Login access control method and device
Through row-level query permission annotation analysis and splicing query conditions, the code redundancy and error problems caused by hard coding are solved, and efficient data access control and code reuse are achieved.
Patent Information
- Application Number
- CN202111583991.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-22
- Publication Date
- 2025-08-29
- Estimated Expiration
- 2041-12-22
AI Technical Summary
In the prior art, filtering non-permission data through hard-coded methods leads to degradation of code redundancy and readability, and the judgment process is highly mechanical and prone to errors.
The row-level query permission annotation is used to obtain the query condition fields, parse and splice the current login attributes and matching rules, perform data access control based on the query conditions, and support data caching and display.
It improves the development efficiency of query interfaces, reduces code redundancy and error probability, realizes code reuse, and improves the accuracy of data permission control.
Smart Images
Figure CN114282187B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of automatic programming, and in particular to a login access control method and device. Background Art
[0002] This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. No statement herein is admitted to be prior art by virtue of its inclusion in this section.
[0003] When developing backend query interfaces, to prevent data leakage caused by the current logged-in user accessing data outside of their authorized scope (for example, only their own salary information is allowed to be queried), hard-coded filtering of non-authorized data is required based on the current logged-in user's role, organization, position, employee number, and other information. This results in redundant code and reduces readability. Furthermore, such judgments are mechanical, repetitive, and prone to errors. Summary of the Invention
[0004] The present invention provides a login access control method to address the existing problem of filtering unauthorized data based on information such as the current login user's role, organization, position, and employee number through hard-coded filtering, which results in code redundancy and reduced code readability. Furthermore, such judgments are mechanical, repetitive, and prone to errors. The method includes:
[0005] Obtain a query condition field, wherein the query condition field is provided with a row-level query permission annotation, wherein the row-level query permission annotation includes attributes of the current login user corresponding to the field and matching rules;
[0006] Parse the query condition field to obtain the attributes and matching rules of the current login user corresponding to the field;
[0007] Get the corresponding attribute value according to the attribute of the current login user corresponding to the field;
[0008] According to the matching rules, the field corresponding to the current login user attribute and the corresponding attribute value are spliced into the query condition;
[0009] Execute queries based on query conditions to obtain the data required for login access control.
[0010] In one embodiment, the attributes of the current login person include but are not limited to: the current login person's role, organization, position, or employee number.
[0011] In one embodiment, the matching rules include but are not limited to: equality, inequality, left string match, right string match, fuzzy match, non-left string match, non-right string match, non-fuzzy match, greater than, greater than or equal to, less than, less than or equal to.
[0012] In one embodiment, the query condition fields include multiple fields, constituting a field set;
[0013] Parsing the query condition field includes:
[0014] Parse each query condition field in the field set in turn to obtain the current login user attributes and matching rules corresponding to the field;
[0015] Get the corresponding attribute value based on the field corresponding to the current login user's attribute, including:
[0016] Loop through each query condition field in the field set, and get the corresponding attribute value based on the attribute of the current logged-in user corresponding to each field.
[0017] In one embodiment, it further includes:
[0018] Caches data required for login access control.
[0019] In one embodiment, the method further includes: displaying data required for login access control.
[0020] The present invention also provides a login access control device to address the existing problem of filtering unauthorized data based on hard-coded information such as the current login user's role, organization, position, and employee number, which results in code redundancy and reduced code readability. Furthermore, such judgments are mechanical, repetitive, and prone to errors. The device includes:
[0021] A query condition field acquisition module is used to obtain a query condition field, wherein the query condition field is provided with a row-level query permission annotation, and the row-level query permission annotation includes the field corresponding to the current login user attribute and matching rules;
[0022] A query condition field parsing module is used to parse the query condition field and obtain the field's corresponding attributes and matching rules for the current login user;
[0023] The attribute value acquisition module is used to obtain the corresponding attribute value according to the attribute of the current login user corresponding to the field;
[0024] The query condition splicing module is used to splice the field corresponding to the current login user attribute and the corresponding attribute value into the query condition according to the matching rules;
[0025] The query module is used to execute queries based on query conditions and obtain the data required for login access control.
