency, a full-link closed-loop management is formed, and efficient and flexible configuration of data authority is implemented.
[0034] In a second aspect, the embodiments of the present application further provide a device for flexibly configuring data authority based on a data interface.
[0035] In an embodiment, refer to Figure 2 , Figure 2 FIG. 1 is a schematic diagram of functional modules of a device for flexibly configuring data authority based on a data interface according to the embodiments of the present application. As shown in FIG. 1, the device for flexibly configuring data authority based on a data interface includes an obtaining module, a constructing module and an executing module. Figure 2
[0036] The obtaining module is configured to obtain key-value pair information of an implementation method of a database API interface and parse the information to obtain key information of each API interface to implement construction of an API resource library; the constructing module is configured to divide user authority based on a user set, an organization set and a custom rule set, and construct data authority filtering SQL condition calculation logic through vector space operation; and the executing module is configured to adjust the JSqlParser engine to insert the data authority filtering SQL condition calculation logic before SQL execution, and combine the API resource library to obtain final data authority filtering SQL conditions when accessing the API interface.
[0037] In a third aspect, the embodiments of the present application provide a device for flexibly configuring data authority based on a data interface. The device for flexibly configuring data authority based on a data interface can be a personal computer (PC), a notebook computer, a server or other device with a data processing function.
[0038] Refer to Figure 3 , Figure 3 FIG. 2 is a schematic diagram of a hardware structure of a device for flexibly configuring data authority based on a data interface according to the embodiments of the present application. In the embodiments of the present application, the device for flexibly configuring data authority based on a data interface can include a processor, a memory, a communication interface and a communication bus.
[0039] The communication bus may be of any type and is used to interconnect the processor, memory, and communication interface.
[0040] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces. These interfaces are used to interconnect internal devices and other devices (such as other computing devices or user devices) based on flexible data permission configuration. Physical interfaces can be Ethernet, fiber, or ATM interfaces; user devices can be displays or keyboards.
[0041] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.
[0042] The processor may be a general-purpose processor that can call a data interface-based data permission flexible configuration implementation program stored in a memory and execute the data interface-based data permission flexible configuration implementation method provided in the embodiments of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the data interface-based data permission flexible configuration implementation program is called can refer to the various embodiments of the data interface-based data permission flexible configuration implementation method of the present application, and will not be repeated here.
[0043] Those skilled in the art will understand that Figure 3 The hardware structure shown in the figure does not constitute a limitation to the present application and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.
[0044] The terms “include,” “comprise,” “have,” and any variations thereof, in the Specification and in the Claims of the present application, and the above-mentioned drawings, are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that includes a list of steps or units is not limited to the listed steps or units, but can optionally further include steps or units not listed, or can optionally further include other steps or units inherent to such processes, methods, products, or devices. The terms “first,” “second,” and “third” and the like descriptions are used to distinguish different objects, and do not represent a sequence or limit the types of “first,” “second,” and “third.”
[0045] In the description of the embodiments of the present application, “exemplary”, “for example”, or “for instance” is used to represent an example, an illustration, or a description. Any embodiment or design scheme described as “exemplary”, “for example”, or “for instance” in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words “exemplary”, “for example”, or “for instance” are intended to present the relevant concept in a specific manner.
[0046] In the description of the embodiments of the present application, unless otherwise specified, “ / ” represents the meaning of or, for example, A / B can represent A or B; “and / or” in the text only represents a description of the relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. In addition, in the description of the embodiments of the present application, “multiple” means two or more than two.
[0047] In some of the processes described in the embodiments of the present application, a plurality of operations or steps are included in a specific order, but it should be understood that these operations or steps can be executed or performed in parallel or in an order different from that in which they appear in the embodiments of the present application. The serial number of the operation is only used to distinguish different operations, and the serial number itself does not represent any execution order. In addition, these processes can include more or fewer operations, and these operations or steps can be executed in sequence or in parallel, and these operations or steps can be combined.
[0048] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and a general hardware platform as required, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, an optical disk) as described above, and includes a plurality of instructions for causing a terminal device to execute the methods described in the embodiments of the present application.
[0049] The preferred embodiments of the present application have been described above with the illustrated embodiments, and are not intended to limit the scope of patent protection for the present application. Any equivalent structure or equivalent process variations, which directly or indirectly incorporate the contents of the specification and drawings of the present application, are also intended to be included within the scope of patent protection for the present application.
Claims
1. A method for implementing flexible configuration of data permissions based on a data interface, characterized in that: The method for implementing flexible configuration of data permissions based on a data interface includes: Obtain and parse the key-value pair information of the implementation method of the database API interface to obtain the key information of each API interface to build the API resource library; User rights are divided based on user sets, organizational sets, and custom rule sets, and the data rights filtering SQL condition calculation logic is constructed through vector space operations. Adjust the JSqlParser engine to insert data permission filtering SQL condition calculation logic before SQL execution, and combine it with the API resource library to obtain the final data permission filtering SQL condition when accessing the API interface.
