Dynamic data authority management system and method based on MyBatis framework

Abstract

The invention discloses a dynamic data authority management system and method based on a MyBatis framework, the system comprises an authority configuration container module and a parent class request object module, the authority configuration container module is used for storing and organizing detailed configuration related to authority, and the detailed configuration comprises attribute scope configuration and control element scope configuration; and the parent class request object module is used for providing a uniform interface and member variables and allowing the subclasses to rewrite the method according to specific business requirements. According to the invention, strong flexibility and configurability are realized by means of a MyBatis framework, the defects of a traditional data authority management system in facing complex and changeable business scenes are overcome, fine granularity division of authority control is realized, and data access authority control of any business scene can be freely combined.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing and information security, and in particular to a dynamic data authority management system and method based on a MyBatis framework. Background Art

[0002] In the current information age, with the continuous expansion of enterprise business scale and the increasing complexity of business scenarios, the requirements for data permission management are becoming higher and higher. Traditional data permission management methods often rely on hard-coded or static settings in configuration files, which are difficult to adapt to changing business needs. Once business needs change, a large amount of code or configuration files need to be modified, which is not only labor-intensive, but also easy to introduce errors, affecting the stability and security of the system.

[0003] In addition, as the business develops, the demand for permission control has become more sophisticated. It is no longer just satisfied with role-level control, but also needs to support the most fine-grained permission control at the data row level, column level, and even for people. This demand is a huge challenge for traditional permission management systems. Summary of the invention

[0004] The purpose of the present invention is to provide a dynamic data authority management system and method based on the MyBatis framework, aiming to solve the above problems. Through the dynamic configuration and the finest-grained control of data permissions, the system can easily cope with changing business scenarios and improve data security and management efficiency.

[0005] The present invention is implemented by adopting the following technical scheme: a dynamic data permission management system implemented based on the MyBatis framework, including a permission configuration container module and a parent class request object module, wherein the permission configuration container module is used to store and organize detailed configurations related to permissions, including attribute scope configuration and control element scope configuration; the parent class request object module is used to provide a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs.

[0006] Furthermore, the permission configuration container module includes an owner submodule and an owner type submodule, wherein: Owner submodule, which is used to identify the unique string or digital ID of the owner of the permission data; The owner type submodule is used to describe the type of owner ID, including personnel and roles.

[0007] Furthermore, the permission configuration container module also includes a control permission grouping submodule, a functional grouping submodule, a priority submodule and an execution SQL submodule, wherein: The control permission grouping submodule is used to define any group and use OR to connect SQL statements within the same group and AND to connect different groups; Functional grouping submodule is used to select and execute SQL statements based on priority when processing SQL statements concatenated with OR in the same group if there are multiple functional groups with the same function; The priority submodule is used to determine which SQL statement should be executed by priority when the control permission group and the functional group are the same, ensuring that only the highest priority rule is applied; The SQL execution submodule is used to execute SQL statements and store them in ciphertext to prevent the exposure of sensitive information.

[0008] Furthermore, the member variables include authority, which is of type Map<String, Object> , used to store permission-related configuration information and output results.

[0009] Furthermore, the rewriting method includes: getDynamicParam: used to return a Map<String, String> Dynamic parameters of the type, which can be filled and adjusted according to the specific situation of the request at runtime. All subclasses inherited from the parent class request object must override the getDynamicParam method; getDynamicOwners: used to return a List <string>The dynamic owner list of the type returns the user ID and the role ID owned by the user by default. When a specific request requires different owner information, the getDynamicOwners method can be selectively overridden.

[0010] Furthermore, the rewriting method further comprises: getFunc: used to return a Function <List <string>,List <authoritymanage>> type of function interface, which maps the owner list to a specific permission management instance list, and dynamically obtains and manages permission configuration according to the specific circumstances of the request; getAuthority: used to return a Map<String, Object> The member variable authority, the obtained value is assembled and returns the owner's authority. The getAuthority method refuses to be overridden by subclasses.

[0011] A dynamic data permission management method based on MyBatis framework is implemented based on the above-mentioned dynamic data permission management system based on MyBatis framework, comprising the following steps: S1: Initialization preparation; S2: initiates a request and performs XML parsing; S3: Take out the dynamic parameters and dynamic owner set, and judge the return value; S4: Determine the result based on the returned value and obtain the dynamic management permission configuration; S5: Decrypt the permission configuration set owned by the user, output the execution statement to the database, and obtain the final return result.

[0012] Furthermore, step S1 includes the following sub-steps: S11: The request object for the API interface inherits the parent request object class; S12: Rewrite the abstract methods and common methods of the parent request object class according to business requirements; S13: Add configuration items to the SQL statements in the XML configuration file of the MyBatis framework that is finally executed.