[0026] In one embodiment, the attributes of the current login person include but are not limited to: the current login person's role, organization, position, or employee number.
[0027] In one embodiment, the matching rules include but are not limited to: equality, left string matching, or right string matching.
[0028] In one embodiment, the query condition fields include multiple fields, constituting a field set;
[0029] The query condition field parsing module is used to:
[0030] Parse each query condition field in the field set in turn to obtain the current login user attributes and matching rules corresponding to the field;
[0031] The attribute value acquisition module is used to:
[0032] Loop through each query condition field in the field set, and get the corresponding attribute value based on the attribute of the current logged-in user corresponding to each field.
[0033] In one embodiment, it further includes:
[0034] The cache database is used to cache the data required for login access control.
[0035] In one embodiment, it further includes: a display module, used to display the data required for login access control.
[0036] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned login access control method when executing the computer program.
[0037] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned login access control method is implemented.
[0038] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned login access control method is implemented.
[0039] In an embodiment of the present invention, compared with the technical solution in the prior art that filters non-authorized data based on information such as the current login person's role, organization, position, employee number, etc. in a hard-coded manner, a query condition field is obtained, and the query condition field is provided with a row-level query permission annotation, and the row-level query permission annotation includes the field corresponding to the current login person's attributes and matching rules; the query condition field is parsed to obtain the field corresponding to the current login person's attributes and matching rules; the corresponding attribute value is obtained according to the field corresponding to the current login person's attributes; according to the matching rules, the field corresponding to the current login person's attributes and the corresponding attribute value are spliced into the query condition; based on the query condition, the query is executed to obtain the data required for login access control. The present invention can realize zero-code control of the current login person's data row-level query permission in the query interface, greatly improving the development efficiency of the query interface row-level data permission control and reducing the probability of BUGs caused by row-level data permission control; avoiding the need to repeatedly write the same row-level query permission control code in each query interface, reducing redundant code while achieving code reuse. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:
[0041] Figure 1 The login access control method process in the embodiment of the present invention is as follows Figure 1 ;
[0042] Figure 2 The login access control method process in the embodiment of the present invention is as follows Figure 2 ;
[0043] Figure 3 The login access control method process in the embodiment of the present invention is as follows Figure 3 ;
[0044] Figure 4 The login access control method process in the embodiment of the present invention is as follows Figure 4 ;
[0045] Figure 5 The structure frame of the login access control device in the embodiment of the present invention is shown in FIG. Figure 1 ;
[0046] Figure 6 The structure frame of the login access control device in the embodiment of the present invention is shown in FIG. Figure 2 ;
[0047] Figure 7 The structure frame of the login access control device in the embodiment of the present invention is shown in FIG. Figure 3 ;
[0048] Figure 8 2 is a structural block diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION
[0049] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.
[0050] Explanation of terms:
[0051] Current login user information: When a user logs in to the system and performs various operations, the user information for the system, including but not limited to the user's role, organization, position, etc.
[0052] Row-level data access control: Provides query permission control for each row of data in the data table. Only those with query permission for the row of data are allowed to query the row of data.
[0053] Figure 1 The login access control method process in the embodiment of the present invention is as follows Figure 1 ,like Figure 1 As shown, the method includes:
[0054] Step 101: Obtain a query condition field, wherein the query condition field is provided with a row-level query permission annotation, wherein the row-level query permission annotation includes attributes of the field corresponding to the current login user and matching rules;
[0055] Step 102: Parse the query condition field to obtain the attributes of the current login user and the matching rules corresponding to the field;
[0056] Step 103: Obtain the corresponding attribute value according to the attribute of the current login user corresponding to the field;
[0057] Step 104: Based on the matching rules, the attribute of the current login user corresponding to the field and the corresponding attribute value are concatenated as the query condition;
[0058] Step 105: Execute a query based on the query conditions to obtain data required for login access control.
[0059] Specifically, this method assumes that the user has logged in and all of the user's information (e.g., role, organization, position, employee number) is directly available. Furthermore, the user has issued a query request, which the method retrieves from the query interface and performs a corresponding data query based on the query request to obtain data within the user's permissions.
