A dynamic data rights management system and method based on MyBatis framework

Abstract

The present invention discloses a dynamic data rights management system and method based on the MyBatis framework. The system includes a rights configuration container module and a parent class request object module. The rights configuration container module is used to store and organize detailed configurations related to rights, including attribute scope configuration and control element scope configuration; the parent class request object module is used to provide a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs. The present invention uses the MyBatis framework to achieve powerful flexibility and configurability, addressing the shortcomings of traditional data rights management systems in the face of complex and changing business scenarios, achieving fine-grained division of rights control, and being able to freely combine data access rights control for any business scenario.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing and information security, and in particular to a dynamic data rights management system and method implemented based on a MyBatis framework. Background Art

[0002] In today's information age, with the continuous expansion of enterprise business scale and the increasing complexity of business scenarios, the requirements for data rights management are becoming increasingly stringent. Traditional data rights management methods often rely on static settings in hard-coded or configuration files, making them difficult to adapt to changing business needs. Once business requirements change, a large amount of code or configuration files must be modified, which is not only labor-intensive but also prone to introducing errors, affecting system stability and security.

[0003] Furthermore, as businesses evolve, the need for permission control becomes increasingly sophisticated. It's no longer sufficient to simply control permissions at the role level; it requires support for permissions at the data row and column levels, and even at the most granular level for individuals. This requirement poses a significant challenge to traditional permission management systems. Summary of the Invention

[0004] The purpose of this invention is to provide a dynamic data permissions management system and method based on the MyBatis framework, aiming to solve the above problems. Through the dynamic configuration and fine-grained control of data permissions, the system can easily cope with changing business scenarios and improve data security and management efficiency.

[0005] The present invention is implemented by adopting the following technical scheme: a dynamic data permission management system implemented based on the MyBatis framework, including a permission configuration container module and a parent class request object module, wherein the permission configuration container module is used to store and organize detailed configurations related to permissions, including attribute scope configuration and control element scope configuration; the parent class request object module is used to provide a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs.

[0006] Furthermore, the permission configuration container module includes an owner submodule and an owner type submodule, wherein:

[0007] Owner submodule, used to identify the unique string or digital ID of the owner of the permission data;

[0008] The owner type submodule is used to describe the type of owner ID, including personnel and roles.

[0009] Furthermore, the authority configuration container module also includes a control authority grouping submodule, a functional grouping submodule, a priority submodule and an execution SQL submodule, wherein,

[0010] The control permission grouping submodule is used to define any group and use OR to connect SQL statements within the same group and AND to connect different groups;

[0011] Functional grouping submodule is used to select and execute SQL statements based on priority when processing SQL statements concatenated with OR within the same group and if there are multiple identical functional groups.

[0012] The priority submodule is used to determine which SQL statement should be executed by priority when the control permission group and functional group are the same, ensuring that only the highest priority rule is applied;

[0013] The SQL execution submodule is used to execute SQL statements and store them in ciphertext to prevent the exposure of sensitive information.

[0014] Furthermore, the member variables include authority, which is of type Map<String, Object> , used to store permission-related configuration information and output results.

[0015] Furthermore, the rewriting method includes:

[0016] getDynamicParam: used to return a Map<String, String> Dynamic parameters of this type can be filled and adjusted at runtime based on the specific circumstances of the request. All subclasses that inherit from the parent request object must override the getDynamicParam method.

[0017] getDynamicOwners: used to return a List <string>The dynamic owner list of the type returns the user ID and the role IDs owned by the user by default. When a specific request requires different owner information, the getDynamicOwners method can be optionally overridden.

[0018] Furthermore, the rewriting method further includes:

[0019] getFunc: used to return a Function <List <string>,List <authoritymanage>> type of function interface, which maps the owner list to a specific permission management instance list, and dynamically obtains and manages permission configuration according to the specific circumstances of the request;

[0020] getAuthority: used to return a Map<String, Object> The member variable authority, the obtained value is assembled and returns the owner's authority. The getAuthority method refuses to be overridden by subclasses.

[0021] A dynamic data rights management method based on the MyBatis framework is implemented based on the above-mentioned dynamic data rights management system based on the MyBatis framework, comprising the following steps:

[0022] S1: Initialization preparation;

[0023] S2: initiates a request and performs XML parsing;

[0024] S3: Get the dynamic parameters and dynamic owner set, and judge the return value;

[0025] S4: Get the dynamic management permission configuration based on the return value judgment result;

[0026] S5: Decrypt the user's permission configuration set, output the execution statement to the database, and obtain the final return result.

