A method, device, equipment and storage medium for obtaining permissions
By storing key-value pairs of role encoding and permissions in preset storage containers in memory, and obtaining permission roles directly from the container, the problem of inefficient access to permissions in the prior art is solved, and efficient permission acquisition is achieved.
Patent Information
- Application Number
- CN202010518018.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-06-09
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2040-06-09
AI Technical Summary
The existing permission acquisition scheme has inefficient permission acquisition due to the high overhead of database connection and query time.
By presetting the key-value pairs of role encoding and permissions in the storage container in memory, the interaction with the database is reduced, and the permission role is directly obtained from the storage container, and whether the permission role includes the object role is determined to obtain permissions.
It significantly improves the efficiency of permission acquisition, reduces database interaction logic, and ensures the accuracy of permission acquisition.
Smart Images
Figure CN113779517B_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the field of computer application technology, and in particular, to a permission acquisition method, device, equipment and storage medium. Background Art
[0002] Most existing permission acquisition solutions first establish a connection with the database, and then query the database based on the established connection to obtain the corresponding permission data.
[0003] However, due to the overhead of database connection establishment time and query time in the above solution, the entire permission acquisition process takes a long time and the acquisition efficiency is low. Summary of the invention
[0004] The embodiments of the present invention provide a method, apparatus, device and storage medium for obtaining rights, which solve the problem of low efficiency in obtaining rights.
[0005] In a first aspect, an embodiment of the present invention provides a method for obtaining permissions, which may include:
[0006] When a triggering event for obtaining permission is detected, obtaining the permission to be obtained corresponding to the triggering event and the object role of the permission obtaining object;
[0007] Acquire a permission role associated with the permission to be obtained from a preset storage container, wherein the permission role is a role having the permission to be obtained;
[0008] Determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained based on the judgment result;
[0009] The preset storage container implements the data storage function through the following steps:
[0010] According to the obtained role codes of each role, the permissions associated with each role are obtained respectively;
[0011] Extracting path information from the authority and storing the path information in a preset storage container, wherein the path information is key information;
[0012] The role associated with the path information is stored in a preset storage container, wherein the role associated with the path information is value information.
[0013] Optionally, the number of roles associated with the path information is at least two. Accordingly, storing the roles associated with the path information in a preset storage container may include:
[0014] Filter the current role from the roles associated with the path information;
[0015] Determine whether a role associated with the path information is stored in a preset storage container;
[0016] If not, the current role is stored in a preset secondary collection object, and the secondary collection object is backfilled into the preset storage container;
[0017] Otherwise, the data set containing the role associated with the path information stored in the preset storage container is obtained, the current role is stored in the data set, and the data set of the added role is filled back into the preset storage container.
[0018] Optionally, storing the role associated with the path information in a preset storage container may include:
[0019] A storage function is generated based on the preset annotation, and the role associated with the path information is stored in a preset storage container based on the storage function.
[0020] Optionally, the permission includes permission information and path information. Extracting the path information from the permission includes:
[0021] Convert permissions into stream data based on a preset conversion function;
[0022] The lambda expression is used as the input parameter to traverse the stream data, and the path information is extracted from each permission according to the traversal results.
[0023] Optionally, based on the obtained role codes of the roles, permissions associated with each role are obtained, which may include:
[0024] Obtain each role from a database and store each role in a memory, wherein the role includes a role code, a role name and / or a role description information;
[0025] According to each role code, the permissions associated with the role code are obtained from the database.
[0026] Optionally, based on the obtained role codes of the roles, permissions associated with each role are obtained, which may include:
[0027] It is determined whether the preset storage container is empty. If so, the permissions associated with each role are obtained according to the role codes of the roles that have been obtained.
[0028] Optionally, the preset storage container includes a key-value pair of Static type, the key information in the key-value pair includes data of String type, and / or the value information includes data of Collection type.
[0029] In a second aspect, an embodiment of the present invention further provides a permission acquisition device, which may include:
[0030] An object role acquisition module is used to acquire the permission to be acquired corresponding to the triggering event and the object role of the permission acquisition object when a triggering event for acquiring the permission is detected;
[0031] A permission role acquisition module, used to acquire a permission role associated with the permission to be acquired from a preset storage container, wherein the permission role is a role having the permission to be acquired;
[0032] The permission acquisition module is used to determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained according to the judgment result;
[0033] The preset storage container implements the data storage function through the following modules:
[0034] The permission obtaining module is used to obtain the permissions associated with each role according to the role codes of each role that have been obtained;
[0035] A path information storage module, used to extract path information from permissions and store the path information in a preset storage container, wherein the path information is key information;
[0036] The role storage module is used to store the role associated with the path information into a preset storage container, wherein the role associated with the path information is value information.
