Method and apparatus for constructing a rights management system, computer device and storage medium

Abstract

The application relates to the field of computer software and provides a permission management system construction method and device, computer equipment and a storage medium. The method acquires a plurality of domain events of business requirements, extracts domain vocabulary and event commands from the domain events, selects domain events associated with permissions from the plurality of domain events according to a preset permission configuration rule to form an event map, obtains a plurality of keywords corresponding to the permission management system according to the event map, performs business division on the domain vocabulary according to the permission configuration rule and the plurality of keywords to obtain each business boundary of the permission management system, constructs a plurality of permission control units based on each business boundary, determines a domain model according to boundary information of each business boundary and the plurality of permission control units, and generates interface code corresponding to each permission control unit based on the domain model and each event command. The application can diversely control resources and form unified permission control logic.

Description

Technical Field

[0001] This application relates to the field of computer software technology, and in particular to a method, apparatus, computer device, and storage medium for constructing a permission management system. Background Technology

[0002] Access control is a crucial component in the development and maintenance of business systems. It helps administrators define and manage system access permissions for various personnel, effectively preventing risks arising from inadequate access control. In some related technologies, business systems are developed and maintained independently. To quickly implement business access control requirements, the access control development team directly implements fixed logic code in the front-end or back-end. However, when administrators subsequently adjust permissions, this logic code lacks universality, and modifications may result in wasted human resources. Summary of the Invention

[0003] The purpose of this application is to at least partially solve the problems of the prior art, and to provide a method, apparatus, computer equipment and storage medium for constructing an access control system, which can perform diversified management and control of resources, form a unified access control logic and save human resources.

[0004] The technical solution of this application embodiment is as follows:

[0005] Firstly, this application provides a method for constructing a permission management system, the method comprising:

[0006] Acquire multiple domain events related to business needs, and extract domain terms and event commands from each of the domain events;

[0007] According to the preset permission configuration rules, select the domain events associated with permissions from multiple domain events to form an event map;

[0008] Based on the event map, obtain multiple keywords corresponding to the permission management system;

[0009] Based on the permission configuration rules and multiple keywords, the domain terms are divided into business categories to obtain the various business boundaries of the permission management system;

[0010] Based on each of the aforementioned business boundaries, multiple permission control units corresponding to the permission management system are constructed.

[0011] The domain model is determined based on the boundary information of each of the business boundaries and the multiple permission control units;

[0012] Based on the domain model and each of the event commands, interface code corresponding to each of the permission control units is generated.

[0013] According to some embodiments of this application, obtaining multiple keywords corresponding to the access control system based on the event map includes:

[0014] Based on the event map, resource keywords, action keywords, and permission keywords corresponding to the permission management system are extracted. The resource keywords include menus, buttons, files, and data objects. The action keywords include add, delete, modify, query, upload, and download operations. The permission keywords include user permissions and data permissions.

[0015] The keywords corresponding to the permission management system are constituted based on the resource keywords, the action keywords, and the permission keywords.

[0016] According to some embodiments of this application, determining the domain model based on the boundary information of each of the business boundaries and the multiple permission control units includes:

[0017] Based on the boundary information of each of the business boundaries, determine the entity association relationships between the domain terms of each of the business boundaries;

[0018] Based on the entity associations, the calling relationships between the various permission control units are determined;

[0019] The domain model is determined based on the multiple permission control units and the calling relationships between them.

[0020] According to some embodiments of this application, determining the entity association relationship between various domain terms of the business boundary based on the boundary information of each business boundary includes:

[0021] Based on the permission configuration rules, the user permissions and the data permissions are determined;

[0022] Based on the user permissions and the data permissions, the action keywords and the resource keywords are controlled to obtain the combination relationship between the action keywords and the resource keywords;

[0023] Based on the combination relationship, determine the entity association relationship between the various domain terms of the business boundary.

[0024] According to some embodiments of this application, the step of dividing the domain vocabulary into business categories based on the permission configuration rules and multiple keywords to obtain the various business boundaries of the permission management system includes:

[0025] Based on the permission configuration rules, for each keyword, the association relationship between the keyword and each domain term is calculated to obtain the association degree;

[0026] Based on the aforementioned relevance, the vocabulary in each of the aforementioned domains is divided into business categories to determine the business boundaries.