[0027] Furthermore, step S1 includes the following sub-steps:

[0028] S11: The request object of the API interface inherits the parent request object class;

[0029] S12: Rewrite the abstract methods and common methods of the parent request object class according to business needs;

[0030] S13: Add configuration items to the SQL statements in the XML configuration file of the MyBatis framework that is finally executed.

[0031] Furthermore, step S3 includes the following sub-steps:

[0032] S31: Retrieve dynamic parameters and dynamic owner sets respectively;

[0033] S32: Determine whether the result of retrieving the dynamic owner set is null. If it is not null, retrieve the return value as the owner's id set; if it is null, obtain the user's primary key id and the role id owned by the user as the owner's id set.

[0034] Furthermore, step S5 includes the following sub-steps:

[0035] S51: Decrypt the permission configuration set owned by the user;

[0036] S52: Group the permission configuration set according to permission control and function groups, perform AND and OR concatenation on the final execution statements, and delete the final execution statements according to priority;

[0037] S53: Replace the placeholder of the final execution statement with the extracted dynamic parameter;

[0038] S54: Submit the final execution statement to the database to obtain the final return result.

[0039] The beneficial effects of the present invention are: the present invention uses the MyBatis framework to achieve powerful flexibility and configurability, solves the shortcomings of traditional data permission management systems when facing complex and changeable business scenarios, realizes fine-grained division of permission control, and can freely combine data access permission control for any business scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0041] Figure 1 Configure container workflow diagram for permissions;

[0042] Figure 2 Prepare a flow chart for initialization;

[0043] Figure 3 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0045] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0046] The following embodiments of the present invention are described in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments may be combined with each other.

[0047] A dynamic data authority management system implemented based on the MyBatis framework includes an authority configuration container, AuthorityManage, and a parent class request object, AuthorityRequest. The authority configuration container, AuthorityManage, is used to store and organize detailed configurations related to permissions, including attribute scope configuration and control element scope configuration; the parent class request object, such as AuthorityRequest, is used to provide a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs.

[0048] See also Figure 1 The authority configuration container AuthorityManage is mainly responsible for storing and organizing detailed configurations related to permissions, mainly including attribute scope configuration and control element scope configuration. Among them, attribute scope configuration is used to load permission rules; control element scope configuration is used to parse permission groups and encapsulate the rules of the same control permission group into a set.

[0049] Specifically, attribute scope configuration includes two main aspects: the first is the owner, which is a unique string or numeric ID used to identify the owner of this permission data. The second is the owner type, which is a string describing the type of the owner ID, such as person or role, to help the permission management system understand the context of the ID.

[0050] Control element scope configuration mainly includes: control permission grouping, which allows the definition of arbitrary groups, and uses OR to connect SQL statements within the same group, and AND to connect different groups. This provides flexible configuration capabilities to adapt to complex permission control scenarios. Functional grouping is similar to control permission grouping, but when processing SQL statements spliced ​​with OR in the same group, if there are multiple functional groups with the same function, the SQL statement to be executed will be selected based on the priority. Priority, when the control permission group and the functional group are the same, the priority is used to determine which SQL statement should be executed to ensure that only the highest priority rule is applied. Execution SQL, this is the SQL statement that is actually executed. Due to security considerations, it should be stored in encrypted form to prevent the exposure of sensitive information.

[0051] In this embodiment, the parent class request abstract object AuthorityRequest is the base class of all specific request objects, providing a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs.

[0052] Among them, the member variable is authority, the type is Map<String, Object> , used to store permission-related configuration information and output results.

[0053] The overridden methods include:

[0054] getDynamicParam, this no-parameter abstract method returns a Map<String, String> Dynamic parameters of type , which can be filled and adjusted according to the specific circumstances of the request at runtime. All subclasses inherited from AuthorityRequest must override this method.

[0055] getDynamicOwners, this normal method without parameters returns a List <string>A dynamic owner list of the type. By default, it returns the user ID and the role IDs owned by the user. If a specific request requires different owner information, you can optionally override this method.

[0056] getFunc, this normal method without parameters returns a Function <List <string>,List <authoritymanage>> type function interface, which maps the owner list to a specific permission management instance list. By implementing this interface, permission configuration can be dynamically obtained and managed according to the specific circumstances of the request.

[0057] getAuthority, a final method with no parameters, and a return type of Map<String, Object> (that is, the member variable authority itself), which is used to assemble the values ​​obtained by the above method through a specific algorithm and return the authority of the owner. This method is not allowed to be overridden by subclasses.

[0058] See also Figure 3 , a dynamic data permission management method based on the MyBatis framework, including the following steps:

[0059] S1: Initialization preparation.

[0060] S2: The client initiates an API request to the server.