[0013] Furthermore, step S3 includes the following sub-steps: S31: Retrieve dynamic parameters and dynamic owner sets respectively; S32: Determine whether the result of retrieving the dynamic owner set is null. If it is not null, retrieve the return value as the owner's id set; if it is null, retrieve the user's primary key id and the role id owned by the user as the owner's id set.

[0014] Furthermore, step S5 includes the following sub-steps: S51: Decrypt the permission configuration set owned by the user; S52: Group the permission configuration set according to permission control groups and function groups, perform AND and OR concatenation on the final execution statements, and delete the final execution statements according to priority; S53: Replace the placeholder of the final execution statement with the extracted dynamic parameter; S54: Submit the final execution statement to the database to obtain the final return result.

[0015] The beneficial effects of the present invention are: the present invention uses the MyBatis framework to achieve powerful flexibility and configurability, solves the shortcomings of traditional data permission management systems when facing complex and changeable business scenarios, realizes fine-grained division of permission control, and can freely combine data access permission control for any business scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0017] Figure 1 Configure container workflow diagram for permissions; Figure 2 Prepare a flow chart for initialization; Figure 3 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0019] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0020] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0021] A dynamic data authority management system based on MyBatis framework includes an authority configuration container AuthorityManage and a parent class request object AuthorityRequest, wherein the authority configuration container AuthorityManage is used to store and organize detailed configurations related to authority, including attribute scope configuration and control element scope configuration; the parent class request object such as AuthorityRequest is used to provide a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs.

[0022] See also Figure 1 The authority configuration container AuthorityManage is mainly responsible for storing and organizing detailed configurations related to permissions, including attribute scope configuration and control element scope configuration. The attribute scope configuration is used to load permission rules; the control element scope configuration is used to parse permission groups and encapsulate the rules of the same control permission group into a set.

[0023] Specifically, the attribute scope configuration mainly includes two aspects: the first is the owner, which is a unique string or digital ID used to identify the owner of this permission data. The second is the owner type, which is a string used to describe the type of the owner ID, such as personnel, role, etc., to facilitate the permission management system to understand the context of the ID.

[0024] Control element scope configuration mainly includes: control permission grouping, which allows the definition of arbitrary groups, and uses OR to connect SQL statements within the same group, and AND to connect different groups. This provides flexible configuration capabilities to adapt to complex permission control scenarios. Functional grouping is similar to control permission grouping, but when processing SQL spliced ​​with OR in the same group, if there are multiple identical functional groups, the SQL statement to be executed will be selected based on priority. Priority, when the control permission group and the functional group are the same, the priority is used to determine which SQL statement should be executed to ensure that only the highest priority rule is applied. Execute SQL, which is the actual SQL statement executed. Due to security considerations, it should be stored in ciphertext to prevent the exposure of sensitive information.

[0025] In this embodiment, the parent class request abstract object AuthorityRequest is the base class of all specific request objects, providing a unified interface and member variables, allowing subclasses to override methods according to specific business requirements.

[0026] Among them, the member variable is authority, and the type is Map<String, Object> , used to store permission-related configuration information and output results.

[0027] The overridden methods include: getDynamicParam, this parameterless abstract method returns a Map<String, String> Dynamic parameters of this type. These parameters can be filled and adjusted at runtime according to the specific circumstances of the request. All subclasses inherited from AuthorityRequest must override this method.

[0028] getDynamicOwners, this normal method without parameters returns a List <string>A dynamic owner list of the type. By default, it returns the user ID and the role IDs owned by the user. If a specific request requires different owner information, you can optionally override this method.

[0029] getFunc, this normal method without parameters returns a Function <List <string>,List <authoritymanage>> type of function interface, which maps the owner list to a specific permission management instance list. By implementing this interface, permission configuration can be dynamically obtained and managed according to the specific circumstances of the request.

[0030] getAuthority, a final method with no parameters, and the return type is Map<String, Object> (that is, the member variable authority itself), which is used to assemble the values ​​obtained by the above method through a specific algorithm and return the authority of the owner. This method refuses to be overridden by subclasses.

[0031] See also Figure 3 , a dynamic data permission management method based on MyBatis framework, including the following steps: S1: Initialization preparation.

[0032] S2: The client initiates an API request to the server.

[0033] S3: The server application interface receives the client's request.

[0034] S4: Initialize the AuthorityRequest subclass object.

[0035] S5: Execute business logic code.

[0036] S6: Interact with the database, perform MyBatis-XML parsing, execute the ${authority} placeholder, and call the getAuthority method of AuthorityRequest.