[0037] In a third aspect, an embodiment of the present invention further provides a device, which may include:
[0038] one or more processors;
[0039] A memory for storing one or more programs;
[0040] When one or more programs are executed by one or more processors, the one or more processors implement the permission acquisition method provided by any embodiment of the present invention.
[0041] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the permission acquisition method provided by any embodiment of the present invention.
[0042] The technical solution of the embodiment of the present invention obtains the permissions associated with each role according to the role codes of the roles that have been obtained, and stores the path information of the permissions and all the roles associated with them in a preset storage container in the form of key-value pairs; in this way, when a triggering event for obtaining permissions is detected, the permissions to be obtained corresponding to the triggering event and the object role of the permission obtaining object can be obtained; the permission role associated with the permission to be obtained is obtained from the preset storage container, and according to whether the permission role includes the object role, it is determined whether the permission obtaining object can obtain the permission to be obtained. The above technical solution can effectively reduce the interaction logic with the database when obtaining permissions, and permissions can be directly obtained from the preset storage container set in the memory, which solves the problem of low efficiency in obtaining permissions. While ensuring the accuracy of permission acquisition, it can greatly improve the efficiency of obtaining permissions. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] Figure 1 is a flowchart of a method for obtaining permissions in Embodiment 1 of the present invention;
[0044] Figure 2 It is a structural block diagram of a permission acquisition device in Embodiment 2 of the present invention;
[0045] Figure 3 It is a structural schematic diagram of a device in embodiment 3 of the present invention. DETAILED DESCRIPTION
[0046] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It is also necessary to explain that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.
[0047] Before introducing the embodiment of the present invention, the application scenario of the embodiment of the present invention is first exemplified: each object has multiple roles, and each role has multiple permissions. For example, assuming that the object role of an object is both an employee of the program development department and a leader of the marketing department, then, as an employee of the program development department, he has access rights to the system content associated with the program development department, and as a leader of the marketing department, he has both access rights and modification rights to the system content associated with the marketing department. Therefore, when the system receives a permission acquisition request sent by the object, it can determine whether it has the permission to be acquired based on the permission to be acquired and the object role decomposed from the permission acquisition request.
[0048] Embodiment 1
[0049] Figure 1This is a flowchart of a method for obtaining permissions provided in Embodiment 1 of the present invention. This embodiment is applicable to the case of obtaining permissions from a preset storage container stored in a memory. The method can be executed by a permission obtaining device provided in an embodiment of the present invention, which can be implemented in software and / or hardware, and can be integrated in various user terminals or servers.
[0050] See also Figure 1 The method of the embodiment of the present invention specifically includes the following steps:
[0051] S110. Obtain the permissions associated with each role according to the obtained role codes of the roles.
[0052] The data of which roles each object has and which permissions each role has are stored in the database. Moreover, in order to uniquely identify each role, the role can be associated with the role code, so that each role can include a role code, which can be a string type of data. This is because the string type role code is a string of English letters. According to the English letters, the specific information of the role can be directly obtained without the need for secondary query logic again, thereby improving the efficiency of obtaining permissions.
[0053] For example, if the role code is Leader of marketing department, then according to the role code, it can be known that the role is the leader of the marketing department. In addition, each role may also include a role name, role description information, etc., which are not specifically limited here.
[0054] Therefore, after obtaining each role from the database, the permissions associated with each role can be obtained from the database according to the role code of each role, or the permissions associated with each role code. The permission is usually a set of multiple permissions, each permission may include path information (url) and permission information. These roles and permissions obtained from the database can be stored in memory.
[0055] S120: Extract path information from the authority, and store the path information in a preset storage container, wherein the path information is key information in the key-value pair.
[0056] Among them, after obtaining the authority, since the authority includes path information, the corresponding path information can be extracted from each authority and stored in a preset storage container, and the path information is the key information in the key-value pair. It can be understood by those skilled in the art that data such as roles and authorities are stored in the database. In order to reduce the number of interactions with the database, these data can be first stored in the memory in the form of variables, and then the corresponding data can be stored in the preset storage container.