[0060] Specifically, the annotation definition is: define the corresponding annotation for the non-empty field judgment of the query class interface, such as @QueryRange. The scope of the annotation is the field, and the annotated fields include:
[0061] 1) rangeType (field type is String, string), used to identify that this field needs to be associated with the corresponding attribute value of the current logged-in person (such as role, organization, position, employee number);
[0062] The role is equivalent to the user group in the Windows operating system. Users are assigned different roles and their access to different application resources is controlled based on the role.
[0063] Affiliated organizations, for example, can be business department, finance department, operations department, logistics department, sales department, etc.
[0064] Position, for example, it can be clerk, department manager, general manager, president, etc.;
[0065] Employee number, which is the employee's identity.
[0066] 2) matchRules (field type: String) identifies the matching rules. Matching rules include eq (equal), ne (not equal), ll (left string match), rl (right string match), al (fuzzy match), nll (not left string match), nrl (not right string match), nal (non-fuzzy match), gt (greater than), ge (greater than or equal to), lt (less than), le (less than or equal to), and so on.
[0067] The code example is as follows:
[0068]
[0069] When the query interface is executed, the underlying BaseService first performs permission verification on the incoming query conditions.
[0070] In the embodiment of the present invention, Figure 2 As shown, the query condition fields include multiple fields, constituting a field set;
[0071] Step 102 parses the query condition field, including:
[0072] Parse each query condition field in the field set in turn to obtain the current login user attributes and matching rules corresponding to the field;
[0073] Step 103 obtains the corresponding attribute value according to the field corresponding to the current login user's attribute, including:
[0074] Loop through each query condition field in the field set, and get the corresponding attribute value based on the attribute of the current logged-in user corresponding to each field.
[0075] In an embodiment of the present invention, step 102, adding annotations to fields: setting permission annotations for query condition fields in the query condition class corresponding to the entity and the attributes and matching rules of the current login person corresponding to the field.
[0076] For example:
[0077] @QueryRange(rangeType="userNo", matchRules="eq");
[0078] @QueryRange(rangeType="userNo",matchRules="ne");
[0079] @QueryRange(rangeType="userNo",matchRules="ge");
[0080] @QueryRange(rangeType="userNo",matchRules="gt");
[0081] @QueryRange(rangeType="userNo",matchRules="le");
[0082] @QueryRange(rangeType="userNo",matchRules="lt");
[0083] @QueryRange(rangeType="userNo",matchRules="ll");
[0084] @QueryRange(rangeType="userNo", matchRules="rl").
[0085] @QueryRange(rangeType="userNo", matchRules="al").
[0086] @QueryRange(rangeType="userNo",matchRules="nll");
[0087] @QueryRange(rangeType="userNo", matchRules="nrl").
[0088] @QueryRange(rangeType="userNo", matchRules="nal").
[0089] In an embodiment of the present invention, step 103 is to obtain a corresponding attribute value based on the attribute of the field corresponding to the current login user. Specifically, the attribute value of the current login user can be stored in a corresponding database. When it is determined that the field corresponds to the attribute of the current login user, it can be determined which attribute value to obtain.
[0090] For example, when the attribute of the field corresponding to the current login person is the role, the specific text corresponding to the role is obtained from the user's relevant information database (or data table) based on the role.
[0091] When the field corresponding to the current login user attribute is the affiliated organization, the user's organization name is obtained from the user's relevant information database (or data table) based on the affiliated organization, such as business department, finance department, operation department, logistics department, sales department, etc.
[0092] When the attribute of the field corresponding to the current login person is the position, the user's position name is obtained from the user's relevant information database (or data table) based on the position, such as employee, department manager, general manager, president, etc.
[0093] When the field corresponding to the current login person attribute is employee number, the user's number value is obtained from the user's related information database (or data table) based on the position, for example, 1001, 10011, a1011, and so on.
