Data query method and device, electronic equipment and storage medium
By obtaining and updating the object identification information and permissions information in the data query request, the data access in the multi -tenant architecture is solved, and the efficient and flexible data query has been realized, and the data security risk is reduced.
Patent Information
- Application Number
- CN202411268754.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-11
- Publication Date
- 2025-01-21
AI Technical Summary
In a multi-tenant architecture, it is difficult for the existing technology to achieve fine control of data access, resulting in low data query efficiency and flexibility, and prone to data overpricing or leakage.
By obtaining the original query statement of the object identification information and data query requests of the target object, the permissions information of the target object object object is query the target information based on the object identification information, and the original query statement is updated according to the authority information to form a target query statement, and finally query data based on the target query statement.
The fine control of data access is realized, the efficiency and flexibility of data query is improved, and the risk of data overlap or leakage is reduced.
Smart Images
Figure CN119336779A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of computer technology, and in particular to a data query method, device, electronic device and storage medium. Background Art
[0002] With the continuous evolution of the digital age, multi-tenant architecture is becoming more and more widely used in enterprises. How to finely control the data access of different tenants and improve the efficiency of data query has also become the focus of multi-tenant data access.
[0003] In the related art, for each request, the role permissions are often parsed separately, and the permissions are judged, and then the query statements are assembled to perform data query operations. However, in the related art, in scenarios with complex business and many request categories, the workload of development or modification is huge. When certain scenarios are omitted, data unauthorized access or leakage will occur. In addition, the control granularity of permissions for a certain page or function is not enough, resulting in the inability to achieve fine control of data access. The efficiency and flexibility of data query are both low, which in turn leads to problems such as data unauthorized access or leakage. Summary of the invention
[0004] The present disclosure provides a data query method, device, electronic device and storage medium to at least solve the problems that the related technologies cannot achieve fine control of data access, the efficiency and flexibility of data query are low, and thus also lead to problems such as data unauthorized access or leakage. The technical solution of the present disclosure is as follows:
[0005] According to a first aspect of an embodiment of the present disclosure, a data query method is provided, including:
[0006] In response to a data query request of a target object for a target service, obtaining object identification information of the target object and an original query statement corresponding to the data query request;
[0007] Based on the object identification information, querying target object permission information corresponding to the target object; the target object permission information indicates the data access permission of the target object under the target service;
[0008] Based on the target object permission information, the original query statement is updated to obtain a target query statement;
[0009] According to the target query statement, the data requested by the data query request is queried.
[0010] In an optional embodiment, querying the target object permission information corresponding to the target object based on the object identification information includes:
[0011] Determining the object type corresponding to the target object according to the object identification information;
[0012] Based on the object type, the target object permission information is determined.
[0013] In an optional embodiment, determining the target object permission information based on the object type includes:
[0014] When the object type is a department type, obtaining authority structure information of the organization to which the target object belongs;
[0015] Acquire, from the authority architecture information, sub-object identification information of a sub-object belonging to the target object and first organization identification information of an organization to which the target object belongs;
[0016] The target object permission information is determined based on the child object identification information and the first organization identification information.
[0017] In an optional embodiment, determining the target object permission information based on the object type includes:
[0018] When the object type is a personal type, acquiring second organization identification information of the organization to which the target object belongs based on the object identification information;
[0019] The target object authority information is determined based on the object identification information and the second organization identification information.
[0020] In an optional embodiment, determining the target object permission information based on the object type includes:
[0021] When the object type is an organization type, the target object authority information is determined based on the object identification information.
[0022] In an optional embodiment, the updating the original query statement based on the target object permission information to obtain the target query statement includes:
[0023] Constructing a permission query statement based on the target object permission information;
[0024] The permission query statement and the original query statement are assembled to obtain the target query statement.
[0025] In an optional embodiment, the method further includes:
[0026] In response to a permission modification request for the target object, the permission modification request includes permission modification information; the permission modification information is the modification content of the data permission of the target object under the target service;
[0027] Based on the permission modification information, the permission information is modified to obtain modified permission information.