[0057] S130: Store the role associated with the path information in a preset storage container, wherein the role associated with the path information is the value information in the key-value pair.
[0058] Among them, for any path information in the preset storage container, the roles associated with it can be stored in the preset storage container in sequence and used as the value information of the path information, that is, the path information and the roles associated with it are stored in the preset storage container in the form of key-value pairs.
[0059] Exemplarily, assuming that role 1 has permission 1, and role 2 has permission 1 and permission 2, then the roles associated with permission 1 are role 1 and role 2, and the role associated with permission 2 is role 2. Thus, for the path information of permission 1, the roles associated with it can be traversed so that role 1 and role 2 can be stored in the preset storage container in sequence; correspondingly, for the path information of permission 2, the roles associated with it can be traversed so that role 2 can be stored in the preset storage container in sequence.
[0060] On this basis, optionally, if the number of roles associated with the path information is at least two, the current role can be first filtered out from the roles associated with the path information, and at the same time, it can be determined whether the role associated with the path information is already stored in the preset storage container; if not, the current role can be stored in a preset secondary collection object, and the secondary collection object can be backfilled into the preset storage container; if so, the data set containing the role associated with the path information stored in the preset storage container can be obtained, and the current role can be added to the data set, and the data set of the added role can be backfilled into the preset storage container.
[0061] Exemplarily, continuing with permission 1 in the above example, role 1 is first used as the current role. At this time, the preset storage container does not store any role associated with the path information. In this case, role 1 can be stored in the preset secondary collection object, and the secondary collection object can be backfilled into the preset storage container. Next, role 2 is used as the current role. At this time, the preset storage container already stores role 1 associated with the path information. In this case, the data set containing role 1 associated with the path information stored in the preset storage container can be obtained first, and role 2 can be added to the data set. Then, the data set with added role 2 can be backfilled into the preset storage container.
[0062] S140: When a triggering event for obtaining permission is detected, obtaining the permission to be obtained corresponding to the triggering event and the object role of the permission obtaining object.
[0063] Among them, after all the path information and all the roles associated with each path information have been stored in the preset storage container, if a triggering event for obtaining permission is detected, the permission to be obtained corresponding to the triggering event and the object role of the permission acquisition object can be obtained, wherein the triggering event can be a reception event of a permission acquisition request, an access event of target data, a modification event of target data, etc. The permission to be obtained is the permission that the permission acquisition object hopes to obtain, and the object role is the various roles that the permission acquisition object has, and the number may be one, two or more.
[0064] S150: Acquire a permission role associated with the permission to be acquired from a preset storage container, wherein the permission role is a role having the permission to be acquired.
[0065] Among them, the path information and roles in the preset storage container are stored in the form of key-value pairs. Therefore, according to the path information of the permission to be obtained, the permission role associated with it can be obtained from the preset storage container, and the permission role includes each role with the permission to be obtained.
[0066] S160: Determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained according to the determination result.
[0067] Among them, if the object role is at least one of the permission roles, the permission acquisition object can obtain the permission to be obtained. For example, the object roles are A, B and C, and the permission roles are A, B, E, F, G, H, I and G. Since the two have a common role, namely role A and role B, the permission acquisition object can obtain the permission to be obtained. Correspondingly, if the object role is not any of the permission roles, the permission acquisition object cannot obtain the permission to be obtained. Compared with the conventional method of determining whether the permission acquisition object can obtain the permission to be obtained by judging whether there is a mapping relationship between the path information of the permission to be obtained and the object role, from the perspective of practical application, the judgment efficiency of the above technical solution is faster.
[0068] The technical solution of the embodiment of the present invention obtains the permissions associated with each role according to the role codes of the roles that have been obtained, and stores the path information of the permissions and all the roles associated with them in a preset storage container in the form of key-value pairs; in this way, when a triggering event for obtaining permissions is detected, the permissions to be obtained corresponding to the triggering event and the object role of the permission obtaining object can be obtained; the permission role associated with the permission to be obtained is obtained from the preset storage container, and according to whether the permission role includes the object role, it is determined whether the permission obtaining object can obtain the permission to be obtained. The above technical solution can effectively reduce the interaction logic with the database when obtaining permissions, and permissions can be directly obtained from the preset storage container set in the memory, which solves the problem of low efficiency in obtaining permissions. While ensuring the accuracy of permission acquisition, it can greatly improve the efficiency of obtaining permissions.