[0037] S7: getDynamicParam() method retrieves dynamic parameters.

[0038] S8: The getDynamicOwners() method retrieves the dynamic owner set.

[0039] S9: Determine whether the return value of step S8 is null. If it is not null, take the return value as the owner's id set; if it is null, obtain the user's primary key id and the role id owned by the user as the owner's id set.

[0040] S10: getFunc() method obtains dynamic management permission configuration.

[0041] S11: Determine whether the return value of step S10 is null. If it is not null, use the owner set id as an input parameter to execute the getFunc() method to obtain the permission configuration set owned by the user; if it is null, use the owner set id as an input parameter to retrieve the permission configuration set owned by the user from the db level.

[0042] S12: Decrypt the permission configuration set owned by the user.

[0043] S13: The permission configuration set is concatenated with and or or for the final execution statements according to the permission control grouping and the function grouping, and the final execution statements are deleted according to the priority.

[0044] S14: Replace the placeholder of the final execution statement #{} with the extracted dynamic parameter.

[0045] S15: Submit the final execution statement to the database to obtain the final return result.

[0046] For details, see Figure 2 The specific process of initialization preparation is: inherit the AuthorityRequest class for the API interface request object, rewrite the abstract method and common method of this class according to business needs, and add the SQL statement in the XML configuration file of the MyBatis framework that is finally executed <if test="authority.available"> ${authority.sql}< / if> Configuration items.

[0047] The present invention makes full use of the flexibility of the XML configuration file in the MyBatis framework. In MyBatis, variable values ​​can be dynamically inserted through the ${} placeholder, but the variable values ​​here are not directly derived from the member variables of the object, but can be obtained through the getter method of the object. This feature makes it possible to pass the permission-related SQL fragments as parameters to the final SQL execution statement, thereby realizing dynamic control of permissions.

[0048] Based on the above embodiments, the present invention has at least the following technical effects: 1. High flexibility. (1) Definition of dynamic parameters: The getDynamicParam() method allows subclasses to dynamically generate the parameters required for permission control based on specific business scenarios. This design enables the system to flexibly respond to different permission control requirements, whether based on user roles, departments, or other complex logic, by overriding this method. (2) Flexible definition of owners: The getDynamicOwners() method provides the ability to dynamically determine the owner of the data. By default, it returns the user ID and role ID, but subclasses can override this method as needed to include other types of owner information, such as organization ID, project ID, etc. This flexibility ensures that the system can adapt to different business scenarios, where the definition of data owners may vary from scenario to scenario. (3) Customization of permission configuration function: The getFunc() method allows subclasses to define how to obtain permission configuration based on owner information. This means that different business modules can have their own permission configuration logic, such as obtaining permission information from a database, configuration file, or remote service. This design greatly improves the flexibility of the system, allowing permission control strategies to easily adapt to different business needs and changes.

[0049] 2. Strong scalability. (1) Modular design: By encapsulating the permission control logic in AuthorityRequest and its subclasses, the system implements modular design. This design allows you to focus on the implementation of related classes when adding or modifying permission control logic without modifying other business logic codes. This not only reduces the coupling of the system, but also improves the reusability and maintainability of the code. (2) Easy to integrate: Since the AuthorityRequest class and its related logic are independent of the specific business logic, they can be easily integrated into any system based on the MyBatis framework. This easy integration feature enables this technical solution to be widely used in different projects and environments. (3) Support for multiple data sources: Due to the flexibility of the getFunc() method, the system can support obtaining permission configuration information from multiple data sources. This includes but is not limited to databases, configuration files, cache systems, remote services, etc. This ability to support multiple data sources enables the system to select the most appropriate data source according to different needs and scenarios, thereby improving the scalability and flexibility of the system.

[0050] 3. Ready to use, (1) Quick deployment: Since this technical solution is based on the widely used MyBatis framework, it has the advantage of quick deployment. Developers only need to add relevant classes and configurations to the project to start using the dynamic data permission control function. This greatly reduces the difficulty and time cost of system deployment. (2) Easy to use: The design of the AuthorityRequest class and its subclasses is clear and concise, easy to understand and use, and developers only need to read a small amount of documentation or sample code to master how to define and use dynamic permission control logic.

[0051] Fourth, dynamic adaptability. The system can manage part or all of the permission control logic in the form of configuration. For example, permission rules, role definitions, data access scopes, etc. can be stored in databases, configuration files, or external services. When the business puts forward new permission requirements, the administrator or system administrator can update the permissions by modifying these configurations without modifying the code.

[0052] For the aforementioned embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily required by the present application.