[0027] According to some embodiments of this application, the step of generating interface code corresponding to each of the permission control units based on the domain model and each of the event commands includes:

[0028] Based on the domain model, create service interfaces corresponding to each event command, and generate interface documentation for each service interface.

[0029] Based on the interface documentation, generate the interface code corresponding to each of the permission control units.

[0030] According to some embodiments of this application, determining the user permissions and the data permissions based on the permission configuration rules includes:

[0031] According to the permission configuration rules, the permissions of each preset user role are identified to obtain the identification results corresponding to each user role;

[0032] The user permissions and data permissions for each user role are determined based on the identification results.

[0033] Secondly, this application provides an apparatus for constructing a permission management system, comprising:

[0034] The data acquisition module is used to acquire events from various domains required by the business, and extract domain terms and event commands from each of the events.

[0035] The data processing module is used to select domain events associated with permissions from each of the domain events according to preset permission configuration and preset permission authentication, and form an event map;

[0036] The vocabulary generation module is used to determine the keywords corresponding to the permission management system based on the event map;

[0037] The segmentation module is used to perform business segmentation of the domain terms based on the permission configuration and each of the keywords, and to determine the business boundaries of the permission management system.

[0038] The permission control generation module is used to construct multiple permission control units corresponding to the permission management system based on each of the aforementioned business boundaries.

[0039] The model building module is used to determine the domain model based on the boundary information of each of the business boundaries and the multiple permission control units;

[0040] The code generation module is used to generate interface code corresponding to each of the permission control units based on the domain model and each of the event commands.

[0041] Thirdly, this application provides a computer device including a memory and a processor, wherein the memory stores computer-readable instructions that, when executed by one or more of the processors, cause the one or more processors to perform the steps of any of the methods described in the first aspect above.

[0042] Fourthly, this application also provides a computer-readable storage medium that can be read and written by a processor, the storage medium storing computer instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of any of the methods described in the first aspect above.

[0043] The technical solution provided in this application has the following beneficial effects:

[0044] This application proposes a method, apparatus, computer device, and storage medium for constructing a permission management system. This embodiment facilitates the generation of an event map, enabling the association of domain events. It then aggregates domain terms into keywords for boundary delineation, allowing the resulting domain model to manage resources in diverse ways, thus forming a unified permission control logic. When subsequent administrators adjust permissions, this unified control logic automatically updates the system, saving human resources. (Permission Management System Construction) Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating a method for constructing a permission management system according to an embodiment of this application;

[0046] Figure 2 yes Figure 1 A flowchart illustrating a sub-step of step S300;

[0047] Figure 3 yes Figure 1 A flowchart illustrating a sub-step of step S600;

[0048] Figure 4 yes Figure 3 A flowchart illustrating a sub-step of step S610;

[0049] Figure 5 yes Figure 1 A flowchart illustrating a sub-step of step S400;

[0050] Figure 6 yes Figure 1A flowchart illustrating a sub-step of step S700;

[0051] Figure 7 yes Figure 4 A flowchart illustrating a sub-step of step S611 in the middle section;

[0052] Figure 8 This is a schematic diagram of an event map for a permission management system construction method provided in one embodiment of this application;

[0053] Figure 9 This is a schematic diagram of the permission control unit of a permission management system construction method provided in an embodiment of this application;

[0054] Figure 10 This is a schematic diagram of the structure of a permission management system construction apparatus provided in one embodiment of this application;

[0055] Figure 11 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] It should be noted that, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0058] First, let's analyze some of the terms used in this application:

[0059] Domain-Driven Design (DDD) is a methodological approach that defines a domain model to determine business and application boundaries, ensuring consistency between the business model and the code model. DDD is not an architecture itself, but rather a methodology for architectural design. It simplifies complex business domains through boundary delineation, creating clear domain and application boundaries that allow for easy evolution of the software architecture.

[0060] Event storming is a primary method for building domain models; it's a process that moves from divergence to convergence. The event storming process generates numerous domain objects, including entities, commands, and events. We then cluster these domain objects across different dimensions, forming boundaries such as aggregations and bounded contexts, thus building the domain model—this is the convergence process.

[0061] Enterprise user systems (B2B systems) are products designed for enterprise operations, serving goals such as building company structures, achieving systematization, and improving efficiency. Examples include office automation (OA) systems and ERP systems. Compared to personal user systems, B2B systems have fewer users, longer lifecycles, and each function is more important.