[0069] In order to better understand the specific implementation process of the above steps, the permission acquisition method of this embodiment is exemplarily described below in combination with specific examples. Exemplarily, considering that there is usually only one data in the set of the primary structure, if there is a correlation between multiple data, it is necessary to set multiple sets to reflect the correlation between the sets. However, multiple sets bring about a large waste of data space. To solve this problem, the preset storage container is set to a secondary structure so that the data in multiple sets can be stored in one set, so that more data can be carried in a smaller data space. On this basis, the key information in the preset storage container is set to String type data so that a certain path information (url) can be represented based on the key information. Considering that each url is associated with multiple value information, each value information is a role, thus, the value information corresponding to the url can be set to a secondary collection type. In order to implement this secondary collection type, the role class DYRole is pre-set. DYRole is also a role container, and its specific meaning is as follows:
[0070]
[0071]
[0072] Specifically, the DYRole class includes a role code, a role name, and a role description. The code is the unique identifier of the role, which is a String type of data. Compared with a numeric type code such as an ID that has no substantive meaning, the String type code is a string of English letters. The specific information of the role can be directly obtained based on the English letters, without the need to perform secondary query logic based on the code, thereby improving the efficiency of obtaining permissions.
[0073] Considering that when implementing the storage and retrieval of roles in DYRole based on the get and set series functions, there may be problems such as code redundancy. To solve this problem, preset annotations are set in DYRole to automatically generate storage functions and retrieval functions, so that the storage of roles in DYRole is implemented based on the storage function, and the retrieval of roles in DYRole is implemented based on the retrieval function. Exemplarily, by setting the @Data annotation, its get and set series functions can be automatically generated, which can greatly simplify the writing of data storage operation functions and improve the development efficiency of applications.
[0074] After setting the role container DYRole, considering that url is a first-level collection type, its corresponding value information is a second-level collection type, so the value information can be set to Collection type data, such as Collection <authority>, where Authority is the authority. It should be understood by those skilled in the art that, compared with the List type, the Collection type can solve the problems of data duplication and large memory space overhead, thereby improving the efficiency of obtaining authority and space utilization. In addition, considering that the data in the preset storage container is common data, it will not change with different objects. Therefore, in order to ensure the consistency of the data and to be directly accessed through the class, the data in the preset storage container is set to a static type, thereby improving the convenience of data acquisition.
[0075] Based on the above analysis, the preset storage container can be set as:
[0076] private static Map <String,Collection <dyrole>>resourceMap=null
[0077] It should be noted that when obtaining permissions, the processing method of directly accessing the database to load data requires multiple interactions with the database when accessing the database, resulting in low data access efficiency. Therefore, in order to improve the efficiency of obtaining permissions, all data can be loaded into the preset storage container only when the system is started, and no secondary loading is performed after the loading is completed. Therefore, when obtaining permissions later, it is only necessary to access the preset storage container stored in the memory, and no interaction with the database is required, and the efficiency of obtaining permissions can be significantly improved. In particular, before implementing data loading, it is optional to first determine whether the preset storage container (resourceMap) is empty (null). If it is null, it means that the data has not been loaded yet, and data loading processing can be performed at this time; if it is not null, it means that the data loading has been completed, and no data loading processing is required at this time.
[0078] To facilitate the reuse of subsequent data loading logic, the data loading logic can be implemented based on a preset loading function. For example, the preset loading function is Private void loadResource(){}, its return value is void type, the function name is loadResource, and the specific implementation logic is as follows:
[0079] First, instantiate resourceMap. Considering that resourceMap stores Static data, if it is instantiated based on HashMap, thread safety issues may occur. Once multi-threaded access occurs, data may be confused. To solve this problem, you can choose a thread-safe class to instantiate resourceMap, such as resourceMap = new ConcurrentHashMap<>(). Considering that an object may have multiple roles, a role may have multiple permissions, and each permission is associated with a URL. Therefore, the data loading logic is to store the URL and all roles associated with the URL in the resourceMap as key-value pairs.
[0080] Specifically, you can first get all roles from the role table stored in the database by calling the UserService.findAllRole() function. The role is the DYRole described above and is marked as List <dyrole>dyRoleList. Next, determine whether dyRoleList is empty. One way to determine is to use dyRoleList==null||dyRoleList.size()==0, which is a two-step method with relatively low efficiency. Another way to determine is to call the dyRoleList.isEmpty() function. If true is returned, indicating that it is empty, an exception throwException("No role obtained") is directly thrown to terminate the process. If false is returned, indicating that it is not empty, the subsequent process is executed.
