Data acquisition method, device, electronic device and storage medium
By using permission maintenance modules to manage user permission information in enterprise-level application development, the problem of poor flexibility caused by embedding code of permission management logic in the existing technology is solved, and more efficient and flexible permission management is achieved.
Patent Information
- Application Number
- CN202411778573.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-05
- Publication Date
- 2025-04-08
AI Technical Summary
In the development of enterprise-level application, the permission management logic is embedded in the code logic, resulting in poor flexibility in permission management. As the business expands, the cost of modifying the code increases.
By obtaining user's permission information and data requirement information, preprocessing is performed to generate target permission information, which is used to limit the data scope that users can operate, and using the permission maintenance module to maintain user permission information to avoid code modification.
It improves the flexibility and adaptability of permission management, reduces the need for code modification, reduces maintenance costs, and improves the security and efficiency of the system.
Smart Images
Figure CN119783126A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication technology, and in particular to a data acquisition method, device, electronic device and storage medium. Background Art
[0002] In the existing enterprise application development process, it mainly relies on the code logic at the business level. In other words, the existing technology verifies whether the user has the right to query data through code. Since permission management may be embedded in the code logic, as the business continues to expand, the requirements for code logic are getting higher and higher. If the permission logic changes, more code needs to be modified, resulting in poor flexibility in permission management during data operations. Summary of the invention
[0003] The embodiments of the present application provide a data acquisition method, device, electronic device and storage medium to solve the problem that the existing data acquisition method only focuses on the acquisition of a single data, thereby causing poor transportation cost control of the warehouse network structure after multiple data acquisition.
[0004] On the one hand, an embodiment of the present application provides a data acquisition method, including: acquiring a first statement; wherein the first statement includes at least: a user's first permission information and data requirement information; preprocessing the first statement and target permission information to obtain a second statement; wherein the preprocessing includes at least: splitting processing and combining processing, and the target permission information is used to limit the data range that the user can operate; the target permission information is obtained based on a permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information; and executing the second statement.
[0005] In a possible embodiment, the method further includes: in response to the first operation, obtaining second permission information of the user; wherein the second permission information is the business permission available to the user, and the target permission information is a subset of the second permission information; based on the second permission information, updating the permission information in the permission maintenance module; wherein the first operation at least includes a user login operation.
[0006] In a possible embodiment, the method further includes: using the permission maintenance module to obtain the intersection of the second permission information and the first permission information to obtain the target permission information.
[0007] In a possible embodiment, the preprocessing of the first statement and the target permission information to obtain the second statement includes: splitting the data requirement information and the target permission information respectively to obtain a first statement set and a second statement set; combining the first statement set and the second statement set to obtain the second statement; wherein the first statement set and the second statement set include the same statement type, and the statement type includes at least one of the following: field name, table name, condition, sorting rule, grouping rule, and filter range.
[0008] In a possible embodiment, the first statement and / or the second permission information are obtained based on an interceptor; wherein the first statement and the second statement are SQL statements.
[0009] In a possible embodiment, the permission maintenance module maintains the user's permission information based on ThreadLocal.
[0010] In a possible embodiment, the permission maintenance module is further provided with a configuration interface, and the configuration interface is used to modify the rules for maintaining permission information by the permission maintenance module.
[0011] On the one hand, an embodiment of the present application provides a data acquisition device, including: an acquisition module, used to acquire a first statement; wherein, the first statement includes at least: a user's first permission information, data requirement information; a processing module, used to pre-process the first statement and target permission information to obtain a second statement; wherein, the pre-processing includes at least: splitting processing, combining processing of the target permission information to limit the data range that the user can operate; the target permission information is obtained based on the first permission information by a permission maintenance module; the permission maintenance module is used to maintain the user's permission information; an execution module is used to execute the second statement.
[0012] On the one hand, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes any one of the above-mentioned data acquisition methods.
[0013] On the one hand, the present application provides a computer-readable storage medium, which includes a program code. When the storage medium is run on an electronic device, the program code is used to enable the electronic device to execute any of the above-mentioned data acquisition methods.
[0014] On the one hand, an embodiment of the present application provides a computer program product, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium; when a processor of an electronic device reads the computer instructions from the computer-readable storage medium, the processor executes the computer instructions, so that the electronic device executes any one of the above-mentioned data acquisition methods.