[0062] According to relevant technologies, the types of permission control are mostly visible, invisible, and disabled. Moreover, permission control is generally limited to the control of menus, pages, and buttons. It is mostly independent permission control for a single menu or page, without forming a unified permission control logic. Each time a new menu or page is added, it needs to be developed and designed separately, resulting in code redundancy.

[0063] Based on this, embodiments of this application propose a method, apparatus, computer device, and storage medium for constructing a permission management system. The method first acquires multiple domain events related to business requirements and extracts domain terms and event commands from each domain event. According to preset permission configuration rules, it selects domain events associated with permissions from the multiple domain events to form an event map, which allows for the association of domain events. Based on the event map, it obtains multiple keywords corresponding to the permission management system. According to the permission configuration rules and multiple keywords, it performs business segmentation on the domain terms, obtaining the various business boundaries of the permission management system, enabling the aggregation of domain terms into keywords. Based on each business boundary, it constructs multiple permission control units corresponding to the permission management system, facilitating diversified resource management. Based on the boundary information of each business boundary and the multiple permission control units, it determines a domain model, thereby forming a unified permission control logic and saving human resources. Based on the domain model and various event commands, it generates interface code corresponding to each permission control unit. Embodiments of this application can achieve diversified resource management, form a unified permission control logic, and save human resources.

[0064] It should be noted that the permission management system construction method can be applied to B-end systems as well as human user systems (C-end systems). It can manage resources in a variety of ways, form a unified permission management logic, and avoid permission control risks.

[0065] The embodiments of this application can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can reside in local and remote computer storage media, including storage devices.

[0066] The following description, with reference to the accompanying drawings, illustrates the permission management system construction method, apparatus, computer equipment, and storage medium provided in the embodiments of this application.

[0067] See Figure 1 , Figure 1 The diagram illustrates a flowchart of a permission management system construction method provided in an embodiment of this application. The method includes, but is not limited to, steps S100, S200, S300, S400, S500, S600, and S700.

[0068] Step S100: Obtain multiple domain events related to business requirements, and extract domain terms and event commands from each domain event.

[0069] In one embodiment, business requirements include the business operations corresponding to the target software system, including the business scope and business processes. Domain terminology refers to the specific objects of resources, actions, and data related to domain events when modeling and analyzing the target software system. The development and maintenance of the target software system are carried out by obtaining business requirements. Multiple domain events corresponding to the business requirements are obtained. The standardized naming rule for domain events is noun + past tense of verb, for example, "order created" and "file uploaded." Furthermore, the names of domain events should avoid using nouns such as "data" and "information," as the use of such meaningless nouns will interfere with the subsequent analysis of the target business. Domain terminology and event commands are extracted from each domain event. For example, domain terminology includes account, role, user permission application, action, data, and file, while event commands are represented as "upload file," "download file," and "add button," etc. Obtaining domain terminology and event commands facilitates unified control of permissions in the future.

[0070] Step S200: Based on the preset permission configuration rules, select the domain events associated with permissions from multiple domain events to form an event map.

[0071] In one embodiment, the domain events obtained in step S100 are subjected to event storming using Domain-Driven Design (DDD). Event storming can discover and mine some business concepts, and cluster and converge these concepts. Preset permission configuration rules include the identification and authentication of user roles; different users have different permissions. For example, different permissions need to be distinguished between ordinary users and administrator users. Administrator users have the authority to authorize ordinary users, while ordinary users cannot perform authorization operations. Furthermore, different ordinary users have different access permissions for resources, actions, or data, which can be configured according to rules for administrators and ordinary users. After configuring permissions according to the rules, domain events associated with the configured permissions are selected from multiple domain events to form an event map. The event map includes the configured user role name, the permissions that can be operated, the event commands to be executed, the domain events, and the relationship between each domain event and the event commands. The key domain events obtained from event storming are aggregated and reflected in the event map, which is beneficial for subsequent business boundary delineation based on the event map.

