Authority management method, device and equipment and readable storage medium

Abstract

The invention discloses an authority management method, apparatus and device, and a readable storage medium. The method comprises the steps of determining whether customized authority configuration needs to be performed on a target role; if yes, all first organizations of the target role are determined, and when the target role corresponds to more than two first organizations, superior organizations of each first organizations are traced upwards, and a tree relation graph containing the first organizations and the superior organizations is constructed; setting a data management authority of the target role to each first organization in the tree relation graph; and if not, determining all second organizations corresponding to the permission field, constructing a venation type relation graph corresponding to the target role, and setting the data management permission of the target role to each second organization in the venation type relation graph. It can be seen that the permission range of the specific role can be visualized through the relation graph while the customized permission configuration mode is provided, and therefore the permission management difficulty and the permission distinguishing difficulty are further simplified.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and more specifically, to a permission management method, apparatus, device and readable storage medium. Background Art

[0002] In enterprises with multiple levels of organizations, such as large supermarket chains and banks, different enterprise roles are given different organizational management permissions. Since there are often multiple organizations at the same level, permission management becomes extremely complex and confusing, and it is difficult to accurately assess whether the scope of permissions between different enterprise roles is the same. The organizational management permissions corresponding to different roles are intertwined, and the same organization may be managed by multiple different enterprise roles, which leads to unclear and unambiguous definition of the scope of permissions.

[0003] In view of this complex and chaotic situation, how to accurately determine the scope of authority of each enterprise role has become a key issue of concern in the process of enterprise authority setting. Summary of the invention

[0004] In view of this, the present application provides a permission management method, apparatus, device and readable storage medium to solve the shortcomings of the prior art in that the scope of permission is not clearly defined.

[0005] In order to achieve the above objectives, the proposed solution is as follows:

[0006] A permission management method, comprising:

[0007] In response to the user's operation of configuring role permissions, a target role is constructed, and it is determined whether customized permission configuration is required for the target role;

[0008] If so, in response to the user's selection operation in the authority configuration interface, all first organizations of the target role are determined, and when the target role corresponds to more than two first organizations, the superior organization of each first organization is traced upward according to the subordinate relationship of each organization, until each first organization belongs to the same superior organization, and a tree relationship diagram including each first organization and each superior organization is constructed; the data management authority of the target role to each first organization in the tree relationship diagram is set;

[0009] If not, determine the authority scope of the target role, and determine all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role based on the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

[0010] Optionally, the step of responding to the user's selection operation on the permission configuration interface to determine all first organizations of the target role includes:

[0011] In response to the user's selection operation on the permission configuration interface, the target affiliation organization and the target permission type of the target role are determined, and based on the target permission type and the target affiliation organization, all first organizations of the target role are determined; wherein the target permission type is used to indicate the selection range of the first organization corresponding to the target role.

[0012] Optionally, determining all first organizational structures of the target role based on the target permission type and the target affiliated organization includes:

[0013] When the target authority type indicates that the selection range of the first organization covers all organizations, determining each organization consistent with the business type of the target affiliated organization as each first organization;

[0014] or,

[0015] When the target authority type indicates that the selection range of the first organization is a subordinate branch organization, each first organization is selected from each subordinate organization of the target affiliated organization;

[0016] or,

[0017] When the target permission type indicates that the selection range of the first organization is a subordinate organization, determining that the target subordinate organization is the first organization;

[0018] or,

[0019] When the target authority type indicates that the selection range of the first organization is the upper-level branch organization, each first organization is selected from each upper-level organization of the target affiliated organization.

[0020] Optionally, when the target authority type indicates that the selection range of the first organization is a subordinate branch organization, selecting each first organization from each subordinate organization of the target affiliated organization includes:

[0021] When the target permission type indicates that the first organization selection range is a lower-level branch organization, responding to the user's operation of setting the organization selection level, determining the target level number;

[0022] According to the subordinate relationship of the target affiliated organization, the subordinate organizations of the target affiliated organization are checked downward, and the subordinate organizations that meet the target number of levels are selected as the first organizational organizations.

[0023] Optionally, also include:

[0024] In response to the user's marking operation in the permission configuration interface, when the target affiliation is the first organization of the target role, determine whether the target role has the authority to manage other roles in the first organization based on the marking operation; if not, limit the authority of the target role.

[0025] Optionally, the step of responding to the user's selection operation on the permission configuration interface to determine all first organizations of the target role includes:

[0026] In response to the user selecting an organization on the authority configuration interface, all organizations selected by the user are used as first organizations.