[0061] S3: The server application interface receives the client's request.

[0062] S4: Initialize the subclass object of AuthorityRequest.

[0063] S5: Execute business logic code.

[0064] S6: Interact with the database, perform MyBatis-XML parsing, execute the ${authority} placeholder, and call the getAuthority method of AuthorityRequest.

[0065] S7: getDynamicParam() method retrieves dynamic parameters.

[0066] S8: The getDynamicOwners() method retrieves the dynamic owner set.

[0067] S9: Determine whether the return value of step S8 is null. If it is not null, take the return value as the owner's id set; if it is null, get the user's primary key id and the role id owned by the user as the owner's id set.

[0068] S10: getFunc() method obtains dynamic management permission configuration.

[0069] S11: Determine whether the return value of step S10 is null. If it is not null, use the owner set ID as an input parameter to execute the getFunc() method to obtain the permission configuration set owned by the user; if it is null, use the owner set ID as an input parameter to retrieve the permission configuration set owned by the user from the database level.

[0070] S12: Decrypt the permission configuration set owned by the user.

[0071] S13: The permission configuration set is combined with the final execution statement using the "and" or "or" method according to the permission control group and the function group, and the final execution statement is deleted according to the priority.

[0072] S14: The placeholder of the final execution statement #{} is replaced with the extracted dynamic parameter.

[0073] S15: Submit the final execution statement to the database to obtain the final return result.

[0074] For details, see Figure 2 The specific process of initialization preparation is: inherit the AuthorityRequest class for the API interface request object, rewrite the abstract method and common method of this class according to business needs, and add the SQL statement in the XML configuration file of the MyBatis framework that is finally executed. <if test="authority.available"> ${authority.sql}< / if> Configuration item.

[0075] The present invention makes full use of the flexibility of the XML configuration file in the MyBatis framework. In MyBatis, variable values ​​can be dynamically inserted through the ${} placeholder. However, the variable values ​​here are not directly derived from the member variables of the object, but can be obtained through the object's getter method. This feature makes it possible to pass permission-related SQL fragments as parameters to the final SQL execution statement, thereby realizing dynamic control of permissions.

[0076] Based on the above embodiments, the present invention has at least the following technical effects:

[0077] 1. High flexibility. (1) Definition of dynamic parameters: The getDynamicParam() method allows subclasses to dynamically generate the parameters required for permission control based on specific business scenarios. This design enables the system to flexibly respond to different permission control requirements, whether based on user roles, departments, or other complex logic, by overriding this method. (2) Flexible definition of owners: The getDynamicOwners() method provides the ability to dynamically determine the owner of the data. By default, it returns the user ID and role ID, but subclasses can override this method as needed to include other types of owner information, such as organization ID, project ID, etc. This flexibility ensures that the system can adapt to different business scenarios, where the definition of data owners may vary from scenario to scenario. (3) Customization of permission configuration functions: The getFunc() method allows subclasses to define how to obtain permission configuration based on owner information. This means that different business modules can have their own permission configuration logic, such as obtaining permission information from a database, configuration file, or remote service. This design greatly improves the flexibility of the system, allowing permission control strategies to easily adapt to different business needs and changes.

[0078] 2. Strong scalability. (1) Modular design: By encapsulating the permission control logic in AuthorityRequest and its subclasses, the system implements a modular design. This design allows you to focus on the implementation of related classes when adding or modifying permission control logic without having to modify other business logic codes. This not only reduces the system's coupling, but also improves the code's reusability and maintainability. (2) Easy to integrate: Since the AuthorityRequest class and its related logic are independent of the specific business logic, they can be easily integrated into any system based on the MyBatis framework. This easy integration feature enables this technical solution to be widely used in different projects and environments. (3) Support for multiple data sources: Due to the flexibility of the getFunc() method, the system can support obtaining permission configuration information from multiple data sources. This includes but is not limited to databases, configuration files, cache systems, remote services, etc. This ability to support multiple data sources enables the system to select the most appropriate data source according to different needs and scenarios, thereby improving the scalability and flexibility of the system.

[0079] 3. Ready to use out of the box, (1) Quick deployment: Since this technical solution is based on the widely used MyBatis framework, it has the advantage of quick deployment. Developers only need to add relevant classes and configurations to the project to start using the dynamic data permission control function. This greatly reduces the difficulty and time cost of system deployment. (2) Easy to use: The design of the AuthorityRequest class and its subclasses is clear and concise, easy to understand and use. Developers only need to read a small amount of documentation or sample code to master how to define and use dynamic permission control logic.

