A method, system and storage medium for managing system internal interface rights

Abstract

The present invention provides a method, system and storage medium for managing the internal interface rights of a system, including: traversing the methods modified by custom annotations when the platform service is started, obtaining the custom annotation objects including the interface name, interface code and several tenants; scanning and obtaining the class information corresponding to the annotation-modified methods, registering the interface access address, interface request mode, service name to which the interface belongs, interface name and interface code together in the database table of the corresponding tenant; writing the interface code together with the enabled / disabled interface identifier configured by the user end and the actual access whitelist configured by the IP address into the interface configuration table of the corresponding tenant; when the interface is called, obtaining the interface configuration information of the corresponding tenant from the interface configuration table, and intercepting / releasing the execution of the interface according to whether it is enabled, the IP address whitelist and the upper limit of the number of calls per unit time included in the interface configuration information. The interface access rights management and the expansion and reference of custom functions are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of computer technology, and in particular to a method, system and storage medium for managing system internal interface authority. Background Art

[0002] Traditional service interfaces implement permission control and access control in the code, execute interface service logic when conditions are met, and return interface results.

[0003] The specific operation process includes first obtaining the enabled state of the interface through the method (or interface) of whether to enable. If not enabled, return not enabled. If enabled, proceed to the next step to determine whether it is in the IP whitelist. Obtain the IP whitelist through the method (or interface) of whether the IP whitelist is in the IP whitelist. If it is not in the IP whitelist, return IP restriction. If it is in the IP whitelist, proceed to the next step to determine whether the number of calls per unit time is met. Obtain whether the number of calls per unit time reaches the upper limit through the method (or interface) of whether the number of calls per unit time is met. If yes, return the number of calls reaching the upper limit. If it does not reach the limit, finally execute the interface service logic and return the interface call result. There are some significant problems: 1. The service interface cannot be automatically detected and discovered, and needs to be manually added and maintained; 2. It does not support multi-tenant and multi-application scenarios; 3. It does not support custom function extension references. Summary of the invention

[0004] In order to solve the technical problems mentioned in the above background technology, the present invention proposes a method for managing system internal interface permissions to solve the above technical problems.

[0005] According to one aspect of the present invention, a method for managing system internal interface permissions is provided, comprising:

[0006] S1. When the platform service is started, traverse the method modified by the custom annotation to obtain the custom annotation object, which includes the interface name, interface code and several tenants;

[0007] S2. Scan and obtain the class information corresponding to the method modified by the custom annotation, and register the class information together with the interface name and the interface code in the database table of the corresponding tenant, wherein the class information includes the interface access address, the interface request method and the name of the service to which the interface belongs;

[0008] S3, writing the interface code together with the enable / disable interface identifier configured by the user end and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant;

[0009] S4. When the designated interface is called, the interface configuration information of the corresponding tenant is obtained from the interface configuration table, and the execution of the interface is intercepted / released according to whether it is enabled, the IP address whitelist, and the upper limit of the number of calls per unit time included in the interface configuration information.

[0010] Through the above technical solution, specific annotations are used in the code development process to describe the corresponding information and annotate it on the interface method; when the system starts, the code program will automatically scan the name, path, request type and other related information corresponding to the interface according to the annotated annotations, and register them in the internal interface information table; the corresponding interface management page provides the function of enabling and disabling the interface, and can configure the actual access whitelist and blacklist according to the IP address, complete the permission management of interface access, and realize the expansion and reference of custom functions. Realize the standardization of platform technology.

[0011] In some specific embodiments, step S1 includes obtaining the project configuration path and scanning @RestController and @Controller annotations. These two annotations are used to mark a class as a controller class, so that the Spring container can automatically identify and manage these controller classes.

[0012] In some specific embodiments, the custom annotation object in step S1 also includes the interface creator. By storing the interface creator, subsequent personnel can maintain the interface more easily.

[0013] In some specific embodiments, step S2 includes enhancing the method modified by the custom annotation based on AOP. Using AOP technology to enhance the method of the custom annotation can realize dynamically adding or modifying functions for a specific method without modifying the source code.