[0015] The beneficial effects of this application are as follows:
[0016] The present application provides a data acquisition method, device, electronic device and storage medium. The present application obtains the first permission information and data requirement information of the user through a first statement, and pre-processes the first statement and the target permission information to obtain a second statement, wherein the pre-processing includes splitting processing and combining processing, and obtains data by executing the second statement. Among them, the target permission information can be used to limit the data range that the user can operate, and the target permission information is obtained based on the permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information. In other words, the present application mainly uses the permission maintenance module to determine the target permission information when acquiring data, and does not involve the nesting of other modules or logic. If the permission logic needs to be adjusted (for example, adding new permissions, modifying permission levels, etc.), it is only necessary to adjust the permission logic of the permission maintenance module, without the need to make a large number of modifications to the code as in the prior art. In this way, the flexibility and adaptability of permission management during data acquisition can be improved, and the efficiency of permission management can also be improved.
[0017] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0019] Figure 1 A flowchart of a data acquisition method in an embodiment of the present application;
[0020] Figure 2 This is a flow chart of another data acquisition method in an embodiment of the present application;
[0021] Figure 3 This is a structural schematic diagram of a data acquisition device in an embodiment of the present application;
[0022] Figure 4 A schematic diagram of the hardware structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION
[0023] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.
[0024] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the invention described herein can be implemented in sequences other than those illustrated or described herein.
[0025] In the existing enterprise-level application development process, controlling the user's access rights to data is an important part of ensuring data security and privacy. However, in the existing technology, the permission management part is often embedded in the code logic at the business level. If the permission logic needs to be changed, such as adding new permissions, modifying permission levels, etc., the code needs to be modified accordingly. As the business continues to expand, the cost of modifying the code also increases, which reduces the flexibility of the system for system management and brings additional maintenance costs.
[0026] In order to solve the above problems, this application provides a data acquisition method, which mainly embeds the user's permissions into the statement accurately, and the statement consists of two parts: permission information and data requirement information. When the permission rules change, only the permission rules need to be updated in the permission maintenance module, and there is no need to change the code, thereby improving the flexibility of permission management and improving system security. For details, please refer to Figure 1 , Figure 1 A flow chart of a data acquisition method in an embodiment of the present application is shown in FIG. Figure 1 As shown, the data acquisition method provided in this application specifically includes:
[0027] S101, obtaining a first statement; wherein the first statement at least includes: a user's first permission information and data requirement information.
[0028] Specifically, the first statement here is a statement obtained based on the user's operation in the application. Among them, the first statement is an SQL statement. User operations include but are not limited to at least one of the following: user login operation, data query operation. Among them, the first statement includes but is not limited to at least one of the following: first permission information, data requirement information. That is to say, after the user performs an operation, the application can determine the data that the user wants to operate based on the data requirement information, and the first permission information is used to determine the user's target permission information. The operations here may include but are not limited to at least one of the following: read operation, edit operation, delete operation.
[0029] Among them, the first permission information may include but is not limited to at least one of the following: the user's permission information, the permission information of the user's organization, the permission information of the device used by the user, and the permission information of the interface used by the user. Exemplarily, the first permission information may only include the permission information of the user's organization, that is, when the user performs a data query operation, the user's organization information can be obtained through the interface to determine the user's final permissions. In actual applications, this application does not specifically limit the type and quantity of permission information included in the first permission information, which can be determined based on actual conditions and is not limited here.
[0030] S102, preprocessing the first statement and target permission information to obtain a second statement; wherein the preprocessing includes at least: splitting processing and combining processing, the target permission information is used to limit the data range that the user can operate; the target permission information is obtained based on the permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information.
[0031] This step means that the present application uses the permission maintenance module to obtain the target permission information, and determines the user's final permission based on the target permission information obtained by the permission maintenance module. Among them, the target permission information can be understood as permission information obtained by adjusting the first permission information according to certain rules. Exemplarily, when the first permission information only includes the user's permission information, the permission maintenance module can use the permission information of the user's organization to further restrict the user's permissions and obtain the user's final target permission information. For example, the user's own permissions can access data A+B, while the permission information of the user's organization can only access data B. In order to ensure the security of the data, the target permission information can limit the user to only have the permission to access data B.
[0032] Among them, this application does not limit the type of permission maintenance module. The permission maintenance module can use at least one of the following methods but not limited to the following to implement user permission management: Lightweight Directory Access Protocol (LDAP), Identity and Access Management (IAM), ThreadLocal. Preferably, the permission maintenance module can be ThreadLocal, which means that the permission maintenance module can be multi-threaded to meet the permission acquisition requirements from different users or databases, and can not interfere with each other, so that the system can more easily adapt to different permission management requirements, thereby improving the overall performance of the system.