[0081] To traverse the dyRoleList, one traversal method is based on the for loop. However, the for loop has the time overhead of reading internal data and is relatively inefficient. Another traversal method is based on forEach, which can improve the traversal efficiency, such as dyRoleList.stream().forEach(item->{}). Before executing forEach, you can first convert the role into stream data through the preset conversion function stream(), because only stream data can execute the forEach function; lambda expressions can be used inside the forEach function. For example, if the input parameter is item, item is a DYRole object, and the function body content follows -> to obtain the URL of all permissions of the DYRole object. Specifically, first get the code in the DYRole object by calling item.code, and then get the List of all permissions corresponding to the code by calling the getAuthorityByDyRoleCode(String code) function. <authority>authorityList, where the Authority class is an authority class, which mainly describes the authority information and URL of a certain authority, as shown below:
[0082]
[0083]
[0084] Next, authorityList is traversed. The specific operation process is similar to dyRoleList. First, the authority is converted into stream data through the preset conversion function stream() function, and the lambda expression is used inside the forEach function. For example, if the input parameter is item2, item2 is data of the Authority type, which is a certain permission under a certain role (item). Next, the url can be obtained by calling the item2.url() function, thereby obtaining the url of itme2 under the item.
[0085] The various data obtained above can be stored in memory first, and then stored in resourceMap in sequence. Specifically, you can first determine whether the value information corresponding to the url has been stored in resourceMap based on the resourceMap.contains(url) function. If resourceMap.contains(url) returns false, it means that the corresponding value information is not stored in resourceMap. At this time, you can perform a secondary collection type Collection in resourceMap. <dyrole>Perform instantiation operations, such as Collection <dyrole>atts=new ArrayList <dyrole>(), thus we can get a secondary collection object atts, and then call atts.add(itme) to store the role under url into atts, and then call resourceMap.put(url,atts) to fill atts back into resourceMap to fill data. Correspondingly, if resourceMap.contains(url) returns true, it means that the corresponding value information has been stored in resourceMap, and then we can call Collection <dyrole>value=resourceMap.get(url) function to get the stored data set and mark it as value, where value is the data set where the stored value information is located, and then add the new role to value by calling value.add(item) function, and then fill value back into resourceMap by calling resourceMap.put(url,value) function. When the above cycle process is completed, all urls and the roles associated with each url are stored in resourceMap.
[0086] Thus, when a trigger event for obtaining permissions is detected, the URL of the permission to be obtained and the object role of the permission obtaining object corresponding to the trigger event can be obtained first; then, by calling Collection <dyrole>resultRoleList = resourceMap.get(url) obtains the permission role associated with the permission to be obtained from the preset storage container, and stores the permission role in the resultRoleList object; then traverses the resultRoleList to determine whether the resultRoleList contains the object role. If so, it means that the permission acquisition object can obtain the permission to be obtained, otherwise, it means that the permission acquisition object cannot obtain the permission to be obtained.
[0087] Embodiment 2
[0088] Figure 2 This is a structural block diagram of a permission acquisition device provided in Embodiment 2 of the present invention. The device is used to execute the permission acquisition method provided in any of the above embodiments. The device and the permission acquisition method of the above embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the permission acquisition device, please refer to the embodiment of the above permission acquisition method. Figure 2 The device may specifically include: a permission obtaining module 210, a path information storage module 220, a role storage module 230, an object role obtaining module 240, a permission role obtaining module 250 and a permission obtaining module 260.
[0089] The permission obtaining module 210 is used to obtain the permission associated with each role according to the role code of each role that has been obtained;
[0090] A path information storage module 220, used to extract path information from the authority and store the path information in a preset storage container, wherein the path information is key information;
[0091] A role storage module 230, used to store the role associated with the path information into a preset storage container, wherein the role associated with the path information is value information;
[0092] The object role acquisition module 240 is used to acquire the permission to be acquired corresponding to the triggering event and the object role of the permission acquisition object when a triggering event for acquiring the permission is detected;
[0093] The permission role acquisition module 250 is used to acquire the permission role associated with the permission to be acquired from a preset storage container, wherein the permission role is a role having the permission to be acquired;
[0094] The permission acquisition module 260 is used to determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained according to the determination result.