[0028] According to a second aspect of an embodiment of the present disclosure, there is provided a data query device, including:
[0029] An acquisition module, configured to respond to a data query request of a target object for a target service and acquire object identification information of the target object and an original query statement corresponding to the data query request;
[0030] A first query module is used to query the target object permission information corresponding to the target object based on the object identification information; the target object permission information indicates the data access permission of the target object under the target service;
[0031] An updating module, configured to update the original query statement based on the target object permission information to obtain a target query statement;
[0032] The second query module is used to query the data requested by the data query request according to the target query statement.
[0033] In an optional embodiment, the first query module includes:
[0034] An object type determination unit, configured to determine the object type corresponding to the target object according to the object identification information;
[0035] The target permission information determining unit is used to determine the target object permission information based on the object type.
[0036] In an optional embodiment, the target authority information determination unit includes:
[0037] A first acquisition subunit is used to acquire the authority structure information of the organization to which the target object belongs when the object type is a department type;
[0038] A second acquisition subunit is used to acquire, from the authority architecture information, sub-object identification information of a sub-object belonging to the target object and first organization identification information of an organization to which the target object belongs;
[0039] The first determining subunit is configured to determine the target object permission information based on the sub-object identification information and the first organization identification information.
[0040] In an optional embodiment, the target authority information determination unit includes:
[0041] A third acquisition subunit is configured to acquire, when the object type is an individual type, second organization identification information of the organization to which the target object belongs based on the object identification information;
[0042] The second determining subunit is configured to determine the target object permission information based on the object identification information and the second organization identification information.
[0043] In an optional embodiment, the target authority information determination unit includes:
[0044] The third determining subunit is configured to determine the target object permission information based on the object identification information when the object type is an organization type.
[0045] In an optional embodiment, the update module includes:
[0046] A construction unit, configured to construct a permission query statement based on the target object permission information;
[0047] An assembling unit is used to assemble the permission query statement and the original query statement to obtain the target query statement.
[0048] In an optional embodiment, the device further comprises:
[0049] A permission modification information acquisition module, used to obtain permission modification information in response to a permission modification request for the target object; the permission modification information is the modification content of the data permission of the target object under the target service;
[0050] The modification module is used to modify the target object permission information based on the permission modification information to obtain modified target object permission information.
[0051] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is used to execute the instructions to implement a method as described in any one of the above-mentioned first aspects.
[0052] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any method described in the first aspect of the embodiment of the present disclosure.
[0053] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:
[0054] In response to a data query request from a target object to a target service, the object identification information of the target object and the original query statement corresponding to the data query request are obtained, and based on the object identification information, the target object permission information corresponding to the target object is queried, so that fine control of permissions can be achieved, and based on the target object permission information, the original query statement is updated to obtain a target query statement, and the target query statement can be reassembled based on the target object permission information, and the data requested by the data query request is queried according to the target query statement, which can improve the efficiency and flexibility of data query on the basis of achieving fine control of permissions, thereby reducing problems such as data unauthorized access or leakage.
[0055] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS
[0056] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.
[0057] Figure 1 is a schematic diagram of an application environment according to an exemplary embodiment;
[0058] Figure 2 is a flow chart of a data query method according to an exemplary embodiment;
[0059] Figure 3 is a flow chart showing a method of querying target object permissions according to an exemplary embodiment;
[0060] Figure 4 is a flowchart showing an update of an original query statement according to an exemplary embodiment;
[0061] Figure 5 is a flow chart showing a method of modifying target object permission information according to an exemplary embodiment;
[0062] Figure 6 is a schematic diagram showing permission architecture information according to an exemplary embodiment;
[0063] Figure 7 is a data query overall flow chart shown according to an exemplary embodiment;
[0064] Figure 8 is a block diagram of a data query device according to an exemplary embodiment;
[0065] Fig. 9 It is a block diagram of an electronic device for data query according to an exemplary embodiment. DETAILED DESCRIPTION
[0066] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.
[0067] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar different contents, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the attached claims.
[0068] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.
[0069] See also Figure 1 , Figure 1 is a schematic diagram of an application environment according to an exemplary embodiment. Figure 1 As shown, the application environment may include a terminal 100 and a server 200 .