[0033] It should be understood that the present application does not specifically limit the specific method by which the permission maintenance module obtains the target permission information based on the first permission information, including but not limited to: taking the intersection of the first permission information and other permission information, taking the union of the first permission information and other permission information. The specific acquisition method will be described in detail later and will not be repeated here.
[0034] After determining the target permissions of the user, the first statement and the target permission information can be processed to obtain the second statement. At this time, the second statement includes both permission information and data requirement information. This ensures that when the subsequent step S103 is executed, the complexity and errors that may be caused by executing data search and permission management separately can be avoided to a certain extent, thereby simplifying the execution process. In addition, the overhead of executing the two steps separately can be reduced, thereby improving the execution efficiency.
[0035] S103: Execute the second statement.
[0036] Finally, the second statement can be executed. Depending on the target permission information, the execution result obtained is also different. Exemplarily, when the target permission information at least partially meets the permission configuration required by the data requirement information, the execution result is to obtain data that meets the user's permissions. When the target permission information is completely different from the permission configuration required by the data requirement information, an empty result set is returned and / or a permission error alarm is triggered.
[0037] In summary, the present application obtains the user's first permission information and data requirement information through a first statement, and sequentially splits and combines the first statement and the target permission information to obtain a second statement, and obtains data by executing the second statement. Among them, the target permission information can be used to limit the data range that the user can operate, and the target permission information is obtained based on the permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information. In other words, the present application mainly uses the permission maintenance module to determine the final permission (i.e., the target permission information), and does not involve the nesting of other modules or logic. If the permission logic needs to be adjusted (for example, adding new permissions, modifying permission levels, etc.), it is only necessary to adjust the permission logic of the permission maintenance module, without the need to make a lot of modifications to the code as in the prior art. In this way, the flexibility and adaptability of permission management can be improved, and the efficiency of permission management can also be improved.
[0038] In addition to managing different types of permission information, the permission maintenance module can also manage at least one of the following information, including but not limited to: user information, company / organization information. The management here includes but is not limited to: query operations, editing operations. In other words, you can query the data under a specified company or department, or the data under all companies or departments in the permission maintenance module. Furthermore, the permission maintenance module can associate user information, organization information, etc. with each permission information, and query the permission information of each user based on this information, that is, cross-table association query.
[0039] It should be noted that this application does not specifically limit the method by which the permission maintenance module obtains permission information. The permission information can be sent by other modules or obtained based on user operations. Furthermore, the permission maintenance module can also be configured with a configuration interface, through which users can modify permission rules and apply the modified rules to data permission control.
[0040] In addition, the permission maintenance module can also be configured with a permission switch to control whether data permissions are enabled.
[0041] In an exemplary embodiment, the method for the permission maintenance module to obtain permission information specifically includes S201-S202:
[0042] S201, in response to a first operation, obtaining second permission information of a user; wherein the second permission information is a service permission available to the user, and the target permission information is a subset of the second permission information.
[0043] Specifically, the present application can obtain the second permission information in response to the user's first operation, wherein the present application does not specifically limit the method for obtaining the second permission information, including but not limited to the following: an intrusion prevention system, an application server, and an interceptor. Preferably, an interceptor can be selected to obtain the second permission information at the data access layer, thereby achieving accurate screening at the source of the data, thereby improving the security and performance of the system.
[0044] Wherein, the first operation at least includes: user login operation. When the user logs in, the login operation needs to carry user permission information, that is, according to this operation, the latest permission information of the user can be obtained, and according to the latest permission information (i.e., the second permission information), the permission information in the permission maintenance module is updated (i.e., step S202). Wherein, the second permission information includes but is not limited to at least one of the following: the permission information of the user, the permission information of the organization to which the user belongs, the permission information of the device used by the user, and the permission information of the interface used by the user. Wherein, the permission types of the second permission information and the first permission information are at least partially different or completely the same, and correspondingly, the method for processing the permission information by the permission maintenance module is also different.
[0045] When the permission types of the second permission information and the first permission information are at least partially different, for example, the second permission information includes user permission information, while the first permission information includes permission information of the organization to which the user belongs. The permission maintenance module can use the second permission information and the first permission information to take the intersection, that is, find the permission items that exist in both the first permission information and the second permission information as the target permission information. This ensures that the user will not exceed the scope of his explicit authorization in actual operation.
[0046] When the second permission information and the first permission information have the same permission type, for example, both include the user's permission information, the first permission information can be used to verify the second permission information, and when the verification passes, the first permission information can be used as the target permission information. Alternatively, the permission maintenance module can also take the intersection of the two and use the permission items that exist in both the first permission information and the second permission information as the target permission information.
