Database column-level data access control method and device

Abstract

The present invention discloses a database column-level data access control method and device, which can be applied to the field of automatic programming technology. The method includes: after receiving a database access request from a current user, obtaining a query result annotation method parameter in the database access request; obtaining a corresponding query result annotation method class based on the query result annotation method parameter; obtaining all annotation fields in the query result annotation method class; parsing all annotation fields to obtain multiple field sets, wherein each field set includes annotation fields corresponding to all user roles with the same user permissions; obtaining a field set that the current user is allowed to access from the multiple field sets based on the user role of the current user; splicing the field sets that are allowed to access into a query result field set; and executing a query based on the query result field set to obtain a query result. The present invention can achieve database column-level data access control with high efficiency and reusability.

Description

Technical Field

[0001] The present invention relates to the technical field of automatic programming, and in particular to a database column-level data access control method and device. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. No statement herein is admitted to be prior art by virtue of its inclusion in this section.

[0003] When developing query interfaces on the backend, to prevent data leakage caused by the currently logged-in user accessing data outside of their authorized scope (for example, only allowing ordinary employees to query basic information such as company employee names and phone numbers, while allowing HR to query company employee ranks and salary information), hard-coded filtering of non-authorized data based on the currently logged-in user's role and other information is required. This code generation technique results in code redundancy and reduced readability. A reusable, concise, and highly readable solution is needed to address this issue. Furthermore, this type of judgment is mechanical, repetitive, and prone to errors, primarily manifested in the following:

[0004] (1) Configuration can only be performed when the code is generated. Subsequent adjustment of column-level query permissions requires secondary development based on the generated code.

[0005] (2) The judgment logic for column-level query permissions is still implemented through hard coding, which results in redundant code and poor readability.

[0006] (3) When column-level query permissions change, the front-end also needs to make synchronous code adjustments.

[0007] Therefore, there is a need for a highly efficient and reusable database column-level data access control method. Summary of the Invention

[0008] An embodiment of the present invention provides a database column-level data access control method for implementing database column-level data access control with high efficiency and reusability. The method includes:

[0009] After receiving the database access request from the current user, obtaining the query result annotation method parameter in the database access request;

[0010] Based on the query result annotation method parameters, obtain the corresponding query result annotation method class, where the query result annotation method class is the query result class with the interface annotation added;

[0011] Obtain all annotated fields in the query result annotation method class, where the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions;

[0012] Parse all annotation fields to obtain multiple field sets, where each field set includes all annotation fields corresponding to user roles with the same user permissions;

[0013] According to the user role of the current user, obtain the field set that the current user is allowed to access from multiple field sets;

[0014] Splice the set of fields that are allowed to be accessed into the query result field set;

[0015] Execute the query based on the query result field set to obtain the query results.

[0016] An embodiment of the present invention provides a database column-level data access control device for implementing database column-level data access control with high efficiency and reusability. The device includes:

[0017] A request parsing module is used to obtain the query result annotation method parameters in the database access request after receiving the database access request from the current user;

[0018] A query result annotation method class retrieval module is used to obtain a corresponding query result annotation method class based on the query result annotation method parameters, wherein the query result annotation method class is a query result class with an interface annotation added;

[0019] Annotation field retrieval module, used to obtain all annotated fields in the query result annotation method class, the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions;

[0020] Annotation field parsing module, used to parse all annotation fields and obtain multiple field sets, where each field set includes the annotation fields corresponding to all user roles with the same user permissions;

[0021] The current user field set acquisition module is used to obtain the field set that the current user is allowed to access from multiple field sets based on the user role of the current user;

[0022] The field set splicing module is used to splice the accessible field set into the query result field set;

[0023] The query execution module is used to execute the query based on the query result field set to obtain the query result.

[0024] An embodiment of the present invention further provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned database column-level data access control method when executing the computer program.

[0025] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned database column-level data access control method.

[0026] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned database column-level data access control method.