[0014] In some specific embodiments, step S3 includes obtaining a workflow newly added by the user after approval, and writing the specified interface configuration information of the workflow configuration into the interface configuration table of the corresponding tenant. Through workflow approval and addition, the configuration information is adjusted and persisted through the interface management interface to achieve custom function extension and reference.

[0015] In some specific embodiments, step S4 includes:

[0016] S41. When the interface configuration information of the corresponding tenant is empty, allowing the execution of the interface;

[0017] S42, obtaining the enable / disable interface identifier, determining whether the interface is enabled according to the enable / disable interface identifier, intercepting the execution of the interface if it is disabled, and determining whether the IP address of the requesting client is in the actual access whitelist if it is enabled, and intercepting the execution of the interface if it is not in the actual access whitelist;

[0018] S43. If the client is in the actual access whitelist, determine whether the number of times the client requests to call the interface reaches the upper limit of the number of calls per unit time. If the upper limit is reached, intercept the execution of the interface; if the upper limit is not reached, release the execution of the interface.

[0019] In some specific embodiments, the acquisition of the IP address of the requesting client in step S42 includes: acquiring a specified field in the HTTP request header information, and assigning the value of the specified field in the HTTP request header information to an IP variable; determining in turn whether the IP variable is assigned a value, and if not, assigning a value to a pre-acquired field, the pre-acquired field including a specified field added by a request processed by a proxy plug-in based on WebLogic Server, a specified field added when the proxy is based on Apache HTTP server, a client IP field added by the proxy server, and an HTTP extension header field added by the proxy server; determining whether the IP variable is the local default IP address of IPv4 or IPv6, and taking the local configured IP as the IP address of the requesting client according to the network card; wherein, if the IP field is a set of several IPs, take the first IP in the set as the IP address of the requesting client.

[0020] In some specific embodiments, step S43 includes: concatenating the IP address of the requesting client and the specified URI into a string as the key of the Redis database; adding 1 to the value corresponding to the key to indicate the arrival of a new request; judging whether the value corresponding to the key is 1, and if the value corresponding to the key is 1, setting an expiration time; judging whether the value corresponding to the key exceeds the preset limit, and if so, intercepting the execution of the interface, and if not, allowing the execution of the interface. Because the number of requests is time-sensitive, the string concatenated from IP and URI is stored in Redis as the key, and the expiration time is set when the corresponding value of the key is 1, that is, the number of requests is 1, to save memory space. In this way, the number of interface requests is limited to avoid excessive requests hindering interface calls.

[0021] According to a second aspect of the present invention, a system for managing system internal interface permissions is provided, the system comprising:

[0022] A traversal module is configured to traverse the method modified by the custom annotation when the platform service is started, and obtain the custom annotation object, wherein the custom annotation object includes an interface name, an interface code, and a number of tenants;

[0023] A storage module is configured to scan and obtain class information corresponding to the method modified by the custom annotation, and register the class information together with the interface name and the interface code in a database table of the corresponding tenant, wherein the class information includes an interface access address, an interface request method, and a name of a service to which the interface belongs;

[0024] A configuration module configured to write the interface code, the enable / disable interface identifier configured by the user end, and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant;

[0025] The interception / release module is configured to obtain the interface configuration information of the corresponding tenant from the interface configuration table when the specified interface is called, and intercept / release the execution of the interface according to whether it is enabled, the IP address whitelist and the upper limit of the number of calls per unit time included in the interface configuration information.

[0026] According to a third aspect of the present invention, a computer-readable storage medium is provided, on which one or more computer programs are stored. When the one or more computer programs are executed by a computer processor, any of the above methods is implemented.