[0072] For example, refer to Figure 8 Taking the event map corresponding to user permission configuration as an example, this section explains the event map. The event map includes the subject name, input, event command, and domain event. In the event map corresponding to user permission configuration, the subject names include "system administrator" and "system." For the system administrator, the received input includes "business system," "user role," and "data scope," the event command is "configure user permissions," and the domain event is "user permissions configured." For the system, the received input is "user account," the event command is "get account," and the domain event is "user has been acquired." Alternatively, the received input can be both "user account" and "user role," the event command is "bind account and role relationship," and the domain event is "account and role relationship bound." After configuring user permissions, the system receives the input "user account," retrieves the account information, and obtains the domain event "account information acquired." Based on the retrieved user account information and user role, the system binds the account and role relationship, resulting in the domain event "account and role relationship bound." The event map reflects the executing subject, domain events, and the direction of data flow, facilitating keyword extraction.

[0073] Step S300: Obtain multiple keywords corresponding to the permission management system based on the event map.

[0074] In one embodiment, step S200 obtains an event map, extracts domain terms from the event map, and defines multiple keywords associated with the permission management system based on these domain terms. These keywords can be summaries of the domain terms in the event map, or partial extracts of the domain terms from the event map, thus forming multiple keywords. This facilitates subsequent business boundary delineation based on the keywords.

[0075] refer to Figure 2 Based on the event map, obtain multiple keywords corresponding to the access control system, including but not limited to the following steps:

[0076] Step S310: Based on the event map, extract resource keywords, action keywords, and permission keywords corresponding to the permission management system. Resource keywords include menus, buttons, files, and data objects; action keywords include add, delete, modify, query, upload, and download operations; and permission keywords include user permissions and data permissions.

[0077] In one embodiment, based on the event map obtained in step S200, resource keywords, action keywords, and permission keywords corresponding to the permission management system are extracted. Resource keywords are objects that users can operate on in the software system, including menus, buttons, files, and data objects. Action keywords are operations that users can perform on resources, including add, delete, modify, query, upload, and download operations. Permission keywords include user permissions and data permissions. User permissions include user and role permissions. Users are the entities that access the system or initiate system operations. Role permissions manage the scope of user's operational authority over resources and actions by assigning user roles. Data permissions are the resource data content visible to users, including visible row and column content. In this document, it refers to row data permissions. Data permissions are bound to user permissions. According to the rules of permission configuration, the selected data range is controlled when requesting permissions, thereby achieving diversification of permission control behaviors.

[0078] Step S320: Based on resource keywords, action keywords, and permission keywords, construct the various keywords corresponding to the permission management system.

[0079] In one embodiment, based on the objects that users can operate on in the software system, the operations that users can perform on resources, the subjects accessing them, and the user permissions and data permissions assigned to the subjects, domain vocabulary is summarized to form various keywords corresponding to the permission management system, which is beneficial for subsequent business boundary division based on keywords.

[0080] Step S400: Based on the permission configuration rules and multiple keywords, the domain terms are divided into business categories to obtain the various business boundaries of the permission management system.

[0081] In one embodiment, user permissions and data permissions are controlled through permission configuration rules. Based on multiple keywords, the permission configuration is adapted to the permission keywords in each keyword. The domain terms are divided into business categories to obtain the boundaries of each business, thereby realizing the scope of permission control for the software system and facilitating the formation of a unified permission control logic.

[0082] refer to Figure 5 Based on permission configuration rules and multiple keywords, domain terms are divided into business categories to obtain the various business boundaries of the permission management system, including but not limited to the following steps:

[0083] Step S410: According to the permission configuration rules, for each keyword, calculate the association relationship between the keyword and the vocabulary of various fields to obtain the association degree.

[0084] In one embodiment, based on the permission configuration rules, preliminary business segmentation is first performed on each keyword, and the association between the keywords and vocabulary in each domain is calculated. Domain vocabulary segmentation can be performed using a word vector algorithm to obtain the association degree; alternatively, a word vector-based clustering algorithm can be used to calculate the association degree. Obtaining the association degree facilitates subsequent domain segmentation processing based on the association degree.

[0085] Step S420: Based on the relevance, classify the vocabulary of each domain into business categories and determine the business boundaries.

[0086] In one embodiment, the relevance scores obtained in step S410 are sorted, either in ascending or descending order. When sorted in descending order, the domain terms corresponding to the first R relevance scores are grouped into one domain to define the business boundary. When sorted in ascending order, the domain terms corresponding to the last R relevance scores are grouped into one domain to define the business boundary. Defining business boundaries facilitates the analysis of various components of the software system, thereby achieving unified access control and saving human resources. Here, R is a preset value, which can be 10 or 15, and can be set according to requirements; details are omitted here. Based on the R value, if the keyword is within the range of R, the keyword and domain terminology are strongly related; if it is outside the range of R, the keyword and domain terminology are weakly related.