[0094] In the embodiment of the present invention, Figure 2 As shown, step 104 combines the field corresponding to the current login user attribute and the corresponding attribute value into a query condition according to the matching rule, for example:
[0095] @QueryRange(rangeType="userNo",matchRules="eq")String classUserNo, if the current logged-in user's UserNo is 1001, the query condition after concatenation is classUserNo=1001. In this way, after executing the query in step 105, the data obtained is within the permission range of user classUserNo=1001.
[0096] @QueryRange(rangeType="userNo",matchRules="ne")String classUserNo. If the current logged-in user's UserNo is 1001, the concatenated query condition is classUserNo!=1001. This matches multiple login names within the login name string that are not equal to 1001. Thus, after executing the query in step 105, data is obtained within the permission range of multiple users with classUserNo!=1001.
[0097] @QueryRange(rangeType="userNo",matchRules="ge")String classUserNo. If the current logged-in user's UserNo is 1001, the concatenated query condition is classUserNo>=1001, which matches multiple login names greater than or equal to 1001 in the login name string. In this way, after executing the query in step 105, the data obtained is within the permission range of multiple users with classUserNo>=1001.
[0098] @QueryRange(rangeType="userNo",matchRules="gt")String classUserNo. If the current logged-in user's UserNo is 1001, the concatenated query condition is classUserNo>1001, which matches multiple login names greater than or equal to 1001 in the login name string. In this way, after executing the query in step 105, the data obtained is within the permission range of multiple users with classUserNo>1001.
[0099] @QueryRange(rangeType="userNo",matchRules="le")String classUserNo. If the current logged-in user's UserNo is 1001, the concatenated query condition is classUserNo<=1001, which matches multiple login names less than or equal to 1001 in the login name string. In this way, after executing the query in step 105, the data obtained is within the permission range of multiple users with classUserNo<=1001.
[0100] @QueryRange(rangeType="userNo",matchRules="lt")String classUserNo. If the current logged-in user's UserNo is 1001, the concatenated query condition is classUserNo<1001, which matches multiple login names less than 1001 in the login name string. In this way, after executing the query in step 105, the data obtained is within the permission range of multiple users with classUserNo<1001.
[0101] @QueryRange(rangeType="userNo",matchRules="ll")String classUserNo. If the current user's UserNo is 1001, the query condition is "classUserNo like '1001%'." This matches multiple login names containing 1001 from the left in the login name string. After executing the query in step 105, the data obtained is within the permission range of multiple users with "classUserNo like '1001%'."
[0102] @QueryRange(rangeType="userNo",matchRules="rl")String classUserNo. If the current user's UserNo is 1001, the concatenated query condition is classUserNo like '%1001'. This matches multiple login names containing 1001 from the right within the login name string. In this way, after executing the query in step 105, the data obtained is within the permission range of multiple users with classUserNo like '%1001'.
[0103] @QueryRange(rangeType="userNo",matchRules="rl")String classUserNo. If the current user's UserNo is 1001, the query condition is "classUserNo like '%1001%'," which fuzzily matches multiple login names containing 1001 within the login name string. In this way, after executing the query in step 105, the data obtained is within the permission range of multiple users with classUserNo like '%1001%'.
[0104] @QueryRange(rangeType="userNo",matchRules="nll")String classUserNo. If the current user's UserNo is 1001, the query condition after concatenation is classUserNo not like '1001%'. This means that multiple login names containing 1001 are not matched from the left in the login name string. Thus, after executing the query in step 105, data within the permission range of multiple users with classUserNo like '1001%' is obtained.
[0105] @QueryRange(rangeType="userNo",matchRules="nrl")String classUserNo. If the current user's UserNo is 1001, the concatenated query condition is classUserNo like '%1001', meaning that multiple login names containing 1001 are not matched from the right side of the login name string. Thus, after executing the query in step 105, data within the permission range of multiple users with classUserNo not like '%1001' is obtained.
[0106] @QueryRange(rangeType="userNo",matchRules="nal")String classUserNo. If the current user's UserNo is 1001, the query condition after concatenation is classUserNo like '%1001%'. This means that multiple login names containing 1001 are not fuzzy matched within the login name string. Therefore, after executing the query in step 105, the data obtained is the data within the permission range of multiple users with classUserNo not like '%1001%'.