[0027] Optionally, the determining of all second organizational structures corresponding to the authority field includes:

[0028] When the area of ​​authority is a functional area, each organization affiliated to the functional area shall be regarded as the second organization;

[0029] or,

[0030] When the said area of ​​authority is the business area, each organization affiliated to the business area shall be regarded as each second organization;

[0031] or,

[0032] When the authority domain is the entire domain, all organizations are regarded as second organizations.

[0033] A rights management device, comprising:

[0034] A construction module is used to respond to the user's operation of configuring role permissions, construct a target role, and determine whether customized permission configuration is required for the target role; if so, call the determination module; if not, call the setting module;

[0035] A determination module is used to respond to the user's selection operation in the permission configuration interface, determine all the first organizations of the target role, and when the target role corresponds to more than two first organizations, trace the superior organization of each first organization upward according to the subordinate relationship of each organization, until each first organization belongs to the same superior organization, and construct a tree relationship diagram including each first organization and each superior organization; set the data management authority of the target role for each first organization in the tree relationship diagram;

[0036] A setting module is used to determine the authority scope of the target role and all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role according to the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

[0037] A rights management device, comprising a memory and a processor;

[0038] The memory is used to store programs;

[0039] The processor is used to execute the program to implement each step of the above-mentioned permission management method.

[0040] A readable storage medium stores a computer program, and when the computer program is executed by a processor, each step of the above-mentioned permission management method is implemented.

[0041] It can be seen from the above technical solutions that the permission management method provided by the present application can respond to the user's operation of configuring role permissions, construct a target role, and determine whether it is necessary to customize the permission configuration of the target role; based on this, the present application can provide different permission setting methods according to the different permission setting requirements of users, improve the user experience, and avoid the permission confusion caused by the same permission setting method; subsequently, if it is necessary to customize the permission configuration of the target role, respond to the user's selection operation in the permission configuration interface, determine all the first organizations of the target role, and when the target role corresponds to more than two first organizations, trace back to the superior organization of each first organization according to the subordinate relationship of each organization until each first organization belongs to the same superior organization, and construct a tree relationship diagram containing each first organization and each superior organization; set the data management authority of the target role to each first organization in the tree relationship diagram; based on this, the present application uses the subordinate relationship of the organization to sort out the data of each first organization. The hierarchical association between the first organizations managed by the target role is intuitively represented through a tree-type relationship diagram, the organizational distribution mode and coverage of the target role's data management authority are clarified, and the authority scope of the target role is further clarified; if the target role does not need to be customized with authority configuration, the authority field of the target role is determined, and all second organizations corresponding to the authority field are determined, and a contextual relationship diagram corresponding to the target role is constructed according to the subordinate relationship between each second organization, and the target role is set to The data management authority of each second organization in the contextual relationship diagram; based on this, the present application can convert the authority scope of the target role from the authority field to each second organization through the authority field provided by the user, and further clarify the authority scope of the target role; guide the user to complete the authority configuration by only setting the authority field, and further accelerate the process of authority management; at the same time, the subordinate relationship between each second organization is further intuitively represented through the contextual relationship diagram, and the scope of the target role's data management authority is intuitively indicated. It can be seen that while providing a customized permission configuration method, the present application can intuitively represent the permission management scope of a specific role by constructing a tree-type relationship diagram and a context-type relationship diagram, thereby visualizing the permission scope of a specific role, thereby further simplifying the difficulty of permission management and permission differentiation. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 A flowchart of a rights management method disclosed in an embodiment of the present application;

[0044] Figure 2 A structural block diagram of a rights management device disclosed in an embodiment of the present application;

[0045] Figure 3 This is a hardware structure block diagram of a rights management device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] The embodiment of the present application provides a rights management method, which can be applied to various enterprise management systems or management platforms, and can also be applied to various computer terminals or intelligent terminals. The execution subject can be a processor or server of the computer terminal or intelligent terminal. The method flow chart of the rights management method is as follows: Figure 1 As shown, specifically including:

[0048] Next, combine Figure 1 The permission management method of this application is introduced in detail, including the following steps:

[0049] Step S1, in response to the user's operation of configuring role permissions, construct a target role, and determine whether customized permission configuration is required for the target role; if so, execute step S2; if not, execute step S3.

[0050] Specifically, it can respond to the user's operation of creating a role in the permission configuration interface, build a target role, and determine the creation time and creation user ID of the target role;

[0051] You can determine whether you need to customize the permissions for the target role based on the user's selected operation.

[0052] For example, if the user selects to configure the first organization in the authority configuration interface, it is determined that customized authority configuration is required for the target role, and step S2 may be executed.

[0053] If the user selects a permission field in the permission configuration interface, it is determined that customized permission configuration is not required for the target role, and step S3 can be executed.