[0087] Step S500: Based on each business boundary, construct multiple permission control units corresponding to the permission management system.

[0088] In one embodiment, in the software system design, one business boundary can be used as a permission control unit, two business boundaries can be used as a permission control unit, or one business boundary can be used as two permission control units. For example, the business boundaries corresponding to the participants can form one permission control unit; the business boundaries corresponding to resources and actions can form one permission control unit corresponding to the permission center; the business boundary corresponding to user identification in user permissions can form one permission control unit, and the business boundary corresponding to permission authorization can form another permission control unit. The permission control unit is an important component of the software system, enabling unified control over permissions.

[0089] Step S600: Determine the domain model based on the boundary information of each business boundary and multiple permission control units.

[0090] refer to Figure 3 The domain model is determined based on the boundary information of each business boundary and multiple permission control units, including but not limited to steps S610, S620 and S630.

[0091] Step S610: Based on the boundary information of each business boundary, determine the entity association relationship between the domain terms of each business boundary.

[0092] In one embodiment, each business boundary is obtained through step S420. Based on the division of events in each domain at different stages and combined with the experience of professional designers, the domain terms of each business boundary are analyzed to obtain the boundary information of the business boundary. Based on this boundary information, the entity association relationship between the domain terms is calculated. The domain terms within a business boundary are strongly associated, thereby achieving high cohesion and low coupling between modules in the system design.

[0093] refer to Figure 4 Based on the boundary information of each business boundary, the entity association relationships between the domain terms of each business boundary are determined, including but not limited to the following steps:

[0094] Step S611: Determine user permissions and data permissions based on permission configuration rules.

[0095] In one embodiment, the permission configuration rules are formulated based on the experience of professional system builders and the business requirements of the software system. These rules determine user permissions and data permissions, thereby enabling operability control and ensuring the security of the software system. For example, according to the permission configuration rules, ordinary users only have view permissions for files and cannot modify them, while administrators can view, modify, and delete files. Regarding data permissions, according to the rules, ordinary users can only view published files or partial information about files, while administrators can view unpublished files and view all information. Determining user permissions and data permissions facilitates the subsequent determination of the calling relationships between permission control units.

[0096] refer to Figure 7 Based on permission configuration rules, user permissions and data permissions are determined, including but not limited to the following steps:

[0097] Step S6111: Based on the permission configuration rules, identify the permissions of each preset user role and obtain the identification results corresponding to each user role.

[0098] In one embodiment, the permissions of various preset user roles using the software system are identified based on the configured user roles. The preset user roles include ordinary users and administrator users. Administrator users further include ordinary administrator users and super administrator users. The identification process differs for different users. For ordinary users, only their identity information needs to be verified, for example, through password verification or mobile phone number verification. For ordinary administrators and super administrators, both identity information verification and user role identification are required. Administrators can be identified through their account type format to distinguish different types of administrators.

[0099] Step S6112: Determine the user permissions and data permissions for each user role based on the identification results.

[0100] In one embodiment, based on the identification result in step S6111, regarding file processing, if the user is identified as a regular user, they can view the file but cannot modify it; if they are a regular administrator, they can view and modify the file but cannot delete it; if they are a super administrator, they can view, modify, and delete the file. The user permissions indicate whether a user can operate on a file, and the data permissions indicate what operations a user can perform. By determining the user permissions and data permissions for each user role, access to various resources can be restricted or actions can be controlled, which is beneficial for subsequently constructing overall permission control and forming a unified control logic.

[0101] Step S612: Based on user permissions and data permissions, control the action keywords and resource keywords to obtain the combination relationship between action keywords and resource keywords.

[0102] In one embodiment, action keywords and resource keywords are controlled based on user permissions and data permissions. For example, regarding action keywords, when a user has viewing permissions for a file, they can first download the file and then view it; in this case, the action keywords are "download" and "view." Regarding resource keywords, when a user has viewing permissions for a file, the object of the operation is the file; the resource keyword is "file." Based on the above example, when a user has viewing permissions for a file, the combined relationship between action keywords and resource keywords is "download file" and "view file." Other possible combinations include "upload file," "modify menu," and "delete file," which will not be elaborated here. Obtaining the combined relationship between action keywords and resource keywords is beneficial for subsequently determining the entity association relationships between terms in various domains.