[0107] In the embodiment of the present invention, Figure 3 As shown, the method further includes:
[0108] Step 301: Cache the data required for login access control.
[0109] Specifically, data caching is a technology that temporarily stores data in a memory buffer. This refers to high-speed storage within a hard drive, which acts like a buffer within the computer, temporarily storing data for easy access and re-reading. Hard drives that cache large amounts of data offer significant advantages when accessing scattered files.
[0110] Typically, large amounts of data are stored in databases, and accessing the database by applications is a time-consuming operation. If the database data is first cached in a buffer area, when the application needs the data, it can be directly retrieved from the buffer area, which can reduce system overhead.
[0111] In the embodiment of the present invention, Figure 4 As shown, the method further includes:
[0112] Step 401: Display the data required for login access control.
[0113] Specifically, the acquired data may be displayed in strips, or may be organized into a file for display.
[0114] The acquisition, storage, use, and processing of data in this application's technical solution comply with relevant national laws and regulations.
[0115] The present invention also provides a login access control device, as described in the following embodiments. Since the principle of the device to solve the problem is similar to that of the login access control method, the implementation of the device can refer to the implementation of the login access control method, and the repeated parts will not be repeated.
[0116] Figure 5 The structure frame of the login access control device in the embodiment of the present invention is shown in FIG. Figure 1 ,like Figure 5 As shown, the device includes:
[0117] Query condition field acquisition module 02, used to obtain query condition fields, wherein the query condition fields are provided with row-level query permission annotations, and the row-level query permission annotations include attributes of the field corresponding to the current login user and matching rules;
[0118] Query condition field parsing module 04, used to parse the query condition field and obtain the field's corresponding current login user attributes and matching rules;
[0119] Attribute value acquisition module 06, used to obtain the corresponding attribute value according to the attribute of the current login user corresponding to the field;
[0120] The query condition splicing module 08 is used to splice the field corresponding to the current login user attribute and the corresponding attribute value into the query condition according to the matching rule;
[0121] The query module 10 is used to execute a query based on the query conditions to obtain the data required for login access control.
[0122] In the embodiment of the present invention, the attributes of the current login person include but are not limited to: the current login person's role, organization, position or employee number.
[0123] In an embodiment of the present invention, the matching rules include but are not limited to: equality, inequality, left string match, right string match, fuzzy match, non-left string match, non-right string match, non-fuzzy match, greater than, greater than or equal to, less than, less than or equal to.
[0124] In an embodiment of the present invention, the query condition fields include multiple fields, constituting a field set;
[0125] The query condition field parsing module is used to:
[0126] Parse each query condition field in the field set in turn to obtain the current login user attributes and matching rules corresponding to the field;
[0127] The attribute value acquisition module is used to:
[0128] Loop through each query condition field in the field set, and get the corresponding attribute value based on the attribute of the current logged-in user corresponding to each field.
[0129] In the embodiment of the present invention, Figure 6 As shown, it also includes:
[0130] The cache database 12 is used to cache data required for login access control.
[0131] In the embodiment of the present invention, Figure 7 As shown, it also includes:
[0132] The display module 14 is used to display the data required for login access control.
[0133] The present invention also provides a computer device, which may be a desktop computer, a tablet computer, a mobile terminal, etc., but the present invention is not limited thereto. In this embodiment, the computer device may refer to the implementation of the above-mentioned login access control method and the above-mentioned login access control device, the contents of which are incorporated herein and repeated parts are not repeated.
[0134] Figure 8 FIG. 8 is a schematic block diagram of the computer device 800 according to an embodiment of the present invention. Figure 8 As shown, the computer device 800 may include a central processor 100 and a memory 140; the memory 140 is coupled to the central processor 100. It should be noted that this figure is exemplary; other types of structures may be used to supplement or replace this structure to implement telecommunication functions or other functions.