[0054] The same target role can correspond to one or more different organization members.

[0055] Step S2, in response to the user's selection operation in the permission configuration interface, determine all the first organizations of the target role, and when the target role corresponds to more than two first organizations, trace back to the superior organization of each first organization according to the subordinate relationship of each organization, until all the first organizations belong to the same superior organization, and construct a tree relationship diagram including each first organization and each superior organization; set the data management authority of the target role for each first organization in the tree relationship diagram.

[0056] Specifically, it can be implemented in a variety of ways to respond to the user's selection operation in the authority configuration interface and determine all the first organizations of the target role.

[0057] For example, in response to the user setting the organization selection method in the authority configuration interface, the first organization can be selected from various organizations;

[0058] Alternatively, in response to the user directly selecting an organization in the authority configuration interface, the organization selected by the user may be used as the first organization.

[0059] After determining each first organization corresponding to the target role, the number of the first organizations corresponding to the target role may be determined.

[0060] When the number is not less than two, the superior organization of each first organization can be searched according to the subordinate relationship of each organization until the same superior organization of each first organization is determined.

[0061] Among them, a knowledge graph may be pre-set, in which multiple organizations and the subordinate relationships between the organizations are recorded.

[0062] A tree-type relationship diagram may be constructed based on the subordinate relationships between each first organizational structure and each found superior organization.

[0063] The target role can be configured with respect to the data management authority of each first organization in the tree relationship diagram.

[0064] The tree relationship diagram may include multiple child nodes and a root node. The root node may be a superior organization corresponding to each first organization; the superior organization may be a common superior organization of each first organization.

[0065] Each child node may include each first organization and a common superior organization of any two first organizations.

[0066] Different target roles may correspond to different first organizations.

[0067] The same organization can correspond to different target roles.

[0068] The target role's data management authority management over the first organization may indicate that the target role can manage all member data and business data in the corresponding first organization.

[0069] Step S3, determine the authority scope of the target role, and determine all second organizations corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role based on the subordinate relationships between the second organizations, and set the target role's data management authority for each second organization in the contextual relationship diagram.

[0070] Specifically, the target role's authority area can be determined based on the target role's role positioning;

[0071] Different target roles can correspond to different areas of authority.

[0072] Among them, the scope and division method of the authority area can be set according to the actual needs of the enterprise. For example, an enterprise related to commodity operation can divide the authority area into the whole area, functional area and business area; for another example, an enterprise related to software development can divide the authority area into the whole area, front-end area and back-end area.

[0073] It should be noted that the first organization refers to the organization corresponding to the target role when customized permission configuration is performed; and the second organization refers to the organization corresponding to the target role when customized permission configuration is not required.

[0074] The first organization and the second organization of different roles may be the same organization.

[0075] It can be seen from the above technical solutions that the permission management method provided by the present application can respond to the user's operation of configuring role permissions, construct a target role, and determine whether it is necessary to customize the permission configuration of the target role; based on this, the present application can provide different permission setting methods according to the different permission setting requirements of users, improve the user experience, and avoid the permission confusion caused by the same permission setting method; subsequently, if it is necessary to customize the permission configuration of the target role, respond to the user's selection operation in the permission configuration interface, determine all the first organizations of the target role, and when the target role corresponds to more than two first organizations, trace back to the superior organization of each first organization according to the subordinate relationship of each organization until each first organization belongs to the same superior organization, and construct a tree relationship diagram containing each first organization and each superior organization; set the data management authority of the target role to each first organization in the tree relationship diagram; based on this, the present application uses the subordinate relationship of the organization to sort out the data of each first organization. The hierarchical association between the first organizations managed by the target role is intuitively represented through a tree-type relationship diagram, the organizational distribution mode and coverage of the target role's data management authority are clarified, and the authority scope of the target role is further clarified; if the target role does not need to be customized with authority configuration, the authority field of the target role is determined, and all second organizations corresponding to the authority field are determined, and a contextual relationship diagram corresponding to the target role is constructed according to the subordinate relationship between each second organization, and the target role is set to The data management authority of each second organization in the contextual relationship diagram; based on this, the present application can convert the authority scope of the target role from the authority field to each second organization through the authority field provided by the user, and further clarify the authority scope of the target role; guide the user to complete the authority configuration by only setting the authority field, and further accelerate the process of authority management; at the same time, the subordinate relationship between each second organization is further intuitively represented through the contextual relationship diagram, and the scope of the target role's data management authority is intuitively indicated. It can be seen that while providing a customized permission configuration method, the present application can intuitively represent the permission management scope of a specific role by constructing a tree-type relationship diagram and a context-type relationship diagram, thereby visualizing the permission scope of a specific role, thereby further simplifying the difficulty of permission management and permission differentiation.