[0053] The above embodiments describe the basic principles and main features of the present invention and the advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the changes and modifications made by those skilled in the art shall be within the scope of protection of the appended claims of the present invention without departing from the spirit and scope of the present invention.< / authoritymanage> < / string> < / string> < / authoritymanage> < / string> < / string>

Claims

1. A dynamic data rights management system based on MyBatis framework, characterized in that: It includes a permission configuration container module and a parent class request object module. The permission configuration container module is used to store and organize detailed configurations related to permissions, including attribute scope configuration and control element scope configuration; the parent class request object module is used to provide a unified interface and member variables, allowing subclasses to override methods according to specific business needs.

2. A dynamic data rights management system based on MyBatis framework as claimed in claim 1, characterized in that: The permission configuration container module includes an owner submodule and an owner type submodule, wherein: Owner submodule, which is used to identify the unique string or digital ID of the owner of the permission data; The owner type submodule is used to describe the type of owner ID, including personnel and roles.

3. A dynamic data rights management system based on MyBatis framework as claimed in claim 2, characterized in that: The permission configuration container module also includes a control permission grouping submodule, a functional grouping submodule, a priority submodule and an execution SQL submodule, wherein: The control permission grouping submodule is used to define any group and use OR to connect SQL statements within the same group and AND to connect different groups; Functional grouping submodule is used to select and execute SQL statements based on priority when processing SQL statements concatenated with OR in the same group if there are multiple functional groups with the same function; The priority submodule is used to determine which SQL statement should be executed by priority when the control permission group and the functional group are the same, ensuring that only the highest priority rule is applied; The SQL execution submodule is used to execute SQL statements and store them in ciphertext to prevent the exposure of sensitive information.

4. A dynamic data rights management system based on MyBatis framework as claimed in claim 3, characterized in that: The member variables include authority, of type Map<String, Object> , used to store permission-related configuration information and output results.

5. A dynamic data rights management system based on MyBatis framework as claimed in claim 4, characterized in that: The rewriting method comprises: getDynamicParam: used to return a Map<String, String> Dynamic parameters of the type, which can be filled and adjusted according to the specific situation of the request at runtime. All subclasses inherited from the parent class request object must override the getDynamicParam method; getDynamicOwners: used to return a List <string> The dynamic owner list of the type returns the user ID and the role ID owned by the user by default. When a specific request requires different owner information, the getDynamicOwners method can be selectively overridden.< / string> 6. A dynamic data rights management system based on MyBatis framework as claimed in claim 5, characterized in that: The rewriting method further comprises: getFunc: used to return a Function <List <string>,List <authoritymanage> > type of function interface, which maps the owner list to a specific permission management instance list, and dynamically obtains and manages permission configuration according to the specific circumstances of the request;< / authoritymanage> < / string> getAuthority: used to return a Map<String, Object> The member variable authority, the obtained value is assembled and returns the owner's authority. The getAuthority method refuses to be overridden by subclasses.

7. A dynamic data rights management method based on MyBatis framework, based on a dynamic data rights management system based on MyBatis framework as described in any one of claims 1 to 6, characterized in that: The steps include: S1: Initialization preparation; S2: initiates a request and performs XML parsing; S3: Take out the dynamic parameters and dynamic owner set, and judge the return value; S4: Determine the result based on the returned value and obtain the dynamic management permission configuration; S5: Decrypt the permission configuration set owned by the user, output the execution statement to the database, and obtain the final return result.

8. A dynamic data authority management method based on MyBatis framework as claimed in claim 7, characterized in that: Step S1 includes the following sub-steps: S11: The request object for the API interface inherits the parent request object class; S12: Rewrite the abstract methods and common methods of the parent request object class according to business requirements; S13: Add configuration items to the SQL statements in the XML configuration file of the MyBatis framework that is finally executed.

9. A dynamic data authority management method based on MyBatis framework as claimed in claim 8, characterized in that: Step S3 includes the following sub-steps: S31: Retrieve dynamic parameters and dynamic owner sets respectively; S32: Determine whether the result of retrieving the dynamic owner set is null. If it is not null, retrieve the return value as the owner's id set; if it is null, retrieve the user's primary key id and the role id owned by the user as the owner's id set.

10. A method for dynamic data authority management based on MyBatis framework as claimed in claim 9, characterized in that: Step S5 includes the following sub-steps: S51: Decrypt the permission configuration set owned by the user; S52: Group the permission configuration set according to permission control groups and function groups, perform AND and OR concatenation on the final execution statements, and delete the final execution statements according to priority; S53: Replace the placeholder of the final execution statement with the extracted dynamic parameter; S54: Submit the final execution statement to the database to obtain the final return result.

Images