[0027] In an embodiment of the present invention, after receiving a database access request from the current user, a query result annotation method parameter in the database access request is obtained; based on the query result annotation method parameter, a corresponding query result annotation method class is obtained, wherein the query result annotation method class is a query result class with an interface annotation; all annotated fields in the query result annotation method class are obtained, wherein the annotated fields are fields with field annotations, and the field annotations include user roles and user permissions; all annotated fields are parsed to obtain multiple field sets, wherein each field set includes annotated fields corresponding to all user roles with the same user permissions; based on the current user's user role, a set of fields that the current user is allowed to access is obtained from the multiple field sets; the set of fields that are allowed to access are concatenated into a query result field set; and a query is executed based on the query result field set to obtain a query result. Compared to existing technical solutions that filter non-authorized data based on information such as the current logged-in user's role through hard-coded filtering, this method, through pre-set interface annotations and field annotations, achieves database column-level data access control with zero code, is highly efficient, and annotations are reusable. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0029] Figure 1 The process of the database column-level data access control method in the embodiment of the present invention is as follows Figure 1 ;

[0030] Figure 2 The process of the database column-level data access control method in the embodiment of the present invention is as follows Figure 2 ;

[0031] Figure 3 The process of the database column-level data access control method in the embodiment of the present invention is as follows Figure 3 ;

[0032] Figure 4 The process of annotating field parsing in the embodiment of the present invention Figure 1 ;

[0033] Figure 5 The process of annotating field parsing in the embodiment of the present invention Figure 2 ;

[0034] Figure 6 This is a flowchart of obtaining a set of fields that the current user is allowed to access in an embodiment of the present invention;

[0035] Figure 7 Schematic diagram of a database column-level data access control device according to an embodiment of the present invention Figure 1 ;

[0036] Figure 8 Schematic diagram of a database column-level data access control device according to an embodiment of the present invention Figure 2 ;

[0037] Figure 9 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0039] First, the terms involved in the embodiments of the present invention are explained.

[0040] Login role: After the user logs in to the system, the role that the user has configured in the system;

[0041] Column-level data access control: Provides query permission control for each column of data in the data table. Only those with query permission for the column of data are allowed to query the data in that column.

[0042] Figure 1 The process of the database column-level data access control method in the embodiment of the present invention is as follows Figure 1 ,include:

[0043] Step 101: After receiving a database access request from the current user, obtain the query result annotation method parameters in the database access request;

[0044] Step 102: Based on the query result annotation method parameters, obtain the corresponding query result annotation method class, where the query result annotation method class is the query result class with the interface annotation added;

[0045] Step 103: Obtain all annotated fields in the query result annotation method class, where the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions.

[0046] Step 104: Parse all annotation fields to obtain multiple field sets, where each field set includes annotation fields corresponding to all user roles with the same user permissions.

[0047] Step 105: Obtain the field set that the current user is allowed to access from multiple field sets based on the user role of the current user;

[0048] Step 106: assemble the set of fields that are allowed to be accessed into a query result field set;

[0049] Step 107: Execute a query based on the query result field set to obtain a query result.

[0050] In an embodiment of the present invention, compared with the technical solution in the prior art that filters non-authorized data based on information such as the role of the current logged-in person through hard-coding, database column-level data access control is implemented with zero code through pre-set interface annotations and field annotations, which is highly efficient and the annotations are reusable.

[0051] In step 101, after receiving a database access request from the current user, query result annotation method parameters in the database access request are obtained.

[0052] Figure 2 The process of the database column-level data access control method in the embodiment of the present invention is as follows Figure 2 In one embodiment, the method further comprises:

[0053] Step 201: Set interface annotations for query result classes in different query scenarios.

[0054] Step 202: Set a field annotation for each field in the query result class.

[0055] In the above embodiment, after the query result class code development has been completed, the query result class needs to be applied to different query scenarios. In order to avoid redeveloping the query result class in the traditional way, the embodiment of the present invention proposes to adopt the method of setting interface annotations in the query result class, such as @ResultColumnsMethod. The scope of the interface annotation is the class, and the fields of the interface annotation include: methodName (field type is String). MethodName is the query result annotation method parameter, which is used for interfaces in different query scenarios.