[0095] Optionally, the role storage module 230 may specifically include:
[0096] A role screening unit, for screening a current role from the roles associated with the path information when the number of roles associated with the path information is at least two;
[0097] A determination unit, used to determine whether a role associated with the path information is stored in a preset storage container;
[0098] A first backfilling unit, for, if not, storing the current role in a preset secondary collection object, and backfilling the secondary collection object into a preset storage container;
[0099] The second backfilling unit is used to otherwise obtain the data set containing the role associated with the path information stored in the preset storage container, store the current role in the data set, and backfill the data set of the added role into the preset storage container.
[0100] Optionally, the role storage module 230 may specifically include:
[0101] The role storage unit is used to generate a storage function based on a preset annotation, and store the role associated with the path information into a preset storage container based on the storage function.
[0102] Optionally, the path information storage module 220 may specifically include:
[0103] The permission conversion unit is used for converting the permission including permission information and path information into stream data based on a preset conversion function;
[0104] The path information extraction unit is used to traverse the stream data with the lambda expression as an input parameter, and extract the path information from each permission according to the traversal result.
[0105] Optionally, the permission obtaining module 210 may specifically include:
[0106] A role storage unit, used to obtain each role from the database and store each role in the memory, wherein the role includes a role code, a role name and / or a role description information;
[0107] The first permission obtaining unit is used to obtain the permissions associated with the role codes from the database according to each role code.
[0108] Optionally, the permission obtaining module 210 may specifically include:
[0109] The second permission obtaining unit is used to determine whether the preset storage container is empty, and if so, obtain the permission associated with each role according to the obtained role code of each role.
[0110] Optionally, the preset storage container includes a key-value pair of Static type, the key information in the key-value pair includes data of String type, and / or the value information includes data of Collection type.
[0111] The permission acquisition device provided in the second embodiment of the present invention, through the cooperation of the permission acquisition module, the path information storage module and the role storage module, obtains the permission associated with each role according to the role codes of the roles that have been obtained, and stores the path information of the permission and all the roles associated with it in a preset storage container in a key-value pair manner; in this way, when the object role acquisition module detects a triggering event for obtaining permission, it can obtain the permission to be obtained corresponding to the triggering event and the object role of the permission acquisition object; the permission role acquisition module and the permission acquisition module cooperate with each other to obtain the permission role associated with the permission to be obtained from the preset storage container, and determine whether the permission acquisition object can obtain the permission to be obtained according to whether the permission role includes the object role. The above device can effectively reduce the interaction logic with the database when obtaining permission, and can directly obtain the permission from the preset storage container set in the memory, which solves the problem of low efficiency of permission acquisition, and can greatly improve the efficiency of permission acquisition while ensuring the accuracy of permission acquisition.
[0112] The permission acquisition device provided in the embodiment of the present invention can execute the permission acquisition method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0113] It is worth noting that in the embodiment of the above-mentioned permission acquisition device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.
[0114] Embodiment 3
[0115] Figure 3 A schematic diagram of a device structure provided in Embodiment 3 of the present invention is shown in FIG. Figure 3 As shown, the device includes a memory 310, a processor 320, an input device 330, and an output device 340. The number of processors 320 in the device can be one or more. Figure 3 A processor 320 is used as an example; the memory 310, the processor 320, the input device 330 and the output device 340 in the device can be connected via a bus or other means. Figure 3 The connection via bus 350 is taken as an example.
[0116] The memory 310, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the permission acquisition method in the embodiment of the present invention (for example, the permission acquisition module 210, the path information storage module 220, the role storage module 230, the object role acquisition module 240, the permission role acquisition module 250 and the permission acquisition module 260 in the permission acquisition device). The processor 320 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 310, that is, implements the above-mentioned permission acquisition method.
[0117] The memory 310 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the device, etc. In addition, the memory 310 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 310 may further include a memory remotely arranged relative to the processor 320, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0118] The input device 330 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 340 may include a display device such as a display screen.
