A menu system with permission control

Abstract

The present invention discloses a menu system with permission control, which relates to the technical field of menu systems and includes an identity authentication subdomain and a menu subdomain; the identity authentication subdomain uses an IAM system for identity recognition and access management; the menu subdomain depends on the identity authentication subdomain and splits the entire menu into a combination of independent function nodes, including function nodes, meta nodes, and meta menus, wherein: the function node is responsible for describing function node information and executing actions related to the function node; the meta node is responsible for describing the hierarchical information of a certain function node in the menu and restoring the hierarchical structure of the entire tree; the meta menu is responsible for restoring all function node information of the menu into a tree structure; after the user's request is verified by the identity authentication subdomain, the actions and results of the identity authentication subdomain and the menu subdomain can be combined and arranged by the application layer of the server. The present invention can control access to resources based on user roles, achieve high reusability of function nodes, and flexible and changeable menus.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of menu system, in particular to a menu system with permission control. BACKGROUND

[0002] The existing menu system is based on document type database (MONGO) storage, and is a whole tree structure menu, which faces the following problems:

[0003] 1. The access of the menu system needs security control, and the function of non-logged-in users is forbidden;

[0004] 2. The function nodes in the menu system need to be managed and configured by users according to requirements, and can be freely combined, but only for administrator identity;

[0005] 3. The user with administrator identity needs to manage the menu, and also needs to see and use all the function nodes that can be used by ordinary users;

[0006] 4. The function nodes can be reused, and the same function node can be used in multiple menu systems. SUMMARY

[0007] The present application provides a menu system with permission control to meet the needs and deficiencies of the current technology development.

[0008] The technical scheme adopted by the menu system with permission control to solve the above technical problems is as follows:

[0009] A menu system with permission control comprises an identity authentication subdomain and a menu subdomain.

[0010] The identity authentication subdomain uses a unified IAM system to perform identity recognition and access management according to the Oauth2 protocol.

[0011] The menu subdomain depends on the identity authentication subdomain, and splits the whole menu into the form of independent function node combination. The menu subdomain comprises three data models of function nodes, meta nodes and meta menus, wherein: the function nodes are responsible for describing function node information and performing actions related to the function nodes; the meta nodes are responsible for describing the hierarchical information of a certain function node in the menu, the meta nodes inherit the attributes of the function nodes, and extend the parent node information, which is used to restore the hierarchical structure of the whole tree, and the actions of the meta nodes are stored in the menu database entity as node information in the meta menu; the meta menu is responsible for caching the information of the function nodes, the meta nodes and the meta menu, and restoring all the function node information of the menu into a tree structure.

[0012] After the request of the user is verified by the identity authentication subdomain, the actions and results of the identity authentication subdomain and the menu subdomain can be combined and arranged through the application layer of the server.

[0013] Optionally, the identity authentication sub-domain uses a unified IAM system for identity recognition according to the Oauth2 protocol, and the specific steps are as follows:

[0014] Step S1.1, the user opens the client, the client finds that the user is not logged in, that is, carries the IAM system pre-allocated client unique identifier and the URL address of the response information required to receive to the IAM system initiates the HTTP application, obtains the request authorized by the IAM system, at this time, the IAM system will be redirected to the login page of the IAM system because the current request does not carry the user identity information;

[0015] Step S1.2, the user inputs the account password on the login page of the IAM system, and checks the IAM system authorization to the current client to access the user information, the IAM system receives the user's account information and performs verification, and after verification, the previous step of applying for authorization is continued, and the issued authorization credential is spliced to the URL address of the response information required to receive, and the response is returned to the client to redirect to the address, thus the client obtains the authorization credential;

[0016] Step S1.3, the client carries the authorization credential issued by the IAM system to initiate an HTTP request to obtain access credential to the server, the server receives the request, carries the IAM system pre-allocated client credential client_id, client_secret to the IAM system to initiate a request to apply for issuing access credential, and responds to the client after obtaining the access credential;

[0017] Step S1.4, the client obtains the access credential applied by the server to the IAM system, saves it to the local cache, and carries the access credential when making HTTP request.

[0018] Further optionally, when step S1.3 is executed, the client secret information is required to be carried to obtain the access credential, and the client secret information is saved by the server, so the server needs to initiate the access credential to the IAM system.