[0056] The code example is as follows:

[0057] @Target({ElementType.FIELD})

[0058] public@interface ResultColumns{

[0059] String methodName();

[0060] }

[0061] Field annotations are defined as annotations that specify whether a field in a query result class is accessible to a specific role, such as @QueryColumn. The scope of the annotation is the field. If the annotation is not configured on a field, all roles are granted access to the field by default. Field annotations include:

[0062] 1) authRole (field type is String), used to identify the user role;

[0063] 2) authType (String): This field identifies user permissions and determines whether the user role corresponding to authRole allows or denies queries. The authType field has two values, representing access permission and access denial, such as "allow" and "refuse."

[0064] The code example is as follows:

[0065] @Target({ElementType.FIELD})

[0066] public@interface QueryColumn{

[0067] String authRole();

[0068] String authType();

[0069] }

[0070] In step 202, a field annotation is set for each field in the query result class, such as @QueryColumn(authRole="hr,boss", authType="allow"), which indicates that only boss and hr are allowed to access the field, and other users are denied access to the field.

[0071] In step 101, the query result annotation method parameter methodName in the database access request is obtained, and then in step 102, the corresponding query result annotation method class is obtained based on the query result annotation method parameter.

[0072] Figure 3 The process of the database column-level data access control method in the embodiment of the present invention is as follows Figure 3 In one embodiment, before obtaining all the annotation fields in the query result annotation method class, the method further includes:

[0073] Step 301, determine whether the query result annotation method class exists; if not, go to step 302, if not, go to step 103;

[0074] Step 302, generating reminder information;

[0075] Step 103: Obtain all annotation fields in the query result annotation method class.

[0076] In the above embodiment, the above judgment is performed mainly for exception handling and improving the robustness of the method of the present invention.

[0077] In step 104, all annotation fields are parsed to obtain multiple field sets.

[0078] In one embodiment, the field set includes a first field set and a second field set;

[0079] Figure 4 The process of annotating field parsing in the embodiment of the present invention Figure 1 , parse all annotation fields and obtain multiple field sets, including:

[0080] Step 401: For each annotation field, obtain a first user role set and a second user role set corresponding to the annotation field, wherein the first user role set includes user roles whose user rights in the annotation field are set to allow access, and the second user role set includes user roles whose user rights in the annotation field are set to deny access.

[0081] Among them, the first user role set is the Map corresponding to allow <column,Set <role>> is a whitelist that identifies the user roles allowed to access each annotation field; the second user role set is the Map corresponding to refuse <column,Set <role>>, is a blacklist, identifying the user roles that are denied access in each annotation field.

[0082] Step 402: Merge all first user role sets to obtain a third user role set;

[0083] Step 403: Merge all second user role sets to obtain a fourth user role set;

[0084] Step 402 and step 403 are equivalent to traversing all annotation fields and executing step 402 in a loop.

[0085] Step 404: sort the third user role set to obtain a first field set, where the first field set includes annotation fields corresponding to all user roles in the third user role set whose user authority is "allow access";

[0086] Among them, the first field set is Map <role,Set <column>>, that is, get the corresponding Set in the allow collection according to column <role>, if the user role is in Set <role>In the annotation field, add it to the Map <role,Set <column>> in.

[0087] Step 405 : sort the fourth user role set to obtain a second field set, where the second field set includes annotation fields corresponding to all user roles in the fourth user role set whose user authority is not deny access.

[0088] Among them, the second field set is Map <role,Set <column>>, that is, get the corresponding Set in the reject set according to column <role>If the user role is not in Set <role>In the annotation field, add it to the Map <role,Set <column>> in.

[0089] Figure 5 The process of annotating field parsing in the embodiment of the present invention Figure 2 , in one embodiment, the field set includes a third field set;

[0090] Before obtaining the field collection that the current user is allowed to access from multiple field collections based on the current user's user role, it also includes:

[0091] Step 501: Obtain non-annotated fields in the query result annotation method class, where the non-annotated fields are fields that are not annotated.

[0092] Step 502: Add all non-annotated fields to a third field set, where the third field set includes all fields for which no user permission is set.

[0093] That is, for fields that do not have QueryColumn added, add them to the Map separately <role,Set <column>>The Set corresponding to the independent user role role all <column>, identifies the set of fields to which all user roles have access.

[0094] In step 105 , based on the user role of the current user, a field set that the current user is allowed to access is obtained from multiple field sets.