2. A method for implementing flexible configuration of data permissions based on a data interface according to claim 1, characterized in that: The key information includes the URL address of the API interface, the interface name and the request method.
3. A method for implementing flexible configuration of data permissions based on a data interface according to claim 2, characterized in that: The key-value pair information of the implementation method of the database API interface is obtained and parsed to obtain the key information of each API interface to realize the construction of the API resource library, which specifically includes: Based on springboot and combined with the RequestMappingHandlerMapping component, call the getHandlerMethods function to obtain the key-value pair information of the implementation methods of all API interfaces in the database; Get the value of the key-value pair information of the current API interface, and get the name of the implementation method of the current API interface through the getMethodAnnotation function; Get the key of the key-value pair information of the current API interface, get the request method of the current API interface through the getMethodsCondition function and the getMethods function, and get the URL address of the current API interface through the getPatternValues function; Build an API resource library based on the URL address, interface name and request method of each API interface obtained.
4. The method for implementing flexible data permission configuration based on a data interface according to claim 1, characterized in that: The filtering condition of the user set is to obtain the user ID bound to the role based on the createBy field carried by each data in the database, and match the obtained user ID with the createBy field to achieve filtering; The filtering condition of the organization set is to match the orgId field carried by each data in the database with the organizational structure as a condition to achieve filtering; The filtering condition of the custom rule set is to implement custom rule filtering based on the created custom SQL condition during execution.
5. A method for implementing flexible configuration of data permissions based on a data interface according to claim 4, characterized in that: The data permission filtering SQL condition calculation logic is specifically as follows: Data permission filtering SQL condition calculation logic = (user set filtering condition ∨ organization set filtering condition) ∧ custom rule set filtering condition Among them, ∨ represents the OR operation, and ∧ represents the AND operation.
6. A method for implementing flexible configuration of data permissions based on a data interface according to claim 5, characterized in that: The combination of the API resource library to obtain the final data permission filtering SQL conditions when accessing the API interface specifically includes: When logging into the database, obtain the permission configuration information of all API interfaces based on the API resource library; Perform user set analysis to obtain the corresponding relationship between API interfaces and user sets, and perform organization set analysis to obtain the corresponding relationship between API interfaces and organization sets; When accessing the API interface, the user set and organization set corresponding to the current API interface are obtained, and the custom rule set is also obtained. The final data permission filtering SQL condition is calculated according to the data permission filtering SQL condition calculation logic to implement permission configuration.
7. A method for implementing flexible configuration of data permissions based on a data interface according to claim 6, characterized in that: The user set parsing is performed to obtain the corresponding relationship between the API interface and the user set, specifically including: Get the current logged-in user ID and the current logged-in user's role list; Determine whether the current logged-in user ID exists in the authorized user ID rule of the permission configuration information of the current API interface, or whether the role of the current logged-in user exists in the authorized role rule. If so, establish a correspondence between the current API interface and the current logged-in user, and obtain a correspondence between the API interface and the user set.
8. The method for implementing flexible configuration of data permissions based on a data interface according to claim 6, characterized in that: The said organization set is performed to obtain the corresponding relationship between the API interface and the organization set, specifically including: Get the organization of the currently logged-in user; Determine whether the organization of the currently logged-in user exists in the authorized organization rules of the permission configuration information of the current API interface. If so, establish a correspondence between the current API interface and the organization of the currently logged-in user, and obtain a correspondence between the API interface and the organization set.
9. A device for implementing flexible configuration of data permissions based on a data interface, characterized in that: The data interface-based data authority flexible configuration implementation device includes: The acquisition module is used to obtain and parse the key-value pair information of the implementation method of the database API interface to obtain the key information of each API interface to realize the construction of the API resource library; A construction module is used to implement user rights division based on user sets, organizational sets, and custom rule sets, and to construct the data rights filtering SQL condition calculation logic through vector space operations; The execution module is used to adjust the JSqlParser engine to insert the data permission filtering SQL condition calculation logic before SQL execution, and combine with the API resource library to obtain the final data permission filtering SQL condition when accessing the API interface.
10. A device for implementing flexible configuration of data permissions based on a data interface, characterized in that: The data interface-based data permission flexible configuration implementation device includes a processor, a memory, and a data interface-based data permission flexible configuration implementation program stored on the memory and executable by the processor, wherein when the data interface-based data permission flexible configuration implementation program is executed by the processor, the steps of the data interface-based data permission flexible configuration implementation method as described in any one of claims 1 to 8 are implemented.