[0027] The present invention proposes a method, system and storage medium for system internal interface authority management, and the technical effects thereof are:

[0028] During the code development process, specific annotations encapsulated within the system are used to describe the corresponding information and annotate them on the interface methods. When the system starts, the code program will automatically scan the name, path, request type and other related information corresponding to the interface according to the annotated annotations, and register them in the internal interface information table. The corresponding interface management page provides the function of enabling and disabling the interface, and can configure the actual access whitelist and blacklist according to the IP address, complete the permission management of interface access, and implement custom function expansion and reference. Realize platform technology standardization. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and together with the description are used to explain the principles of the present invention. Other embodiments and many expected advantages of the embodiments will be readily appreciated as they become better understood by reference to the following detailed description. Other features, objects and advantages of the present application will become more apparent by reading the detailed description of the non-limiting embodiments made with reference to the following drawings:

[0030] Figure 1 It is a flowchart of a method for managing system internal interface permissions in one embodiment of the present application;

[0031] Figure 2is a schematic diagram of an annotation-modified interface of an embodiment of the present application;

[0032] Figure 3 is a schematic diagram of an interface configuration table of an embodiment of the present application;

[0033] Figure 4 is a schematic diagram of an interface management interface of an embodiment of the present application;

[0034] Figure 5 It is a schematic diagram of an interface management interface configuration workflow of an embodiment of the present application;

[0035] Figure 6 is a schematic diagram of a workflow variable configuration interface of an embodiment of the present application;

[0036] Figure 7 is a schematic diagram of a workflow custom approval interface of an embodiment of the present application;

[0037] Figure 8 This is a schematic diagram of an interface detection and discovery interface of an embodiment of the present application;

[0038] Fig. 9 It is a schematic diagram of a system internal interface permission system of an embodiment of the present application;

[0039] Fig.10 It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0040] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0041] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0042] According to a method for managing system internal interface permissions in an embodiment of the present application, Figure 1 FIG. 1 is a flowchart of a method for managing system internal interface permissions in an embodiment of the present application. Figure 1 As shown, the method includes:

[0043] S1. When the platform service is started, traverse the method modified by the custom annotation to obtain the custom annotation object, which includes the interface name, interface code and several tenants;

[0044] Specifically, S1 includes the following steps:

[0045] S101, program start;

[0046] S102. Get the project configuration path and scan @RestController and @Controller annotations. These two annotations are used to mark a class as a controller class, so that the Spring container can automatically identify and manage these controller classes.

[0047] S103. When the platform service is started, traverse the method modified by the custom annotation @ExposedInterface to obtain the custom annotation object, where the custom annotation object includes the interface name, interface code, and a number of tenants;

[0048] It should be noted that projects that apply the custom annotation @ExposedInterface need to configure "server.servlet.context-path" in the springboot configuration file "application.properties". This value is the access path of the project and can also be used as a mark to distinguish service modules. For example, it is configured as "server.servlet.context-path= / zjark-web-core".

[0049] As an example, modify the "queryBySql" interface with @ExposedInterface. Figure 2 As shown in the figure, set the values ​​of the "name", "code" and "tenants" attributes after @ExposedInterface so that the corresponding attributes of the annotation can be scanned when the platform service starts to obtain the data included in the custom annotation object; "name" represents the name of the interface, "code" represents the interface code (uniqueness), and "tenants" represents the tenants who own the interface. When the project starts, the interface information will be written into the database of the corresponding tenant. Note: You can configure one tenant or multiple tenants (separated by commas).

[0050] Specifically, the custom annotation object in step S103 also includes the interface creator. By storing the interface creator, it is convenient for subsequent personnel to maintain the interface. The interface creator is a "creator" field, which is used to represent the creator field in the corresponding table of the interface creator, and the default value is admin.

[0051] S2. Realize automatic detection and discovery of the service interface, scan and obtain the class information corresponding to the method modified by the custom annotation (such as @ExposedInterface), register the class information together with the interface name and the interface code in the database table of the corresponding tenant, the class information includes the interface access address, interface request method and the name of the service to which the interface belongs; and update the configuration time.

[0052] Specifically, step S2 includes enhancing the method modified by the custom annotation based on AOP. Using AOP technology to enhance the method of the custom annotation can realize dynamically adding or modifying functions for a specific method without modifying the source code.