[0095] Among them, the current user can have multiple user roles. Figure 6 This is a flowchart of obtaining a set of fields that the current user is allowed to access in an embodiment of the present invention. In one embodiment, obtaining a set of fields that the current user is allowed to access from multiple field sets based on the user role of the current user includes:

[0096] Step 601: Obtain all fields that the user role of the current user allows to access from multiple field sets according to the user role of the current user;

[0097] Step 602: De-duplicate all fields and add them to the set of fields that are allowed to be accessed.

[0098] In step 106, the set of fields that are allowed to be accessed is spliced ​​into the query result field set. Specifically, the underlying BaseService of the development framework first obtains the set of fields that are allowed to be accessed based on the user role of the current user, and then deduplicates all fields and adds them to the set of fields that are allowed to be accessed to ensure that the query results are within the permission range of the current user.

[0099] In step 107, a query is executed based on the query result field set to obtain a query result.

[0100] In summary, the method proposed in an embodiment of the present invention obtains a query result annotation method parameter in the database access request after receiving a database access request from the current user. Based on the query result annotation method parameter, a corresponding query result annotation method class is obtained, wherein the query result annotation method class is a query result class with an interface annotation. All annotated fields in the query result annotation method class are obtained, wherein the annotated fields are fields with field annotations, and the field annotations include user roles and user permissions. All annotated fields are parsed to obtain multiple field sets, wherein each field set includes annotated fields corresponding to all user roles with the same user permissions. Based on the current user's user role, a set of fields permitted to be accessed by the current user is obtained from the multiple field sets. The permitted field sets are concatenated into a query result field set. A query is executed based on the query result field set to obtain a query result. Compared to existing technical solutions that filter non-authorized data based on information such as the current logged-in user's role through hard-coded filtering, this method, through pre-set interface annotations and field annotations, achieves database column-level data access control with zero code, resulting in high efficiency and reusable annotations.

[0101] The present invention also provides a database column-level data access control device, as described in the following embodiments. Since the principles of this device are similar to those of the database column-level data access control method, the implementation of this device can refer to the implementation of the database column-level data access control method, and the repeated parts will not be repeated here.

[0102] Figure 7 Schematic diagram of a database column-level data access control device according to an embodiment of the present invention Figure 1 ,include:

[0103] The request parsing module 701 is used to obtain the query result annotation method parameters in the database access request after receiving the database access request from the current user;

[0104] A query result annotation method class retrieval module 702 is used to obtain a corresponding query result annotation method class based on the query result annotation method parameters, where the query result annotation method class is a query result class with an interface annotation added;

[0105] Annotation field retrieval module 703, used to obtain all annotated fields in the query result annotation method class, wherein the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions;

[0106] Annotation field parsing module 704 is used to parse all annotation fields to obtain multiple field sets, where each field set includes annotation fields corresponding to all user roles with the same user permissions;

[0107] The current user field set obtaining module 705 is used to obtain the field set that the current user is allowed to access from multiple field sets according to the user role of the current user;

[0108] The field set splicing module 706 is used to splice the set of fields that are allowed to be accessed into a query result field set;

[0109] The query execution module 707 is used to execute a query based on the query result field set to obtain a query result.

[0110] In one embodiment, the field set includes a first field set and a second field set;

[0111] The annotation field parsing module is specifically used for:

[0112] For each annotation field, obtain a first user role set and a second user role set corresponding to the annotation field, wherein the first user role set includes user roles whose user authority in the annotation field is to allow access, and the second user role set includes user roles whose user authority in the annotation field is to deny access;

[0113] Merge all first user role sets to obtain a third user role set;

[0114] Merge all second user role sets to obtain a fourth user role set;

[0115] The third user role set is sorted to obtain a first field set, where the first field set includes annotation fields corresponding to all user roles in the third user role set whose user authority is to allow access;

[0116] The fourth user role set is sorted to obtain a second field set, where the second field set includes annotation fields corresponding to all user roles in the fourth user role set whose user authority is not deny access.

[0117] In one embodiment, the field set includes a third field set;

[0118] The annotation field parsing module is also used for:

[0119] Obtaining non-annotated fields in the query result annotation method class, wherein the non-annotated fields are fields to which no annotations are added;

[0120] All non-annotated fields are added to a third field set, which includes all fields for which no user permissions are set.