[0070] In an optional embodiment, the terminal 100 can be used to provide services such as data query to users. Specifically, the terminal 100 may include but is not limited to electronic devices such as smart phones, desktop computers, tablet computers, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, smart wearable devices, etc., and may also be software running on the above electronic devices, such as applications, etc. Optionally, the operating system running on the electronic device may include but is not limited to Android system, IOS system, Linux, Windows, etc.
[0071] In an optional embodiment, the server 200 can provide background support for the terminal 100 and perform data query. Optionally, the server 200 can provide rights management information. Accordingly, data query processing can be performed in combination with the rights management information. Specifically, the server 200 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.
[0072] In addition, it should be noted that Figure 1 What is shown is only one application environment provided by the present disclosure. In actual application, other application environments may also be included. For example, data query may also be implemented in a terminal.
[0073] In the embodiments of this specification, the terminal 100 and the server 200 may be directly or indirectly connected via wired or wireless communication, which is not limited in this disclosure.
[0074] Figure 2 is a flow chart of a data query method according to an exemplary embodiment. Figure 2 As shown, the data query method is used in electronic devices such as terminals and servers, and includes the following steps:
[0075] In step S201, in response to a data query request of a target object for a target service, object identification information of the target object and an original query statement corresponding to the data query request are obtained;
[0076] In a specific embodiment, the target object may be an object assigned one or more roles, and a role may be an abstract concept with different data permissions. For example, an object in an enterprise organization may be assigned a corresponding role, and different positions have their own corresponding data permissions. The target service may be an employee management service, an order process service, and a bank query service, etc. The data query request may be a query request from the target object for data in the target service. Specifically, when the target object is a bank customer and the target service is a bank query service, for the data query request from the target object to the target service, the target object can only access its own account data.
[0077] In a specific embodiment, the object identification information may be a combination of attribute information of the target object in different dimensions. Specifically, taking the target service as the employee management service as an example, the object identification information may include name, object type, etc. The original query data may be: select * from corp_data where, wherein corp_data represents the organizational data under the employee management service.
[0078] In step S203, based on the object identification information, the target object authority information corresponding to the target object is queried;
[0079] In a specific embodiment, the target object permission information may indicate the data access permission of the target object under the target service.
[0080] In an optional embodiment, the above method may further include: a step of querying the target object authority, such as Figure 3 As shown, the following steps may be included:
[0081] In step S301, the object type corresponding to the target object is determined according to the object identification information;
[0082] In a specific embodiment, the object type can be a personal type, a department type, and an organization type. Specifically, taking the target service as an employee management service as an example, when the object type is a department type, only the data of the employees in the department can be viewed; when the object type is a personal type, only the employee's own data can be viewed.
[0083] In step S303, target object permission information is determined based on the object type.
[0084] In a specific embodiment, taking the employee management service as an example, when the object type is a department type, specifically, the finance department, the target object permission information may be the data access permission of the finance department under the employee management service.
[0085] In the above embodiment, the data permission of the target object is determined according to the object type of the target object, so as to achieve fine control over data access and avoid data unauthorized access and leakage.
[0086] In an optional embodiment, the above-mentioned determining the target object permission information based on the object type includes:
[0087] When the object type is department type, obtain the authority structure information of the organization to which the target object belongs;
[0088] Acquire, from the authority architecture information, the sub-object identification information of the sub-object belonging to the target object and the first organization identification information of the organization to which the target object belongs;
[0089] Based on the child object identification information and the first organization identification information, target object authority information is determined.
[0090] In a specific embodiment, the authority architecture information is used to indicate the authority relationship information between objects in the organization corresponding to the target object. The organization corresponding to the target object may be the target object itself or the organization to which the target object belongs.
[0091] In a specific embodiment, the sub-object may be an object belonging to the target object, and the sub-object identification information may be the identification information of the sub-object. The two have a one-to-one mapping relationship. The first identification information may be the identification information of the organization to which the target object belongs. Specifically, assuming that the target object is department B, the organization to which the target object belongs is company A, and the target object has employee 1, employee 2, and employee 3, the sub-object identification information may be the identification information of employee 1, employee 2, and employee 3, and the first organization information may be the identification information of company A.