[0103] Step S613: Determine the entity association relationships between the domain terms of the business boundary based on the combination relationship.

[0104] In one embodiment, based on the combination relationship obtained in step S612, action keywords and resource keywords can be combined. Since each keyword includes multiple domain terms, for example, resource keywords include terms such as buttons, menus, and files, and action keywords include viewing and deleting. Based on the operable operations and operable objects, the entity association relationship between each domain term is obtained, which is beneficial for subsequently determining the calling relationship between each permission control unit.

[0105] Step S620: Determine the calling relationship between each permission control unit based on the entity association relationship.

[0106] In one embodiment, based on the entity association relationships obtained in step S613, and the entity association relationships of domain vocabulary, the association relationships between various business boundaries are obtained. These association relationships can be one-to-one, many-to-one, or one-to-many, and can also be represented as aggregation, inheritance, and generalization relationships, etc., which will not be elaborated here. Each business boundary can correspond to a permission control unit, thus obtaining the calling relationships between various permission control units. The above steps not only obtain the calling relationships between various permission control units, but also the calling relationships within each permission control unit. Determining the calling relationships between various permission control units is beneficial for forming the overall architecture of the entire software system.

[0107] Step S630: Determine the domain model based on multiple permission control units and the calling relationships between them.

[0108] In one embodiment, multiple permission control units are obtained according to step S500, and the calling relationship between permission control units is obtained according to step S620, thereby forming the overall architecture design of the software system, obtaining the domain model corresponding to the software system, and realizing the design and analysis of the software system.

[0109] For example, refer to Figure 9 In the domain model, taking resource keywords as an example, the permission control units corresponding to resource keywords are explained. The permission control units corresponding to resource keywords include data entities, menu entities, file entities, button entities, resource group entities, resource type entities, resource aggregate roots, and user subject-resource relationship entities. Data entities include data ID, data code, data range, and data name; menu entities include menu ID, menu code, menu name, menu Uniform Resource Locator (URL), and parent menu ID; file entities include file ID, file code, file name, file path, and parent file ID; button entities include button ID, button code, button name, and button path; resource group entities include resource group ID and resource group name; resource type entities include resource type ID and resource type name; resource entities include resource ID, resource code, resource name, resource address, parent resource ID, resource group ID, resource type ID, resource sorting, and active status; user subject-resource relationship entities include user subject-resource relationship ID, member role ID, and resource ID. Data entities, menu entities, file entities, and button entities have a generalized relationship with the resource aggregation root. Resource group entities and resource type entities have a many-to-one relationship with the resource aggregation root. The resource aggregation root has a one-to-many relationship with the user subject and resource relationship entities. Figure 9The asterisk (*) indicates multiple access permissions. This resource keyword can also be associated with other keywords in the domain model to form business boundaries, enabling calls between various permission control units based on user permissions and data permissions, thus achieving unified permission control logic. The call relationships within other permission control units are similar to the above and will not be elaborated upon here.

[0110] Step S700: Based on the domain model and various event commands, generate the interface code corresponding to each permission control unit.

[0111] refer to Figure 6 Based on the domain model and various event commands, generate the interface code corresponding to each permission control unit, including but not limited to the following steps:

[0112] Step S710: Based on the domain model, create service interfaces corresponding to each event command and generate interface documentation for each service interface.

[0113] In one embodiment, the domain model obtained above is used to obtain the various permission control units in the domain model and the calling relationships between the various permission control units. Based on event commands, various service interfaces are created. These service interfaces are represented as Application Programming Interfaces (APIs). The APIs can be edited to generate corresponding interface documentation, including Swagger, Eolinker, and apiDoc documentation. Obtaining the interface documentation facilitates subsequent interface code generation.

[0114] Step S720: Based on the interface documentation, generate the interface code corresponding to each permission control unit.

[0115] In one embodiment, based on the Swagger, Eolinker, and apiDoc interface documents, the corresponding interface code for each permission control unit is generated, thereby automating the process of generating interface documents based on event commands and then generating interface code based on the interface documents. This saves manpower and improves the design efficiency of the permission management system.