[0135] In one embodiment, the login access control function may be integrated into the central processing unit 100. The central processing unit 100 may be configured to perform the following control:
[0136] Obtain a query condition field, wherein the query condition field is provided with a row-level query permission annotation, wherein the row-level query permission annotation includes attributes of the current login user corresponding to the field and matching rules;
[0137] Parse the query condition field to obtain the attributes and matching rules of the current login user corresponding to the field;
[0138] Get the corresponding attribute value according to the attribute of the current login user corresponding to the field;
[0139] According to the matching rules, the field corresponding to the current login user attribute and the corresponding attribute value are spliced into the query condition;
[0140] Execute queries based on query conditions to obtain the data required for login access control.
[0141] The attributes of the current login person include but are not limited to: the current login person's role, organization, position or employee number.
[0142] The matching rules include but are not limited to: equality, inequality, left string match, right string match, fuzzy match, non-left string match, non-right string match, non-fuzzy match, greater than, greater than or equal to, less than, and less than or equal to.
[0143] Wherein, the query condition fields include multiple fields, constituting a field set;
[0144] Parsing the query condition field includes:
[0145] Parse each query condition field in the field set in turn to obtain the current login user attributes and matching rules corresponding to the field;
[0146] Get the corresponding attribute value based on the field corresponding to the current login user's attribute, including:
[0147] Loop through each query condition field in the field set, and get the corresponding attribute value based on the attribute of the current logged-in user corresponding to each field.
[0148] Among them, also include:
[0149] Caches data required for login access control.
[0150] Among them, also include:
[0151] Displays the data required for login access control.
[0152] In another embodiment, the login access control may be configured separately from the central processing unit 100. For example, the login access control may be configured as a chip connected to the central processing unit 100, and the login access control function may be implemented under the control of the central processing unit.
[0153] like Figure 8 As shown, the computer device 800 may further include: a communication module 110, an input unit 120, an audio processing unit 130, a display 160, and a power supply 170. It is worth noting that the computer device 800 does not necessarily have to include Figure 8 In addition, the computer device 800 may also include all components shown in Figure 8 For components not shown, reference may be made to the prior art.
[0154] like Figure 8 As shown, the central processing unit 100 is sometimes also referred to as a controller or operation control unit, and may include a microprocessor or other processor device and / or logic device. The central processing unit 100 receives input and controls the operation of various components of the computer device 800 .
[0155] The memory 140 may be, for example, one or more of a cache, flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices. It may store programs for executing related information. The CPU 100 may execute the programs stored in the memory 140 to implement information storage or processing.
[0156] The input unit 120 provides input to the CPU 100. The input unit 120 may be, for example, a keypad or touch input device. The power supply 170 is used to provide power to the computer device 800. The display 160 is used to display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.
[0157] The memory 140 may be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), or SIM card. Alternatively, it may be a memory that retains information even when power is off, can be selectively erased, and is provided with more data. Examples of such memory are sometimes referred to as EPROMs. The memory 140 may also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142 for storing application programs and function programs, or processes for executing the operations of the computer device 800 via the central processing unit 100.
[0158] The memory 140 may also include a data storage unit 143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the computer device. The driver storage unit 144 of the memory 140 may include various driver programs for the computer device's communication functions and / or for executing other functions of the computer device (such as a messaging application, a contact book application, etc.).
[0159] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processor 100 to provide input signals and receive output signals, which may be the same as in a conventional mobile communication terminal.
[0160] Based on different communication technologies, multiple communication modules 110 can be provided in the same computer device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide audio output via the speaker 131 and receive audio input from the microphone 132, thereby implementing common telecommunication functions. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 130 is coupled to the central processing unit 100, enabling local recording via the microphone 132 and playback of stored audio via the speaker 131.
[0161] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned login access control method is implemented.
[0162] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned login access control method is implemented.