[0053] S3, write the interface code, the enable / disable interface identifier configured by the user end, and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant; the interface configuration table is as follows Figure 3 As shown, interface_name corresponds to the name attribute in the annotation; interface_code corresponds to the code attribute in the annotation; interface_url is the access address of the current interface; request_type is the request method of the interface; service indicates the name of the service to which the interface belongs; creator indicates the creator, which is admin by default. The above information is automatically generated and written into the database when the project is started, and cannot be changed in subsequent operations.

[0054] Specifically, step S3 includes obtaining a workflow newly added by the user after approval, and writing the specified interface configuration information of the workflow configuration into the interface configuration table of the corresponding tenant. Figure 4 As shown, the configuration information is adjusted and persisted through the interface management interface to achieve custom function extension and reference.

[0055] Furthermore, the specified interface configuration information of the workflow configuration is configured in the following way:

[0056] like Figure 5 As shown, this step includes selecting the workflow type; passing the interface input parameters; returning a user for approval and selecting a fixed single person single signature;

[0057] like Figure 6 As shown in the figure, this step includes adding variables in the workflow editor and selecting the newly added variables as the input parameters of the custom interface;

[0058] like Figure 7 As shown, this step involves configuring a custom method in the workflow custom approval.

[0059] S301. Obtain tenant information to implement multi-tenant and multi-application support. Obtain whitelist, whether enabled, and upper limit of number of calls per unit time from the internal_interface_extra configuration table according to the tenant.

[0060] S4. When the designated interface is called, the interface configuration information of the corresponding tenant is obtained from the interface configuration table, and the execution of the interface is intercepted / released according to whether it is enabled, the IP address whitelist, and the upper limit of the number of calls per unit time included in the interface configuration information.

[0061] Specifically, step S4 includes:

[0062] S401. When the interface configuration information of the corresponding tenant is empty, allowing the execution of the interface;

[0063] S402, obtaining the enable / disable interface identifier, determining whether the interface is enabled according to the enable / disable interface identifier, intercepting the execution of the interface if it is disabled, and determining whether the IP address of the requesting client is in the actual access whitelist if it is enabled, and intercepting the execution of the interface if it is not in the actual access whitelist;

[0064] Among them, whether to enable can be defined as a true or false field. When the user edits the "Whether to enable" attribute to "yes", the interface can be called normally; when it is configured to "no", the interface cannot be called.

[0065] Specifically, the acquisition of the IP address of the requesting client in step S402 includes: acquiring the specified field in the HTTP request header information, assigning the value of the specified field in the HTTP request header information to the IP variable; determining in turn whether the IP variable is assigned a value, and if not, assigning a value to a pre-acquired field, wherein the pre-acquired field includes a specified field added by a request processed by a proxy plug-in based on WebLogic Server, a specified field added when the proxy is based on Apache HTTP server, a client IP field added by the proxy server, and an HTTP extension header field added by the proxy server; determining whether the IP variable is the local default IP address of IPv4 or IPv6, and taking the local configured IP as the IP address of the requesting client according to the network card; wherein, if the IP field is a set of several IPs, taking the first IP in the set as the IP address of the requesting client. By acquiring the specified field in the HTTP request header information to acquire the requested IP, it acquires IP addresses in multiple situations, thereby avoiding the problem of failure in acquiring the requested IP.

[0066] S403: If the client is in the actual access whitelist, determine whether the number of times the client requests to call the interface reaches the upper limit of the number of calls per unit time. If the upper limit is reached, intercept the execution of the interface; if the upper limit is not reached, release the execution of the interface.

[0067] Specifically, step S403 includes: concatenating the IP address of the requesting client and the specified URI into a string as the key of the Redis database; adding 1 to the value corresponding to the key to indicate the arrival of a new request; judging whether the value corresponding to the key is 1, and if so, setting an expiration time; judging whether the value corresponding to the key exceeds the preset limit, and if so, intercepting the execution of the interface, and if not, allowing the execution of the interface. Because the number of requests is time-sensitive, the string concatenated from IP and URI is stored in Redis as the key, and the expiration time is set when the corresponding value of the key is 1, that is, the number of requests is 1, to save memory space. In this way, the number of interface requests is limited to avoid excessive requests hindering interface calls.