[0116] refer to Figure 10This application provides a permission management system construction device 100. The device 100 includes: a data acquisition module 110 acquiring various domain events related to business requirements and extracting domain terms and event commands from these events; a data processing module 120 selecting domain events associated with permissions from these events based on preset permission configurations and authentication methods to form an event map, thus linking domain events; a terminology generation module 130 determining keywords corresponding to the permission management system based on the event map; a segmentation module 140 performing business segmentation on the domain terms based on the permission configurations and keywords to determine the business boundaries of the permission management system, enabling the aggregation of domain terms into keywords; a permission control generation module 150 constructing multiple permission control units corresponding to the permission management system based on the business boundaries, facilitating diversified resource management; a model construction module 160 determining a domain model based on the boundary information of each business boundary and the multiple permission control units, thereby forming a unified permission control logic and saving human resources; and a code generation module 170 generating interface code corresponding to each permission control unit based on the domain model and event commands. The embodiments of this application can manage resources in a diverse manner, forming a unified permission management logic and saving human resources.

[0117] It should be noted that the data acquisition module 110 is connected to the data processing module 120, the data processing module 120 is connected to the vocabulary generation module 130, the vocabulary generation module 130 is connected to the segmentation module 140, the segmentation module 140 is connected to the permission control generation module 150, the permission control generation module 150 is connected to the model building module 160, and the model building module 160 is connected to the code generation module 170. The permission management system construction method provided in the above embodiment operates on the permission management system construction device 100, which can perform diversified management of resources, form a unified permission control logic, and save human resources.

[0118] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0119] Figure 11 This application illustrates a computer device 500 provided in an embodiment of the present application. The computer device 500 may be a server or a terminal, and its internal structure includes, but is not limited to:

[0120] Memory 510 is used to store programs;

[0121] The processor 520 is used to execute the program stored in the memory 510. When the processor 520 executes the program stored in the memory 510, the processor 520 is used to execute the above-mentioned permission management system construction method.

[0122] The processor 520 and memory 510 can be connected via a bus or other means.

[0123] The memory 510, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the permission management system construction method described in any embodiment of the present invention. The processor 520 implements the above-described permission management system construction method by running the non-transitory software program and instructions stored in the memory 510.

[0124] The memory 510 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store the permission management system construction method described above. Furthermore, the memory 510 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 510 may optionally include memory remotely located relative to the processor 520, and these remote memories can be connected to the processor 520 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0125] The non-transitory software programs and instructions required to implement the above-described permission management system construction method are stored in the memory 510. When executed by one or more processors 520, the permission management system construction method provided in any embodiment of the present invention is executed.

[0126] This application also provides a computer-readable storage medium storing computer-executable instructions for executing the above-described permission management system construction method.

[0127] In one embodiment, the storage medium stores computer-executable instructions that are executed by one or more control processors 520, such as one processor 520 in the computer device 500, which can cause the one or more processors 520 to execute the permission management system construction method provided in any embodiment of the present invention.

[0128] The embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0129] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0130] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0131] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically include computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0132] The foregoing detailed description of preferred embodiments of the present invention is not limited to the above-described embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method for constructing a permission management system, characterized in that, The method includes: Acquire multiple domain events related to business needs, and extract domain terms and event commands from each of the domain events; According to preset permission configuration rules, domain events associated with permissions are selected from multiple domain events to form an event map; wherein, the event map includes subject name, input, event command and domain event, and the event map is used to reflect the executing subject of the event, the domain event and the direction of data flow; The event map is used to obtain multiple keywords corresponding to the access control system, including: extracting resource keywords, action keywords, and permission keywords corresponding to the access control system based on the event map, wherein the resource keywords include menus, buttons, files, and data objects; the action keywords include add, delete, modify, query, upload, and download operations; and the permission keywords include user permissions and data permissions; and constructing each keyword corresponding to the access control system based on the resource keywords, action keywords, and permission keywords. Based on the permission configuration rules and multiple keywords, the domain vocabulary is divided into business categories to obtain the various business boundaries of the permission management system. This includes: calculating the association between each keyword and each domain vocabulary based on a word vector algorithm to obtain the association degree; sorting the association degrees; and, based on the sorting results, assigning a preset number of domain vocabulary with strong association with the keyword to the same business boundary. Based on each of the aforementioned business boundaries, multiple permission control units corresponding to the permission management system are constructed; wherein, constructing multiple permission control units corresponding to the permission management system includes: forming a permission control unit corresponding to a permission center by combining the business boundaries corresponding to resources and the business boundaries corresponding to actions; forming a permission control unit by combining the business boundaries corresponding to user identity recognition in user permissions; and forming a permission control unit by combining the business boundaries corresponding to permission authorization. Determining a domain model based on the boundary information of each business boundary and multiple permission control units includes: determining user permissions and data permissions based on the permission configuration rules; controlling action keywords and resource keywords based on the user permissions and data permissions to obtain the combination relationship of the action keywords and resource keywords; determining the entity association relationship between each domain term in the business boundary based on the combination relationship; determining the calling relationship between each permission control unit based on the entity association relationship; and determining the domain model based on the multiple permission control units and the calling relationship between each permission control unit. Based on the domain model and each of the event commands, interface code corresponding to each of the permission control units is generated.