[0019] Optionally, the identity authentication sub-domain uses a unified IAM system for access management according to the Oauth2 protocol, and the specific steps are as follows:

[0020] Step S2.1, the client carries the access credential to access the HTTP interface controlled by the permission, the server receives the access credential, and turns to the IAM system to request user information, so as to verify the access credential and obtain the user's role, account information;

[0021] Step S2.2, the server reads the pre-set permission content according to the obtained user role information, judges whether the current user request has the permission of the resource, and then decides to return the resource information or error prompt information to achieve the purpose of access control.

[0022] Optionally, the function node information involved includes function node name, function node description information, function icon, hyperlink, and route.

[0023] The action of the function node includes creation, modification, and query.

[0024] The creation and modification actions of the function node need administrator permission; after the role of the user is verified in the application layer, the modification and creation requests meeting the requirements are directly persisted to the database, and a function node modified event is issued, so that the cache layer receives the event notification and caches the function node information.

[0025] The query action of the function node is used for hitting the data cached in the memory by the cache layer.

[0026] Optionally, the action of the meta menu involved includes creation, modification, query, and restoration.

[0027] The creation and modification of the meta menu need administrator permission; after the access is controlled according to the user role of the request from the application layer, the legal request is persisted to the database and a menu change event is issued, so that the cache layer caches the meta menu information and the meta node information.

[0028] The query of the meta menu will hit the cache data, and the complete menu and the function node information contained in the menu are assembled according to the meta node cache information and the function node cache information.

[0029] The restoration action of the meta menu is to restore all the function node information of the menu to a tree structure according to the meta node information description.

[0030] Preferably, the core of the restoration action of the meta menu is a tree traversal restoration algorithm, which uses the memory reference mechanism of the object of the program language to constantly mount and reference the memory addresses of all the flat function nodes to their parent nodes. When all the function nodes are traversed, the function node with an empty upper node is the root node of the entire menu.

[0031] Further optionally, the actions and results of the identity authentication subdomain and the menu subdomain are combined and arranged by the application layer of the server, and the specific steps are as follows:

[0032] Step S3.1, according to the menu number requested by the user, the meta menu information is queried out by using the query method of the menu subdomain.

[0033] Step S3.2: Take all meta-node information in the menu subdomain as a set, take the permission information obtained based on the current user role information in the identity authentication subdomain as a set, and use removeIf to find the intersection of the two sets to obtain the permission menu node set that matches the current user role information;

[0034] Step S3.3: Use the meta-menu restore action to restore the permission menu node set that obtains the current user role information into a tree structure, and respond to the client with the entire menu tree information.

[0035] The menu system with permission control of the present invention has the following beneficial effects compared with the prior art:

[0036] (1) The present invention can individually control access to sub-nodes in the entire menu based on roles, making menu configuration and combination more flexible and authority control more precise, so that the menu functions available to users vary depending on their roles;

[0037] (2) The menu system of the present invention classifies subdomains according to their business content and realizes functional autonomy, so that the business in each subdomain is clear, the functional responsibilities are clear, and the business is more accurately defined, which reduces the coupling between various business areas and reduces the maintenance cost of the menu system, is conducive to the long-term iteration of the menu system, and improves the reusability of the menu system;

[0038] (3) The identity authentication subdomain of the present invention adopts a role-based access control concept, which combines users with permission usage roles, so that the menu system can more accurately control the resource content accessed by users, avoid information leakage, protect users' legitimate resources, and enhance the security of the menu system;

[0039] (4) The menu subdomain of the present invention first splits the entire menu into a combination of independent functional nodes, and then freely combines and arranges the independent functional nodes, thereby achieving high reusability of the functional nodes and flexible variability of the menu. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Attachment Figure 1 It is a schematic diagram of subdomain division of the present invention. DETAILED DESCRIPTION

[0041] In order to make the technical solution, the technical problems solved and the technical effects of the present invention more clear, the technical solution of the present invention is clearly and completely described below in conjunction with specific embodiments.

[0042] Example 1:

[0043] Combined with attachment Figure 1 , this embodiment proposes a menu system with permission control, which includes an identity authentication subdomain and a menu subdomain.

[0044] (1) Identity authentication sub-domain uses a unified IAM system for identity recognition and access management according to the Oauth2 protocol.