[0047] S202: Based on the second permission information, update the permission information in the permission maintenance module; wherein the first operation at least includes a user login operation.
[0048] In this step, the permission information in the permission maintenance module can be updated based on the second permission information. Exemplarily, the permission maintenance module can compare the second permission information with the permission information stored inside it, and when the two are different, the permission information inside it can be updated to the second permission information.
[0049] In this way, the real-time nature of the permission information in the permission maintenance module can be guaranteed, thereby achieving the effect of timely response to security threats, thereby improving system security.
[0050] After the target permission information is acquired according to the first permission information and the second permission information by using the permission maintenance module, step S102 may be executed, wherein step S102 specifically includes steps S1021-S1022.
[0051] S1021, split the data requirement information and the target authority information respectively to obtain a first statement set and a second statement set.
[0052] Specifically, the data demand information can be split, wherein the present application does not specifically limit the method of splitting processing, for example, Druid can be used for parsing. The data demand information is split into a first statement set. And the target permission information of the permission maintenance module is split to obtain a second statement set. Among them, the statement types included in the first statement set and the second statement set are the same, including but not limited to at least one of the following: field name (columns), table name (table), condition (where), sorting rule (orderByClause), grouping rule (groupByClause), and filtering range (limit).
[0053] S1022: Combine the first statement set and the second statement set to obtain the second statement.
[0054] Among them, the present application does not specifically limit the combination of the first statement set and the second statement set. For example, the first statement set may include abc, and the second statement set may include 123. The final second statement may be abc123 or a1b2c3.
[0055] The above is a data acquisition method provided by the present application. The above are embodiments and can be freely combined with the present application according to actual conditions without specific limitations.
[0056] In an exemplary embodiment, the above embodiments may be combined. Figure 2 FIG. 1 is a flow chart of another data acquisition method in an embodiment of the present application. Figure 2 As shown, the method includes:
[0057] S1, user logs in.
[0058] S2, save the user permission information to ThreadLocal.
[0059] Among them, ThreadLocal is the permission maintenance module, and the user permission information is the second permission information.
[0060] S3, enter the application system.
[0061] S4, query data through the interface.
[0062] In this step, the interface may carry designated organization information (ie, the organization to which the user belongs), and the organization authority information (ie, first authority information) may be obtained based on the organization information.
[0063] S5: Take the intersection of the user's own organizational authority and the organizational authority information specified by the SQL query.
[0064] This step is step S102, wherein the user's own organizational authority is the second authority information stored in ThreadLocal, and the organizational authority information specified by the SQL query is the first authority information.
[0065] S6, obtain the SQL statement.
[0066] The SQL statement here refers to the data requirement information in the first statement.
[0067] S7, decompose the SQL statement to obtain the fields, names, table name conditions, etc.
[0068] That is, in the aforementioned step S1021, the data SQL statement is decomposed and processed.
[0069] S8, concatenate new SQL statements.
[0070] This step is the aforementioned step S1022.
[0071] S9, query the database to obtain data.
[0072] This step is equivalent to executing the second statement and obtaining data according to the second statement.
[0073] S10, end.
[0074] Based on the same inventive concept, the present application also provides a data acquisition device. Figure 3 As shown, it is a schematic diagram of the structure of the data acquisition device 300, which may include:
[0075] The acquisition module 301 is used to acquire a first statement; wherein the first statement at least includes: first permission information and data requirement information of the user;
[0076] The processing module 302 is used to pre-process the first statement and the target permission information to obtain a second statement; wherein the pre-processing includes at least: splitting processing and combining processing, the target permission information is used to limit the data range that the user can operate; the target permission information is obtained based on the permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information;
[0077] The execution module 303 is used to execute the second statement.
[0078] In a possible embodiment, the data acquisition device 300 is also configured to obtain the user's second permission information in response to the first operation; wherein the second permission information is the business permission available to the user, and the target permission information is a subset of the second permission information; based on the second permission information, the permission information in the permission maintenance module is updated; wherein the first operation at least includes a user login operation.
[0079] In a possible embodiment, the data acquisition device 300 is further configured to use the permission maintenance module to obtain the intersection of the second permission information and the first permission information to obtain the target permission information.
[0080] In a possible embodiment, the data acquisition device 300 is also configured to split the data demand information and the target authority information respectively to obtain a first statement set and a second statement set; combine the first statement set and the second statement set to obtain the second statement; wherein the first statement set and the second statement set include the same statement type, and the statement type includes at least one of the following: field name, table name, condition, sorting rule, grouping rule, and filtering range.