[0068] Optionally, this application method also supports users to upload documents corresponding to the interface and download the uploaded documents. When uploading for the second time, the last uploaded document is overwritten, such as Figure 8 As shown, through the method of the present application, the interface name, interface path, request type, interface type, service, whether enabled and file name can be automatically detected, and it also includes upload and download buttons, which are used to upload or download interface documents.

[0069] Through the above method, it is possible to use specific annotations encapsulated within the system during the code development process to describe the corresponding information and annotate it on the interface method; when the system starts, the code program will automatically scan the name, path, request type and other related information corresponding to the interface according to the annotated annotations, and register them in the internal interface information table; the corresponding interface management page provides the function of enabling and disabling the interface, and can configure the whitelist and blacklist of actual access according to the IP address, complete the permission management of interface access, and implement custom function extension and reference to achieve platform technology standardization.

[0070] Reference below Fig. 9 , Fig. 9 is a schematic diagram of a system internal interface permission system of an embodiment of the present application, such as Fig. 9As shown, the system includes a traversal module 901, which is configured to traverse the method modified by the custom annotation when the platform service is started, and obtain the custom annotation object, wherein the custom annotation object includes an interface name, an interface code and a number of tenants; a storage module 902, which is configured to scan and obtain the class information corresponding to the method modified by the custom annotation, and register the class information together with the interface name and the interface code in the database table of the corresponding tenant, wherein the class information includes the interface access address, the interface request method and the name of the service to which the interface belongs; a configuration module 903, which is configured to write the interface code together with the enable / disable interface identifier configured by the user end and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant; an interception / release module 904, which is configured to obtain the interface configuration information of the corresponding tenant from the interface configuration table when the specified interface is called, and intercept / release the execution of the interface according to whether it is enabled, the IP address whitelist and the upper limit of the number of calls per unit time included in the interface configuration information.

[0071] Reference below Fig.10 , which shows a schematic diagram of the structure of a computer system 1000 suitable for implementing an electronic device of an embodiment of the present application. Fig.10 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0072] like Fig.10 As shown, the computer system 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the system 1000 are also stored. The CPU 1001, the ROM 1002, and the RAM 1003 are connected to each other through a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0073] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage section 1008 as needed.

[0074] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the central processing unit (CPU) 1001, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable storage medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, an apparatus, or a device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, an apparatus, or a device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.

[0075] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0076] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0077] The modules involved in the embodiments of the present application may be implemented by software or by hardware.

[0078] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or it may exist alone and not be assembled into the electronic device. The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed by the electronic device, the electronic device: traverses the method modified by the custom annotation when the platform service is started, obtains the custom annotation object, and the custom annotation object includes the interface name, interface code and several tenants; scans and obtains the class information corresponding to the method modified by the custom annotation, and registers the class information together with the interface name and the interface code in the database table of the corresponding tenant, and the class information includes the interface access address, interface request method and the name of the service to which the interface belongs; writes the interface code together with the enable / disable interface identifier configured by the user end and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant; when the specified interface is called, the interface configuration information of the corresponding tenant is obtained from the interface configuration table, and the execution of the interface is intercepted / released according to whether it is enabled, the IP address whitelist and the upper limit of the number of calls per unit time included in the interface configuration information.

[0079] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for managing system internal interface permissions, characterized in that: include: S1. When the platform service is started, traverse the method modified by the custom annotation to obtain the custom annotation object, which includes the interface name, interface code and several tenants; S2. Scan and obtain the class information corresponding to the method modified by the custom annotation, and register the class information together with the interface name and the interface code in the database table of the corresponding tenant, wherein the class information includes the interface access address, the interface request method and the name of the service to which the interface belongs; S3, writing the interface code together with the enable / disable interface identifier configured by the user end and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant; obtaining the workflow newly added by the user after approval, and writing the specified interface configuration information of the workflow configuration into the interface configuration table of the corresponding tenant, including adding variables in the workflow editor, selecting the newly added variables as the input parameters of the custom interface, and configuring the custom method in the workflow custom approval; S4. When the designated interface is called, the interface configuration information of the corresponding tenant is obtained from the interface configuration table, and the execution of the interface is intercepted / released according to whether it is enabled, the IP address whitelist, and the upper limit of the number of calls per unit time included in the interface configuration information.