[0092] In a specific embodiment, Figure 6 As shown, Figure 6 It is a schematic diagram of a permission architecture information shown according to an exemplary embodiment. Taking the permission architecture information of an organization (tenant A) as an example, the organization (tenant A) data can be obtained by the tenant id of the organization (tenant A), and the organization (tenant A) data can include all user ids and data under the organization (tenant A). The id of user 1 under department B can be obtained according to the department id of department B. When the role assigned to user 1 is accountant, the permission id can be obtained according to the role id, and the functional permission (add, delete, modify, check) corresponding to the permission id can be obtained. This functional permission is the functional permission of user 1.
[0093] In the above embodiment, when the target object type is a department type, based on the authority structure information of the organization to which it belongs, the authority information of the sub-objects belonging to the target object is first obtained, and then the target object authority information is obtained, thereby achieving fine control over data access and improving the accuracy of data query.
[0094] In an optional embodiment, the above-mentioned determining the target object permission information based on the object type includes:
[0095] When the object type is a personal type, obtaining second organization identification information of the organization to which the target object belongs based on the object identification information;
[0096] Based on the object identification information and the second organization identification information, target object authority information is determined.
[0097] In a specific embodiment, the second organization identification information may be identification information of the organization to which the target object belongs.
[0098] In a specific embodiment, taking the order process service as an example, when the target object is a department and there are employee 1 and employee 2, the target object permission information can be determined as corp_id=#{corpId}, user_id=1 and user_id=2, where corp_id can represent the id of the organization to which the department belongs, user_id=1 can represent the id of employee 1, user_id=2 can represent the id of employee 2, and corpId can represent the identifier of the organization to which the department belongs.
[0099] In the above embodiment, when the object type is a personal type, the target object permission information is determined based on the object identification information and the identification information of the organization to which the target object belongs, which can improve the efficiency of data query and quickly query the data of the target object under the target service.
[0100] In an optional embodiment, the above-mentioned determining the target object permission information based on the object type includes:
[0101] When the object type is an organization type, the target object authority information is determined based on the object identification information.
[0102] In a specific embodiment, when the object type is an organization type, the target object may be a company. Optionally, when the target object is company A, based on the object identification information, the target object permission information may be determined as company A's data access rights to all employees.
[0103] In the above embodiment, when the target object is an organization, the target object permission information can be directly determined based on the object identification information, thereby improving the efficiency of data permission management.
[0104] In step S205, based on the target object authority information, the original query statement is updated to obtain a target query statement;
[0105] In a specific embodiment, the target query statement can be a data query statement for the target object for the target service. Specifically, when the object type is an organization, the target query statement can be: select * from corp_data where corp_id = #{corpId}. When the object type is a department and the department has employee 1, employee 2, and employee 3, the target query statement can be: select * from corp_data where corp_id = #{corpId} and user_id in (1, 2, 3), where user_id in (1, 2, 3) can represent the ids of employee 1, employee 2, and employee 3. When the object type is an individual (employee 1), the target query statement can be: select * from corp_data where corp_id = #{corpId} and user_id = 1.
[0106] In an optional embodiment, the above method may further include: a step of updating the original query statement, such as Figure 4 As shown, the following steps may be included:
[0107] In step S401, a permission query statement is constructed based on the target object permission information;
[0108] In a specific embodiment, the permission query statement can be a query statement in a preset format obtained based on the target object permission information. Specifically, taking the order process service as an example, when the target object is the purchasing department and the target object permission information is the data access rights to employee 1, employee 2 and employee 3, the permission query statement can be constructed as: where corp_id = #{corpId} and user_id in (1, 2, 3).
[0109] In step S403, the permission query statement and the original query statement are assembled to obtain a target query statement.
[0110] In a specific embodiment, taking the order process service as an example, when the target object is employee 1 and the target object permission information is the data access permission to employee 1, the permission query is expected to be constructed as: where corp_id=#{corpId}anduser_id=1, the original query statement can be: select*from corp_data, and the assembled target query statement can be: select*from corp_data where corp_id=#{corpId}anduser_id=1.
[0111] In the above embodiment, based on the target object permission information, the original query statement is updated, the permission control granularity is refined, the fine control of data permissions is achieved, and the accuracy of data access is improved.