[0080] Fourth, dynamic adaptability: The system can manage part or all of the permission control logic in the form of configuration. For example, permission rules, role definitions, data access scopes, etc. can be stored in a database, configuration files, or external services. When new permission requirements are raised by the business, administrators or system administrators can update permissions by modifying these configurations without modifying the code.

[0081] For the sake of simplicity, the aforementioned embodiments are described as a series of actions. However, those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are preferred embodiments, and the actions involved are not necessarily required by this application.

[0082] The above embodiments describe the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present invention. Without departing from the spirit and scope of the present invention, modifications and variations made by those skilled in the art without departing from the spirit and scope of the present invention should be within the scope of protection of the appended claims.< / authoritymanage> < / string> < / string> < / authoritymanage> < / string> < / string>

Claims

1. A dynamic data rights management system based on the MyBatis framework, characterized in that: It includes a permission configuration container module and a parent class request object module. The permission configuration container module is used to store and organize detailed configurations related to permissions, including attribute scope configuration and control element scope configuration; the parent class request object module is used to provide a unified interface and member variables, allowing subclasses to rewrite methods according to specific business needs; The overridden methods include: getDynamicParam: used to return a Map<String, String> Dynamic parameters of this type can be filled and adjusted according to the request at runtime. All subclasses that inherit from the parent class request object must override the getDynamicParam method. getDynamicOwners: used to return a List <string> The dynamic owner list of the type returns the user ID and the role ID owned by the user by default. When a specific request requires different owner information, the getDynamicOwners method can be optionally rewritten;< / string> getFunc: used to return a Function <List <string>,List <authoritymanage> > type of function interface, which maps the owner list to a specific permission management instance list, and dynamically obtains and manages permission configuration according to the specific circumstances of the request;< / authoritymanage> < / string> getAuthority: used to return a Map<String, Object> The member variable authority, the obtained value is assembled and returns the owner's authority. The getAuthority method refuses to be overridden by subclasses; The permission configuration container module includes the owner submodule and the owner type submodule, among which, Owner submodule, used to identify the unique string or digital ID of the owner of the permission data; The owner type submodule is used to describe the type of owner ID, including personnel and roles; The authority configuration container module also includes a control authority grouping submodule, a functional grouping submodule, a priority submodule and an execution SQL submodule, wherein: The control permission grouping submodule is used to define any group and use OR to connect SQL statements within the same group and AND to connect different groups; Functional grouping submodule is used to select and execute SQL statements based on priority when processing SQL statements concatenated with OR within the same group and if there are multiple identical functional groups. The priority submodule is used to determine which SQL statement should be executed by priority when the control permission group and functional group are the same, ensuring that only the highest priority rule is applied; The SQL execution submodule is used to execute SQL statements and store them in ciphertext to prevent the exposure of sensitive information.

2. A dynamic data rights management system based on the MyBatis framework as claimed in claim 1, characterized in that: The member variables include authority, of type Map<String, Object> , used to store permission-related configuration information and output results.

3. A dynamic data rights management method based on the MyBatis framework, based on the dynamic data rights management system based on the MyBatis framework according to any one of claims 1 to 2, characterized in that: The steps include: S1: Initialization preparation; S2: initiates a request and performs XML parsing; S3: Get the dynamic parameters and dynamic owner set, and judge the return value; S4: Get the dynamic management permission configuration based on the return value judgment result; S5: Decrypt the user's permission configuration set, output the execution statement to the database, and obtain the final return result.

4. A dynamic data authority management method based on MyBatis framework as claimed in claim 3, characterized in that: Step S1 includes the following sub-steps: S11: The request object of the API interface inherits the parent request object class; S12: Rewrite the abstract methods and common methods of the parent request object class according to business needs; S13: Add configuration items to the SQL statements in the XML configuration file of the MyBatis framework that is finally executed.

5. A dynamic data authority management method based on MyBatis framework as claimed in claim 4, characterized in that: Step S3 includes the following sub-steps: S31: Retrieve dynamic parameters and dynamic owner sets respectively; S32: Determine whether the result of retrieving the dynamic owner set is null. If it is not null, retrieve the return value as the owner's id set; if it is null, obtain the user's primary key id and the role id owned by the user as the owner's id set.

6. A dynamic data authority management method based on MyBatis framework as claimed in claim 5, characterized in that: Step S5 includes the following sub-steps: S51: Decrypt the permission configuration set owned by the user; S52: Group the permission configuration set according to permission control and function groups, perform AND and OR concatenation on the final execution statements, and delete the final execution statements according to priority; S53: Replace the placeholder of the final execution statement with the extracted dynamic parameter; S54: Submit the final execution statement to the database to obtain the final return result.

Images