2. A method for managing system internal interface rights according to claim 1, characterized in that: Step S1 includes obtaining the project configuration path and scanning @RestController and @Controller annotations.

3. A method for managing system internal interface rights according to claim 1, characterized in that: The custom annotation object in step S1 also includes the interface creator.

4. A method for managing system internal interface rights according to claim 1, characterized in that: Step S2 includes enhancing the method modified by the custom annotation based on AOP.

5. A method for managing system internal interface rights according to claim 1, characterized in that: Step S4 includes: S41. When the interface configuration information of the corresponding tenant is empty, allowing the execution of the interface; S42, obtaining the enable / disable interface identifier, determining whether the interface is enabled according to the enable / disable interface identifier, intercepting the execution of the interface if it is disabled, and determining whether the IP address of the requesting client is in the actual access whitelist if it is enabled, and intercepting the execution of the interface if it is not in the actual access whitelist; S43. If the client is in the actual access whitelist, determine whether the number of times the client requests to call the interface reaches the upper limit of the number of calls per unit time. If the upper limit is reached, intercept the execution of the interface; if the upper limit is not reached, release the execution of the interface.

6. A method for managing system internal interface rights according to claim 5, characterized in that: In step S42, obtaining the IP address of the requesting client includes: obtaining a specified field in the HTTP request header information, and assigning the value of the specified field in the HTTP request header information to an IP variable; determining in turn whether the IP variable is assigned a value, and if not, assigning a value to a pre-acquired field, wherein the pre-acquired field includes a specified field added by a request processed by a proxy plug-in based on WebLogic Server, a specified field added when the proxy is based on Apache HTTP server, a client IP field added by the proxy server, and an HTTP extension header field added by the proxy server; determining whether the IP variable is the local default IP address of IPv4 or IPv6, and taking the IP configured on the local machine as the IP address of the requesting client according to the network card; wherein, if the IP field is a set of several IPs, taking the first IP in the set as the IP address of the requesting client.

7. A method for managing system internal interface rights according to claim 6, characterized in that: Step S43 includes: concatenating the IP address of the requesting client and the specified URI into a string as the key of the Redis database; adding 1 to the value corresponding to the key to indicate the arrival of a new request; judging whether the value corresponding to the key is 1, and if so, setting an expiration time; judging whether the value corresponding to the key exceeds a preset limit, and if so, intercepting the execution of the interface, and if not, allowing the execution of the interface.

8. A system for managing system internal interface rights, characterized in that: The system comprises: A traversal module is configured to traverse the method modified by the custom annotation when the platform service is started, and obtain the custom annotation object, wherein the custom annotation object includes an interface name, an interface code, and a number of tenants; A storage module is configured to scan and obtain class information corresponding to the method modified by the custom annotation, and register the class information together with the interface name and the interface code in a database table of the corresponding tenant, wherein the class information includes an interface access address, an interface request method, and a name of a service to which the interface belongs; The configuration module is configured to write the interface code together with the enable / disable interface identifier configured by the user end and the actual access whitelist configured according to the IP address into the interface configuration table of the corresponding tenant; obtain the workflow newly added by the user after approval, and write the specified interface configuration information of the workflow configuration into the interface configuration table of the corresponding tenant, including adding variables in the workflow editor, selecting the newly added variables as the input parameters of the custom interface, and configuring the custom method in the workflow custom approval; The interception / release module is configured to obtain the interface configuration information of the corresponding tenant from the interface configuration table when the specified interface is called, and intercept / release the execution of the interface according to whether it is enabled, the IP address whitelist and the upper limit of the number of calls per unit time included in the interface configuration information.

9. A computer-readable storage medium having one or more computer programs stored thereon, characterized in that: When the one or more computer programs are executed by a computer processor, the method according to any one of claims 1 to 7 is implemented.

Images