[0119] Embodiment 4
[0120] Embodiment 4 of the present invention provides a storage medium including computer executable instructions, wherein the computer executable instructions are used to execute a permission acquisition method when executed by a computer processor, the method comprising:
[0121] When a triggering event for obtaining permission is detected, obtaining the permission to be obtained corresponding to the triggering event and the object role of the permission obtaining object;
[0122] Acquire a permission role associated with the permission to be obtained from a preset storage container, wherein the permission role is a role having the permission to be obtained;
[0123] Determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained based on the judgment result;
[0124] The preset storage container implements the data storage function through the following steps:
[0125] According to the obtained role codes of each role, the permissions associated with each role are obtained respectively;
[0126] Extracting path information from the authority and storing the path information in a preset storage container, wherein the path information is key information;
[0127] The role associated with the path information is stored in a preset storage container, wherein the role associated with the path information is value information.
[0128] Of course, the computer executable instructions of a storage medium including computer executable instructions provided by an embodiment of the present invention are not limited to the operations of the method described above, and can also execute related operations in the permission acquisition method provided by any embodiment of the present invention.
[0129] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.
[0130] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.< / dyrole> < / dyrole> < / dyrole> < / dyrole> < / dyrole> < / authority> < / dyrole> < / dyrole> < / authority>
Claims
1. A method for obtaining permissions, It is characterized in that include: When a triggering event for obtaining permission is detected, obtaining the permission to be obtained corresponding to the triggering event and the object role of the permission obtaining object; Acquire a permission role associated with the permission to be acquired from a preset storage container, wherein the permission role is a role having the permission to be acquired; Determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained according to the determination result; The preset storage container implements the data storage function through the following steps: According to the role codes of the roles obtained, the permissions associated with each role are obtained respectively; Extracting path information from the authority and storing the path information in the preset storage container, wherein the path information is key information; storing the role associated with the path information in the preset storage container, wherein the role associated with the path information is value information; The preset storage container is set in the memory; The preset storage container includes a key-value pair of Static type, the key information in the key-value pair includes data of String type, and / or the value information includes data of Collection type.
2. The method according to claim 1, It is characterized in that The number of the roles associated with the path information is at least two, and storing the roles associated with the path information in the preset storage container includes: Filter out the current role from the roles associated with the path information; Determining whether the role associated with the path information is stored in the preset storage container; If not, the current role is stored in a preset secondary collection object, and the secondary collection object is backfilled into the preset storage container; Otherwise, obtain the data set containing the role associated with the path information and stored in the preset storage container, store the current role in the data set, and fill the data set of the added role back into the preset storage container.
3. The method according to claim 1, It is characterized in that The step of storing the role associated with the path information in the preset storage container includes: A storage function is generated based on a preset annotation, and the role associated with the path information is stored in the preset storage container based on the storage function.
4. The method according to claim 1, It is characterized in that The authority includes the authority information and the path information, and extracting the path information from the authority includes: Converting the permission into stream data based on a preset conversion function; The lambda expression is used as an input parameter to traverse the stream data, and path information is extracted from each of the permissions according to the traversal result.
5. The method according to claim 1, It is characterized in that The step of obtaining the permissions associated with each role according to the obtained role codes of the roles includes: Obtaining each role from a database and storing each role in a memory, wherein the role includes a role code, a role name and / or a role description information; According to each of the role codes, permissions associated with the role codes are obtained from the database.
6. The method according to claim 1, It is characterized in that The step of obtaining the permissions associated with each role according to the obtained role codes of the roles includes: It is determined whether the preset storage container is empty. If so, the permissions associated with each role are obtained according to the obtained role codes of the roles.
7. A permission acquisition device, It is characterized in that include: An object role acquisition module, used to acquire the permission to be acquired corresponding to the triggering event and the object role of the permission acquisition object when a triggering event for acquiring the permission is detected; A permission role acquisition module, used to acquire the permission role associated with the permission to be acquired from a preset storage container, wherein the permission role is a role having the permission to be acquired; A permission acquisition module, used to determine whether the permission role includes the object role, and determine whether the permission acquisition object obtains the permission to be obtained according to the judgment result; The preset storage container implements the data storage function through the following modules: The permission obtaining module is used to obtain the permission associated with each role according to the role code of each role that has been obtained; A path information storage module, used to extract path information from the authority and store the path information in the preset storage container, wherein the path information is key information; a role storage module, used to store the role associated with the path information into the preset storage container, wherein the role associated with the path information is value information; The preset storage container is set in the memory; The preset storage container includes a key-value pair of Static type, the key information in the key-value pair includes data of String type, and / or the value information includes data of Collection type.
8. A device, It is characterized in that include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the permission acquisition method as described in any one of claims 1-6.
9. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the method for obtaining permissions as described in any one of claims 1 to 6 is implemented.