[0081] In a possible embodiment, the data acquisition device 300 is further configured to acquire the first statement and / or the second permission information based on an interceptor; wherein the first statement and the second statement are SQL statements.
[0082] In a possible embodiment, the data acquisition device 300 is further configured so that the permission maintenance module maintains the user's permission information based on ThreadLocal.
[0083] In a possible embodiment, the data acquisition device 300 is further configured so that the authority maintenance module is further provided with a configuration interface, and the configuration interface is used to modify the rules for maintaining the authority information by the authority maintenance module.
[0084] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application, and the electronic device can implement the functions of the aforementioned data acquisition method and device, referring to Figure 4, the electronic device comprises:
[0085] At least one processor 401, and a memory 402 connected to the at least one processor 401. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present application. Figure 4 In the example, the processor 401 and the memory 402 are connected via the bus 400. The bus 400 is Figure 4 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 400 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 401 can also be called a controller, and there is no limitation on the name.
[0086] In the embodiment of the present application, the memory 402 stores instructions that can be executed by at least one processor 401. The at least one processor 401 can execute the data acquisition method discussed above by executing the instructions stored in the memory 402. The processor 401 can implement Figure 4 The functions of each module in the device shown.
[0087] Among them, the processor 401 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 402 and calling the data stored in the memory 402, the various functions of the device and process data, the device can be monitored as a whole.
[0088] In one possible design, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 401. In some embodiments, the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.
[0089] Processor 401 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the data acquisition method disclosed in the embodiments of the present application can be directly embodied as a hardware processor to be executed, or a combination of hardware and software modules in the processor can be executed.
[0090] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0091] By designing and programming the processor 401, the code corresponding to the data acquisition method described in the above embodiment can be fixed into the chip, so that the chip can execute the data acquisition method when it is running. Figure 2 The steps of the data acquisition method of the embodiment shown are as follows: How to design and program the processor 401 is a technique well known to those skilled in the art and will not be described in detail here.
[0092] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the data acquisition method discussed above.
[0093] In some possible implementations, various aspects of the data acquisition method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the data acquisition method according to various exemplary implementations of the present application described above in this specification.
[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0098] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A data acquisition method, characterized in that: The method comprises: Obtaining a first statement; wherein the first statement at least includes: first permission information and data requirement information of the user; Preprocessing the first statement and the target permission information to obtain a second statement; wherein the preprocessing at least includes: splitting processing and combining processing, the target permission information is used to limit the data range that the user can operate; the target permission information is obtained based on the permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information; Execute the second statement.
2. The method according to claim 1, characterized in that: The method further comprises: In response to the first operation, second permission information of the user is obtained; wherein the second permission information is a service permission that the user can use, and the target permission information is a subset of the second permission information; Based on the second permission information, updating the permission information in the permission maintenance module; The first operation at least includes a user login operation.
3. The method according to claim 2, characterized in that: The method further comprises: The target permission information is obtained by taking the intersection of the second permission information and the first permission information using the permission maintenance module.
4. The method according to claim 1, characterized in that: The preprocessing of the first statement and the target permission information to obtain the second statement includes: The data requirement information and the target authority information are split and processed respectively to obtain a first statement set and a second statement set; Combining the first statement set and the second statement set to obtain the second statement; The first statement set and the second statement set include the same statement type, and the statement type includes at least one of the following: field name, table name, condition, sorting rule, grouping rule, and screening range.
5. The method according to any one of claims 1 to 4, characterized in that: The first statement and / or the second permission information are obtained based on an interceptor; wherein the first statement and the second statement are SQL statements.
6. The method according to any one of claims 1 to 5, characterized in that: The permission maintenance module maintains the user's permission information based on ThreadLocal.
7. The method according to claim 6, characterized in that: The authority maintenance module is also provided with a configuration interface, and the configuration interface is used to modify the rules for maintaining authority information by the authority maintenance module.
8. A data acquisition device, characterized in that: include: An acquisition module, configured to acquire a first statement; wherein the first statement at least includes: first permission information of a user and data requirement information; a processing module, configured to pre-process the first statement and target permission information to obtain a second statement; wherein the pre-processing includes at least: splitting processing and combining processing; the target permission information is used to limit the data range that can be operated by the user; the target permission information is obtained based on the permission maintenance module using the first permission information; the permission maintenance module is used to maintain the user's permission information; An execution module is used to execute the second statement.
9. An electronic device, characterized in that: The device comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes any one of the methods in claims 1 to 6.
10. A computer-readable storage medium, characterized in that: The storage medium comprises a program code, and when the storage medium is run on an electronic device, the program code is used to enable the electronic device to execute any one of the methods of claims 1 to 6.