2. The method according to claim 1, characterized in that, The step of generating interface code corresponding to each permission control unit based on the domain model and each of the event commands includes: Based on the domain model, create service interfaces corresponding to each event command, and generate interface documentation for each service interface. Based on the interface documentation, generate the interface code corresponding to each of the permission control units.

3. The method according to claim 1, characterized in that, The step of determining the user permissions and the data permissions based on the permission configuration rules includes: According to the permission configuration rules, the permissions of each preset user role are identified to obtain the identification results corresponding to each user role; The user permissions and data permissions for each user role are determined based on the identification results.

4. A device for constructing a permission management system, characterized in that, include: The data acquisition module is used to acquire events from various domains required by the business, and extract domain terms and event commands from each of the events. The data processing module is used to select the domain events associated with the permissions from each of the domain events according to the preset permission configuration and preset permission authentication, and form an event map; wherein, the event map includes the subject name, input, event command and domain event, and the event map is used to reflect the executing subject of the event, the domain event and the direction of data flow; The vocabulary generation module is used to determine the keywords corresponding to the permission management system based on the event map, including: extracting resource keywords, action keywords, and permission keywords corresponding to the permission management system based on the event map, wherein the resource keywords include menus, buttons, files, and data objects; the action keywords include add, delete, modify, query, upload, and download operations; and the permission keywords include user permissions and data permissions; and constructing the keywords corresponding to the permission management system based on the resource keywords, action keywords, and permission keywords. The segmentation module is used to perform business segmentation of the domain vocabulary according to the permission configuration and each keyword, and to determine the business boundary of the permission management system. The module includes: calculating the association relationship between each keyword and each domain vocabulary based on a word vector algorithm to obtain the association degree; sorting the association degree; and, according to the sorting result, dividing a preset number of domain vocabulary with strong association relationship with the keyword into the same business boundary. The permission control generation module is used to construct multiple permission control units corresponding to the permission management system based on each of the aforementioned business boundaries; wherein, constructing multiple permission control units corresponding to the permission management system includes: forming a permission control unit corresponding to a permission center by combining the business boundaries corresponding to resources and the business boundaries corresponding to actions; forming a permission control unit by combining the business boundaries corresponding to user identity recognition in user permissions; and forming a permission control unit by combining the business boundaries corresponding to permission authorization. A model building module is used to determine a domain model based on the boundary information of each of the business boundaries and multiple permission control units, including: determining user permissions and data permissions based on the permission configuration rules; controlling action keywords and resource keywords according to the user permissions and data permissions to obtain the combination relationship of the action keywords and resource keywords; determining the entity association relationship between each of the domain terms of the business boundaries according to the combination relationship; determining the calling relationship between each of the permission control units according to the entity association relationship; and determining the domain model according to the multiple permission control units and the calling relationship between each of the permission control units. The code generation module is used to generate interface code corresponding to each of the permission control units based on the domain model and each of the event commands.

5. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing computer-readable instructions that, when executed by one or more of the processors, cause the one or more processors to perform the steps of the method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The storage medium is readable and writable by a processor, and the storage medium stores computer instructions that, when executed by one or more processors, cause one or more processors to perform the steps of the method as described in any one of claims 1 to 3.

Images