[0121] In one embodiment, the current user field set obtaining module is specifically configured to:

[0122] According to the user role of the current user, obtain all fields that the user role of the current user allows to access from multiple field sets;

[0123] All fields are deduplicated and added to the set of fields that are allowed to be accessed.

[0124] In one embodiment, the query result annotation method class retrieval module is further used to:

[0125] Before obtaining all annotation fields in the query result annotation method class, determining whether the query result annotation method class exists;

[0126] If not, generate a reminder message;

[0127] If so, obtain all annotation fields in the query result annotation method class.

[0128] Figure 8 Schematic diagram of a database column-level data access control device according to an embodiment of the present invention Figure 2 In one embodiment, the apparatus further includes an annotation setting module 801, configured to:

[0129] In different query scenarios, set interface annotations for query result classes;

[0130] Set field annotations for each field in the query result class.

[0131] In summary, in the apparatus proposed in an embodiment of the present invention, after receiving a database access request from the current user, the apparatus obtains a query result annotation method parameter in the database access request; based on the query result annotation method parameter, obtains a corresponding query result annotation method class, wherein the query result annotation method class is a query result class with an interface annotation; obtains all annotated fields in the query result annotation method class, wherein the annotated fields are fields with field annotations, and the field annotations include user roles and user permissions; parses all annotated fields to obtain multiple field sets, wherein each field set includes annotated fields corresponding to all user roles with the same user permissions; obtains a set of fields that the current user is allowed to access from the multiple field sets based on the current user's user role; concatenates the set of fields that are allowed to access into a query result field set; and executes a query based on the query result field set to obtain a query result. Compared to prior art solutions that filter non-authorized data based on information such as the current logged-in user's role through hard-coded filtering, this method, through pre-set interface annotations and field annotations, achieves database column-level data access control with zero code, is highly efficient, and annotations are reusable.

[0132] An embodiment of the present invention further provides a computer device, Figure 9 This is a schematic diagram of a computer device in an embodiment of the present invention. The computer device 900 includes a memory 910, a processor 920, and a computer program 930 stored in the memory 910 and executable on the processor 920. When the processor 920 executes the computer program 930, the above-mentioned database column-level data access control method is implemented.

[0133] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned database column-level data access control method.

[0134] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned database column-level data access control method.

[0135] In summary, in the computer device, computer-readable storage medium, and computer program product proposed in the embodiments of the present invention, after receiving the current user's request to access the database, the query result annotation method parameters in the database access request are obtained; based on the query result annotation method parameters, the corresponding query result annotation method class is obtained, and the query result annotation method class is a query result class with added interface annotations; all annotated fields in the query result annotation method class are obtained, and the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions; all annotated fields are parsed to obtain multiple field sets, wherein each field set includes annotated fields corresponding to all user roles with the same user permissions; according to the user role of the current user, the field set allowed to be accessed by the current user is obtained from the multiple field sets; the field set allowed to be accessed is spliced ​​into a query result field set; and a query is executed based on the query result field set to obtain a query result. Compared with the existing technical solutions that filter non-authorized data based on information such as the role of the current logged-in person through hard-coding, database column-level data access control is achieved with zero code through pre-set interface annotations and field annotations, which is highly efficient and the annotations are reusable.

[0136] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0137] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0138] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0139] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0140] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.< / column> < / column> < / column> < / role> < / role> < / column> < / column> < / role> < / role> < / column> < / role> < / role>

Claims

1. A database column-level data access control method, characterized in that: include: After receiving the database access request from the current user, obtaining the query result annotation method parameter in the database access request; Based on the query result annotation method parameters, obtain the corresponding query result annotation method class, where the query result annotation method class is the query result class with the interface annotation added; Obtain all annotated fields in the query result annotation method class, where the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions; Parse all annotation fields to obtain multiple field sets, where each field set includes all annotation fields corresponding to user roles with the same user permissions; According to the user role of the current user, obtain the field set that the current user is allowed to access from multiple field sets; Splice the set of fields that are allowed to be accessed into the query result field set; Execute the query based on the query result field set to obtain the query results; Also includes: In different query scenarios, set interface annotations for query result classes; Set field annotations for each field in the query result class.