[0076] Furthermore, in response to the user selecting the first role on the permission configuration interface, a tree-type relationship main body diagram corresponding to the first role can be rendered and displayed, in which the permission organization structure corresponding to the first role is marked to indicate the authority scope of the first role. The first role can be a role that has been configured with data management permissions.

[0077] Among them, the first role has the data management authority of each authorized organization.

[0078] Furthermore, in response to the user selecting the second role in the permission configuration interface, the tree-type relationship theme diagram corresponding to the second role is rendered and displayed, and in response to the user configuring new permissions for the second role, the new permissions of the second role are determined, and based on the new permissions, the tree-type relationship theme diagram of the second role is revised to complete the permission update of the second role.

[0079] It can be seen from the above technical solution that the present application can realize permission configuration through the permission configuration interface, which has high reusability, high maintainability, low cost and fast permission configuration rate.

[0080] In some embodiments of the present application, in order to further meet the permission configuration requirements of different users, the present application provides two ways to set the first organization. Next, the process of determining all first organizations of the target role in response to the user's selection operation in the permission configuration interface in step S2 is described in detail, and the steps are as follows:

[0081] The first one,

[0082] S20. In response to the user's selection operation on the permission configuration interface, determine the target organization and target permission type of the target role, and based on the target permission type and the target organization, determine all first organizations of the target role; wherein the target permission type is used to indicate the selection range of the first organization corresponding to the target role.

[0083] Specifically, the present application may provide an organization screening method. That is, in response to the user selecting the organization and permission type on the permission configuration interface, the target organization and the target permission type of the target role may be determined. The target permission type may be used to indicate the selectable range of the first organization corresponding to the target role.

[0084] The selectable range may be determined according to the target permission type, and the first organizational structure corresponding to the target role may be selected from the selectable range according to the target affiliation organization.

[0085] The second type

[0086] S21. In response to the user selecting an organization on the authority configuration interface, all organizations selected by the user are used as first organizations.

[0087] Specifically, the present application may provide an advanced customization method, that is, in response to the user directly selecting the first organization in the authority configuration interface, each organization customized by the user is used as each first organization.

[0088] It can be seen from the above technical solution that this embodiment provides two optional methods for responding to the user's selection operation in the permission configuration interface to determine all the first organizations of the target role. Through the above methods, different personalized permission configuration methods can be further provided according to different user needs, thereby further improving the user's usage experience; at the same time, through the first method, the matching first organization can be filtered from the selectable range, thereby reducing the difficulty for the user to find the first organization from a variety of organizations and simplifying the difficulty of permission configuration.

[0089] In some embodiments of the present application, different target permission types may correspond to different first organization screening methods. Next, the first organization screening methods corresponding to different target permission types will be provided, that is, the process of determining all first organizations of the target role based on the target permission type and the target affiliated organization in step S20 will be described in detail, and the steps are as follows:

[0090] The first one,

[0091] S200: When the target authority type indicates that the first organization selection range covers all organizations, determine each organization having the same business type as the target affiliated organization as each first organization.

[0092] Specifically, when the target permission type indicates that the selectable scope of the target role's permissions is all organizations, the business types of all organizations can be determined, and each organization with the same business type as the target affiliated organization can be used as each first organization of the target role.

[0093] The second type

[0094] S201: When the target authority type indicates that the selection range of the first organization is a lower-level branch organization, each first organization is selected from each lower-level organization of the target affiliated organization.

[0095] Specifically, when the target permission type indicates that the selectable scope of the permission of the target role is a lower-level branch organization, multiple first organizational structures may be selected from the lower-level organizations of the target affiliated organization.

[0096] For example, the target affiliation institution of the target role may be a district branch, and its subordinate institutions may be Beizhen branch, Nanzhen branch, Xizhen branch, etc. Beizhen branch, Nanzhen branch, Xizhen branch, etc. may be used as the first organizational institutions of the target role.

[0097] The third type

[0098] S202: When the target permission type indicates that the selection range of the first organization is a subordinate organization, determine that the target subordinate organization is the first organization.

[0099] Specifically, when the target permission type indicates that the selectable scope of the permission of the target role is an affiliated organization, the target affiliated organization may be directly selected as the first organizational structure.

[0100] The fourth type

[0101] S203: When the target authority type indicates that the selection range of the first organization is an upper-level branch organization, select each first organization from each upper-level organization of the target affiliated organization.