[0112] In step S207, the data requested by the data query request is queried according to the target query statement.
[0113] In a specific embodiment, taking the employee management service as an example, when the target query statement is select*fromcorp_data where corp_id=#{corpId}anduser_id in(1,2,3), the data of employee 1, employee 2 and employee 3 can be queried.
[0114] In an optional embodiment, the above method may further include: a step of modifying the target object permission information, such as Figure 5 As shown, the following steps may be included:
[0115] In step S501, in response to a permission modification request for a target object, permission modification information is obtained;
[0116] In a specific embodiment, the permission modification information may be the modification content of the data permissions of the target object under the target service. Specifically, taking the employee management service as an example, when the target object is the purchasing department, and the purchasing department has data access rights to employee 1, employee 2, and employee 3, the permission modification information may be to delete the data permissions of the purchasing department to employee 3 under the employee management service.
[0117] In step S503, the target object permission information is modified based on the permission modification information to obtain modified target object permission information.
[0118] In a specific embodiment, taking the employee management service as an example, when the target object is the purchasing department and the target object authority information is that it has data access rights to employees 1, 2, and 3, the authority modification information may be to delete the purchasing department's data rights to employee 3 under the employee management service. Based on the authority modification information, the modified target object authority information is obtained as having data access rights to employees 2 and 3.
[0119] In the above embodiment, based on the permission modification information contained in the permission modification request for the target object, the permission information of the target object is modified, so as to achieve precise control of data permissions and improve the flexibility of data management and query.
[0120] It can be seen from the technical solutions provided by the above embodiments of this specification that this specification responds to the data query request of the target object for the target service, obtains the object identification information of the target object and the original query statement corresponding to the data query request, and queries the target object permission information corresponding to the target object based on the object identification information, so as to realize fine control of permissions, and based on the target object permission information, updates the original query statement to obtain the target query statement, and can realize reassembling the target query statement based on the target object permission information, and querying the data requested by the data query request according to the target query statement, which can improve the efficiency and flexibility of data query on the basis of realizing fine control of permissions, thereby reducing problems such as data unauthorized access or leakage.
[0121] Figure 7 is a flowchart of an overall data query according to an exemplary embodiment. Figure 7 As shown, in the commodity order process service, in response to the data query request 1, the control layer 1 accesses and intercepts the data query request 1, and based on the data query request 1, obtains the object identification information of the target object and the original query statement corresponding to the data query request 1, passes the object identification information and the original query statement to the business layer 1, queries the target object permission information corresponding to the target object, passes the target object permission information to the storage layer 1, and dynamically intercepts it through the permission parser and the SQL interceptor, wherein the SQL interceptor intercepts the original query statement, and updates the original query statement in combination with the result obtained by the permission parser to obtain the target query statement, and through the target query statement, queries the data requested by the data query request 1 in the database.
[0122] Figure 8 is a block diagram of a data query device according to an exemplary embodiment. Figure 8 , the device comprises:
[0123] An acquisition module 810 is used to obtain the object identification information of the target object and the original query statement corresponding to the data query request in response to the data query request of the target object for the target service;
[0124] The first query module 830 is used to query the target object permission information corresponding to the target object based on the object identification information; the target object permission information indicates the data access permission of the target object under the target service;
[0125] An updating module 850 is used to update the original query statement based on the target object authority information to obtain a target query statement;
[0126] The second query module 870 is used to query the data requested by the data query request according to the target query statement.
[0127] In an optional embodiment, the first query module 830 includes:
[0128] An object type determination unit, used to determine the object type corresponding to the target object according to the object identification information;
[0129] The target permission information determination unit is used to determine the target object permission information based on the object type.
[0130] In an optional embodiment, the target authority information determination unit includes:
[0131] The first acquisition subunit is used to acquire the authority structure information of the organization to which the target object belongs when the object type is a department type;
[0132] A second acquisition subunit is used to acquire, from the authority structure information, the sub-object identification information of the sub-object belonging to the target object and the first organization identification information of the organization to which the target object belongs;
[0133] The first determining subunit is used to determine the target object permission information based on the sub-object identification information and the first organization identification information.