2. The method according to claim 1, wherein The field set includes a first field set and a second field set; Parse all annotation fields and obtain multiple field sets, including: For each annotation field, obtain a first user role set and a second user role set corresponding to the annotation field, wherein the first user role set includes user roles whose user authority in the annotation field is to allow access, and the second user role set includes user roles whose user authority in the annotation field is to deny access; Merge all first user role sets to obtain a third user role set; Merge all second user role sets to obtain a fourth user role set; The third user role set is sorted to obtain a first field set, where the first field set includes annotation fields corresponding to all user roles in the third user role set whose user authority is to allow access; The fourth user role set is sorted to obtain a second field set, where the second field set includes annotation fields corresponding to all user roles in the fourth user role set whose user authority is not deny access.

3. The method according to claim 2, wherein The field set includes a third field set; Before obtaining the field collection that the current user is allowed to access from multiple field collections based on the current user's user role, it also includes: Obtaining non-annotated fields in the query result annotation method class, wherein the non-annotated fields are fields to which no annotations are added; All non-annotated fields are added to a third field set, which includes all fields for which no user permissions are set.

4. The method according to claim 3, wherein Based on the current user's user role, obtain the field sets that the current user is allowed to access from multiple field sets, including: According to the user role of the current user, obtain all fields that the user role of the current user allows to access from multiple field sets; All fields are deduplicated and added to the set of fields that are allowed to be accessed.

5. The method according to claim 1, wherein Before obtaining all the annotated fields in the query result annotation method class, it also includes: Determine whether the query result annotation method class exists; If not, generate a reminder message; If so, obtain all annotation fields in the query result annotation method class.

6. A database column-level data access control device, characterized in that: include: A request parsing module is used to obtain the query result annotation method parameters in the database access request after receiving the database access request from the current user; A query result annotation method class retrieval module is used to obtain a corresponding query result annotation method class based on the query result annotation method parameters, wherein the query result annotation method class is a query result class with an interface annotation added; Annotation field retrieval module, used to obtain all annotated fields in the query result annotation method class, the annotated fields are fields with added field annotations, and the field annotations include user roles and user permissions; Annotation field parsing module, used to parse all annotation fields and obtain multiple field sets, where each field set includes the annotation fields corresponding to all user roles with the same user permissions; The current user field set acquisition module is used to obtain the field set that the current user is allowed to access from multiple field sets based on the user role of the current user; The field set splicing module is used to splice the accessible field set into the query result field set; A query execution module is used to execute a query based on the query result field set to obtain the query result; Also includes annotation settings module for: In different query scenarios, set interface annotations for query result classes; Set field annotations for each field in the query result class.

7. The device according to claim 6, characterized in that The field set includes a first field set and a second field set; The annotation field parsing module is specifically used for: For each annotation field, obtain a first user role set and a second user role set corresponding to the annotation field, wherein the first user role set includes user roles whose user authority in the annotation field is to allow access, and the second user role set includes user roles whose user authority in the annotation field is to deny access; Merge all first user role sets to obtain a third user role set; Merge all second user role sets to obtain a fourth user role set; The third user role set is sorted to obtain a first field set, where the first field set includes annotation fields corresponding to all user roles in the third user role set whose user authority is to allow access; The fourth user role set is sorted to obtain a second field set, where the second field set includes annotation fields corresponding to all user roles in the fourth user role set whose user authority is not deny access.

8. The device according to claim 7, wherein The field set includes a third field set; The annotation field parsing module is also used for: Obtaining non-annotated fields in the query result annotation method class, wherein the non-annotated fields are fields to which no annotations are added; All non-annotated fields are added to a third field set, which includes all fields for which no user permissions are set.

9. The device according to claim 8, wherein The current user field collection acquisition module is specifically used for: According to the user role of the current user, obtain all fields that the user role of the current user allows to access from multiple field sets; All fields are deduplicated and added to the set of fields that are allowed to be accessed.

10. The device according to claim 6, wherein The query result annotation method class retrieval module is also used to: Before obtaining all annotation fields in the query result annotation method class, determining whether the query result annotation method class exists; If not, generate a reminder message; If so, obtain all annotation fields in the query result annotation method class.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

13. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images