[0045] (1) Identity authentication sub-domain uses a unified IAM system for identity recognition, and the specific steps are as follows:

[0046] Step S1.1, the user opens the client, the client finds that the user is not logged in, that is, carries the IAM system pre-allocated client unique identifier and the URL address of the response information required to receive to the IAM system initiates the HTTP application, obtains the request of the IAM system authorization, at this time, the IAM system will be redirected to the login page of the IAM system because the current request does not carry the user identity information;

[0047] Step S1.2, the user inputs the account password on the login page of the IAM system, and checks the IAM system authorization to the current client to access the user information, the IAM system receives the user's account information and performs verification, and after verification, the previous step of applying for authorization is continued, and the issued authorization credential is spliced to the URL address of the response information required to receive, and the response is returned to the client to redirect to the address, thus the client obtains the authorization credential;

[0048] Step S1.3, the client carries the authorization credential issued by the IAM system to initiate an HTTP request to obtain access credential to the server, the server receives the request, carries the IAM system pre-allocated client credential client_id, client_secret to the IAM system to initiate a request to issue access credential, and responds to the client after obtaining the access credential; It needs to be supplemented that since the access credential needs to carry the client secret information, and the client secret information is saved by the server, the access credential needs to be issued by the server to the IAM system;

[0049] Step S1.4, after the client obtains the access credential applied by the server to the IAM system, it is saved to the local cache, and the access credential is carried when making HTTP request.

[0050] (2) Identity authentication sub-domain uses a unified IAM system for access management according to the Oauth2 protocol, and the specific steps are as follows:

[0051] Step S2.1, the client carries the access credential to access the HTTP interface controlled by the permission, the server receives the access credential, and turns to the IAM system to request user information, so as to verify the access credential and obtain the user's role, account information;

[0052] Step S2.2, the server reads the pre-set permission content according to the obtained user role information, judges whether the current user request has the permission of the resource, and then decides to return the resource information or the error prompt information to achieve the purpose of access control.

[0053] (ii) The menu sub-domain depends on the identity authentication sub-domain, and the overall menu is split into the form of independent function node combination, the menu sub-domain including three data models of function node, meta node and meta menu.

[0054] (a) The function node is responsible for describing function node information and performing function node related actions;

[0055] The function node information includes function node name, function node description information, function icon, hyperlink and route;

[0056] The actions of the function node include creation, modification and query, wherein:

[0057] The creation and modification actions of the function node need administrator permission, after the role of the user is verified in the application layer, the modification and creation request meeting the requirements are directly persisted to the database, and the function node has been modified event is issued, so that the cache layer receives the event notification, and the function node information is cached;

[0058] The query action of the function node is used for hitting the data cached in the memory by the cache layer.

[0059] (b) The meta node is responsible for describing the hierarchical information of a function node in the menu, the meta node inherits the attributes of the function node, and extends the parent node information, which is used to restore the hierarchical structure of the whole tree, and the actions of the meta node are stored in the menu database entity as the node information in the meta menu.

[0060] (c) The meta menu is responsible for caching the information of the function node, the meta node and the meta menu, and restoring all the function node information of the menu into a tree structure.

[0061] The actions of the meta menu include creation, modification, query and restoration, wherein:

[0062] The creation and modification of the meta menu need administrator permission, after the access is controlled according to the user role of the request from the application layer, the legal request is persisted to the database and the menu change event is issued, so that the cache layer caches the meta menu information and the meta node information;

[0063] The query of the meta menu will hit the cached data, and assemble the complete menu and the function node information contained in the menu according to the meta node cached information and the function node cached information;

[0064] The restoring action of the meta menu is to restore all function node information of the menu to a tree structure according to the meta node information description.

[0065] (Three) After the user's request is verified by the identity authentication subdomain, the action and result of the identity authentication subdomain and the menu subdomain can be combined and arranged through the application layer of the server, and the specific steps are as follows:

[0066] Step S3.1, according to the menu number requested by the user, the meta menu information is queried out by using the query method of the menu subdomain;

[0067] Step S3.2, all meta node information in the menu subdomain is taken as a set, and the permission information based on the current user role information obtained from the identity authentication subdomain is taken as a set, and the intersection of the two sets is obtained by using removeIf, to obtain a permission menu node set conforming to the current user role information;

[0068] Step S3.3, the permission menu node set obtained by the current user role information is restored to a tree structure by using the restoring action of the meta menu, and the whole menu tree information is responded to the client.

[0069] As can be seen from the above, the menu system with permission control can accurately control the accessed resource content based on the user role, protect the legal resources of the user, and also realize the high reusability of the function nodes and the flexible variability of the menu through the free combination and arrangement of the function nodes in the menu subdomain.

[0070] Based on the above specific embodiments of the present application, any improvement and modification made by the person skilled in the art without departing from the principle of the present application shall fall within the scope of the patent protection of the present application.