[0163] In an embodiment of the present invention, compared with the prior art technical solution of filtering non-authorized data based on information such as the current login user's role, organization, position, employee number, etc. through hard coding, a query condition field is obtained, the query condition field is provided with a row-level query permission annotation, and the row-level query permission annotation includes the field corresponding to the current login user's attribute and matching rules; the query condition field is parsed to obtain the field corresponding to the current login user's attribute and matching rules; the corresponding attribute value is obtained according to the field corresponding to the current login user's attribute; according to the matching rules, the field corresponding to the current login user's attribute and the corresponding attribute value are spliced into a query condition; based on the query condition, a query is executed to obtain the data required for login access control. The present invention can achieve zero-code control of the current login user's data row-level query permission in the query interface, greatly improving the development efficiency of the query interface row-level data permission control and reducing the probability of bugs caused by row-level data permission control; because the query condition class can be reused by multiple query interfaces, it avoids the need to repeatedly write the same row-level query permission control code in each query interface, reducing redundant code while achieving code reuse.
[0164] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0165] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0166] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0168] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A login access control method, characterized in that: include: Get the query condition field, which is set with a row-level query permission annotation. The row-level query permission annotation includes the field's corresponding attributes of the current logged-in user and matching rules. When the query interface is executed, the underlying BaseService first performs permission verification on the incoming query condition. Parse the query condition field to obtain the attributes and matching rules of the current login user corresponding to the field; Get the corresponding attribute value according to the attribute of the current login user corresponding to the field; According to the matching rules, the field corresponding to the current login user attribute and the corresponding attribute value are spliced into the query condition; Execute queries based on query conditions to obtain data required for login access control; Wherein, the query condition fields include multiple fields, constituting a field set; Parsing the query condition field includes: parsing each query condition field of the field set in turn to obtain the current login user attribute and matching rule corresponding to the field; Acquiring corresponding attribute values according to the attributes of the current logged-in user corresponding to the fields includes: looping through each query condition field in the field set, and acquiring corresponding attribute values based on the attributes of the current logged-in user corresponding to each field.
2. The login access control method according to claim 1, wherein: The attributes of the current login person include but are not limited to: the current login person's role, organization, position or employee number.
3. The login access control method according to claim 1, wherein: The matching rules include but are not limited to: equality, inequality, left string match, right string match, fuzzy match, non-left string match, non-right string match, non-fuzzy match, greater than, greater than or equal to, less than, and less than or equal to.
4. The login access control method according to claim 1, wherein: Also includes: Caches data required for login access control.
5. The login access control method according to claim 1, wherein: Also includes: Displays the data required for login access control.
6. A login access control device, characterized in that: include: The query condition field acquisition module is used to obtain the query condition field. The query condition field is set with a row-level query permission annotation. The row-level query permission annotation includes the field's corresponding attributes of the current logged-in user and matching rules. When the query interface is executed, the underlying BaseService first performs permission verification on the incoming query condition. A query condition field parsing module is used to parse the query condition field and obtain the field's corresponding attributes and matching rules for the current login user; The attribute value acquisition module is used to obtain the corresponding attribute value according to the attribute of the current login user corresponding to the field; The query condition splicing module is used to splice the field corresponding to the current login user attribute and the corresponding attribute value into the query condition according to the matching rules; The query module is used to execute queries based on query conditions and obtain the data required for login access control; Wherein, the query condition fields include multiple fields, constituting a field set; The query condition field parsing module is used to parse each query condition field in the field set in turn to obtain the current login user attributes and matching rules corresponding to the field; The attribute value acquisition module is used to: loop through each query condition field in the field set, and obtain the corresponding attribute value based on the attribute of each field corresponding to the current logged-in user.
7. The login access control device according to claim 6, wherein: The attributes of the current login person include but are not limited to: the current login person's role, organization, position or employee number.
8. The login access control device according to claim 6, wherein: The matching rules include but are not limited to: equality, inequality, left string match, right string match, fuzzy match, non-left string match, non-right string match, non-fuzzy match, greater than, greater than or equal to, less than, and less than or equal to.
9. The login access control device according to claim 6, wherein: Also includes: The cache database is used to cache the data required for login access control.
10. The login access control device according to claim 6, wherein: Also includes: The display module is used to display the data required for login access control.
11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the login access control method according to any one of claims 1 to 5 is implemented.
12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the login access control method according to any one of claims 1 to 5 is implemented.
13. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the login access control method according to any one of claims 1 to 5 is implemented.
Citation Information
Patent Citations
Data permission configuration method and device and computer equipment
CN111552678A