[0134] In an optional embodiment, the target authority information determination unit includes:
[0135] A third acquisition subunit is used to acquire, when the object type is an individual type, second organization identification information of the organization to which the target object belongs based on the object identification information;
[0136] The second determining subunit is used to determine the target object authority information based on the object identification information and the second organization identification information.
[0137] In an optional embodiment, the target authority information determination unit includes:
[0138] The third determining subunit is used to determine the target object authority information based on the object identification information when the object type is an organization type.
[0139] In an optional embodiment, the update module 850 includes:
[0140] A construction unit, used to construct a permission query statement based on the permission information of the target object;
[0141] The assembling unit is used to assemble the permission query statement and the original query statement to obtain a target query statement.
[0142] In an optional embodiment, the above device further includes:
[0143] The permission modification information acquisition module is used to obtain permission modification information in response to a permission modification request for a target object; the permission modification information is the modification content of the data permission of the target object under the target service;
[0144] The modification module is used to modify the target object permission information based on the permission modification information to obtain the modified target object permission information.
[0145] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.
[0146] Fig. 9 is a block diagram of an electronic device for data query according to an exemplary embodiment. The electronic device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The electronic device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a data query method is implemented. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the housing of the electronic device, or an external keyboard, touchpad or mouse, etc.
[0147] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present disclosure, and does not constitute a limitation on the electronic device to which the scheme of the present disclosure is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0148] In an exemplary embodiment, an electronic device is also provided, including: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the data query method in the embodiment of the present disclosure.
[0149] In an exemplary embodiment, a computer-readable storage medium is also provided. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the data query method in the embodiment of the present disclosure.
[0150] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.
[0151] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.
Claims
1. A data query method, characterized in that: include: In response to a data query request of a target object for a target service, obtaining object identification information of the target object and an original query statement corresponding to the data query request; Based on the object identification information, query the target object permission information corresponding to the target object; The target object permission information indicates the data access permission of the target object under the target service; Based on the target object permission information, the original query statement is updated to obtain a target query statement; According to the target query statement, the data requested by the data query request is queried.
2. The data query method according to claim 1, characterized in that: The querying of the target object permission information corresponding to the target object based on the object identification information includes: Determining the object type corresponding to the target object according to the object identification information; Based on the object type, the target object permission information is determined.
3. The data query method according to claim 2, characterized in that: The determining the target object permission information based on the object type includes: When the object type is a department type, obtaining authority structure information of the organization to which the target object belongs; Acquire, from the authority architecture information, sub-object identification information of a sub-object belonging to the target object and first organization identification information of an organization to which the target object belongs; The target object permission information is determined based on the child object identification information and the first organization identification information.
4. The data query method according to claim 2, characterized in that: The determining the target object permission information based on the object type includes: When the object type is a personal type, acquiring second organization identification information of the organization to which the target object belongs based on the object identification information; The target object authority information is determined based on the object identification information and the second organization identification information.
5. The data query method according to claim 2, characterized in that: The determining the target object permission information based on the object type includes: When the object type is an organization type, the target object authority information is determined based on the object identification information.
6. The data query method according to claim 1, characterized in that: The updating of the original query statement based on the target object authority information to obtain the target query statement includes: Constructing a permission query statement based on the target object permission information; The permission query statement and the original query statement are assembled to obtain the target query statement.
7. The data query method according to claim 1, characterized in that: The method further comprises: In response to a permission modification request for the target object, obtaining permission modification information; the permission modification information is the modification content of the data permission of the target object under the target service; Based on the permission modification information, the target object permission information is modified to obtain modified target object permission information.
8. A data query device, characterized in that: The device comprises: An acquisition module, configured to respond to a data query request of a target object for a target service and acquire object identification information of the target object and an original query statement corresponding to the data query request; A first query module is used to query the target object permission information corresponding to the target object based on the object identification information; the target object permission information indicates the data access permission of the target object under the target service; An updating module, configured to update the original query statement based on the target object permission information to obtain a target query statement; The second query module is used to query the data requested by the data query request according to the target query statement.
9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the data query method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the data query method as claimed in any one of claims 1 to 7.