Claims

1. A menu system with authority control, characterized in that ,It includes the identity authentication subdomain and the menu subdomain; The identity authentication subdomain uses a unified IAM system for identity identification and access management according to the Oauth2 protocol; The menu subdomain depends on the identity authentication subdomain, splitting the entire menu into a combination of independent function nodes. The menu subdomain includes three data models: function node, meta node, and meta menu, where: a) Function nodes are responsible for describing function node information and executing function node-related actions. Function node information includes the function node name, function node description, function icon, hyperlink, and route. Function node actions include creation, modification, and query. Creation and modification require administrator privileges. After the application layer verifies the user's role, eligible modification and creation requests are directly persisted to the database and a function node modification event is issued so that the cache layer can receive event notifications and cache the function node information. Query actions are used to hit data cached in memory by the cache layer. b) The meta-node is responsible for describing the hierarchical information of a function node in the menu. The meta-node inherits the attributes of the function node and extends the parent node information to restore the hierarchical structure of the entire tree. The actions of the meta-node are stored in the menu database entity as node information in the meta-menu. c) The metamenu is responsible for caching the information of function nodes, metanodes, and metamenus, and restoring all function node information of the menu into a tree structure; the actions of the metamenu include creation, modification, query, and restoration, among which: the creation and modification of the metamenu requires administrator privileges. After the application layer controls access based on the requested user role, legitimate requests will be persisted to the database and a menu change event will be issued so that the cache layer can cache the metamenu information and its metanode information; the query of the metamenu will hit the cached data and assemble the complete menu and the function node information contained in the menu based on the metanode cache information and the function node cache information; the metamenu restoration action is to restore all function node information of the menu into a tree structure according to the metanode information description. The core of the metamenu restoration action is the tree traversal restoration algorithm, which uses the memory reference mechanism of the programming language object to continuously mount the memory addresses of all flattened function nodes to their parent nodes. When all function nodes are traversed, the function node with an empty parent node is the root node of the entire menu; After the user's request is verified by the authentication subdomain, the server's application layer can combine and orchestrate the actions and results of the authentication subdomain and the menu subdomain. The specific steps are as follows: Step S3.1: Query the meta-menu information using the query method of the menu subdomain according to the menu number requested by the user; Step S3.2: Take all meta-node information in the menu subdomain as a set, take the permission information obtained based on the current user role information in the identity authentication subdomain as a set, and use removeIf to find the intersection of the two sets to obtain the permission menu node set that matches the current user role information; Step S3.3: Use the meta-menu restore action to restore the permission menu node set that obtains the current user role information into a tree structure, and respond to the client with the entire menu tree information.

2. A menu system with authority control according to claim 1, characterized in that: The identity authentication subdomain uses a unified IAM system for identity recognition according to the Oauth2 protocol. The specific steps are as follows: Step S1.1: The user opens the client. If the client detects that the user is not logged in, it initiates an HTTP request to the IAM system with the unique identifier pre-assigned by the IAM system and the URL address to receive the response information. The request is authorized by the IAM system. At this time, the IAM system redirects the user to the IAM system login page because the current request does not carry user identity information. Step S1.2: The user enters their account and password on the IAM system's login page and selects the option to allow the IAM system to authorize the current client to access user information. The IAM system receives the user's account information and verifies it. Once the verification is successful, it proceeds to the previous step to apply for authorization and appends the issued authorization certificate to the URL address where the response information needs to be received. The system then returns a response to redirect the client to this URL. The client then obtains the authorization certificate. Step S1.3: The client sends an HTTP request to the server for access credentials, carrying the authorization credentials issued by the IAM system. After receiving the request, the server sends a request to the IAM system for access credentials, carrying the client_id and client_secret pre-assigned to the client by the IAM system. After obtaining the access credentials, the server responds to the client. Step S1.4: After the client obtains the access credentials requested by the server from the IAM system, it saves them to the local cache and carries the access credentials when making HTTP requests.

3. A menu system with authority control according to claim 2, characterized in that: When executing step S1.3, since obtaining the access credential requires carrying the client key information, and the client key information is stored by the server, the issuance of the access credential must be initiated by the server to the IAM system.

4. A menu system with authority control according to claim 2, characterized in that: The identity authentication subdomain uses a unified IAM system for access management according to the Oauth2 protocol. The specific steps are as follows: Step S2.1: The client accesses the permission-controlled HTTP interface with the access credentials. The server receives the access credentials and requests the user information from the IAM system to verify the access credentials and obtain the user's role and account information. Step S2.2: The server reads the pre-set permission content based on the obtained user role information to determine whether the current user request has the permission for the resource, and then decides to return resource information or error prompt information to achieve the purpose of access control.

Images