[0102] Specifically, when the target permission type indicates that the selectable scope of the permission of the target role is the upper-level branch organization, multiple first organizational structures may be selected from the upper-level organizations of the target affiliated organization.

[0103] It can be seen from the above technical solution that this embodiment provides four optional methods for determining all first organizational structures of the target role based on the target authority type and the target affiliation organization. Through the above methods, different target authority types can be provided to meet the different needs of users and improve the wide application of this application.

[0104] In some embodiments of the present application, the process of selecting each first organization from each subordinate organization of the target affiliated organization in step S201 when the target authority type indicates that the selection range of the first organization is a subordinate branch organization is described in detail, and the steps are as follows:

[0105] S2010. When the target permission type indicates that the selection range of the first organization is a lower-level branch organization, respond to the user's operation of setting the organization selection level and determine the target number of levels.

[0106] Specifically, considering that some target roles do not have data management permissions for all hierarchical subordinate branch organizations, we can try to use the target level number to restrict the permissions of the target roles.

[0107] The target number of levels may be used to indicate the number of levels covered by each first organizational structure corresponding to the target role.

[0108] S2011. According to the subordinate relationship of the target affiliated organization, check the subordinate organizations of the target affiliated organization downward, and select the subordinate organizations that meet the target number of levels as each first organizational structure.

[0109] Specifically, the subordinate organizations of the target affiliated organization may be determined according to the subordinate relationship of the target affiliated organization, and organizations that meet the target number of levels may be selected from the subordinate organizations as the first organizational organizations.

[0110] For example, the target affiliation organization of the target role can be the city branch, and the subordinate organization of the city branch can be the district branch, and the subordinate organizations of the district branch can be the Beizhen branch, Nanzhen branch, Xizhen branch, etc.; when the target level number is 2, the district branch, Beizhen branch, Nanzhen branch, Xizhen branch, etc. can be used as the first organizational organizations of the target role.

[0111] It can be seen from the above technical solution that this embodiment provides an optional method for selecting each first organization from the subordinate organizations of the target affiliated organization when the target authority type indicates that the selection range of the first organization is a subordinate branch organization. Through the above method, the target level number can be further utilized to select the first organization from multiple organizations, thereby improving the operability and flexibility of the authority configuration.

[0112] Similarly, in step S203, when the target authority type indicates that the selection range of the first organization is the upper-level branch organization, the process of selecting each first organization from each upper-level organization of the target affiliated organization may include:

[0113] When the target permission type indicates that the first organization selection range is the upper branch organization, responding to the user's operation of setting the organization selection level, determining the target level number;

[0114] According to the subordinate relationship of the target affiliated institution, the superior institution of the target affiliated institution is traced upward, and the superior institutions that meet the target number of levels are selected as each first organizational structure.

[0115] In some embodiments of the present application, considering that some target roles only have the authority to manage personal data, a target role authority limitation process can be added when the target affiliation organization is the first organization of the target role. Next, the process will be described in detail, the steps are as follows:

[0116] S2020. In response to the user's marking operation in the permission configuration interface, when the target affiliation is the first organization of the target role, determine whether the target role has the authority to manage other roles in the first organization based on the marking operation; if not, limit the authority of the target role.

[0117] Specifically, in response to the user's marking operation in the permission configuration interface, when the target affiliation is the first organization of the target role, it can be evaluated based on the marking operation whether the target role only has the authority to modify personal data. If so, the target role authority is limited to personal data management authority. If not, it indicates that the target role has the authority to manage all user data in the corresponding target affiliation.

[0118] It can be seen from the above technical solution that compared with the previous embodiment, this embodiment newly adds an optional method of limiting the target role permissions. Through the above method, the permissions of the target role can be adjusted to personal data management permissions to meet the permission requirements of different roles.

[0119] In some embodiments of the present application, considering that different second organizations exist in different jurisdictions, the process of determining all second organizations corresponding to the jurisdiction in step S3 is described in detail, and the steps are as follows:

[0120] The first one,

[0121] When the authority area is a functional area, each organizational structure affiliated to the functional area is regarded as each second organizational structure.

[0122] Specifically, if the authority field is a functional field, all organizational structures in the functional field may be used as the second organizational structures.

[0123] The second type

[0124] When the authority field is a business field, each organization affiliated to the business field is regarded as each second organization.

[0125] Specifically, if the authority domain is a business domain, all organizations in the business domain may be used as the second organizations.

[0126] The third type

[0127] When the authority domain is the entire domain, all organizations are regarded as second organizations.

[0128] Specifically, if the authority domain is the entire domain, all organizations in the business domain and all organizations in the functional domain may be used as the second organizations.

[0129] It can be seen from the above technical solutions that this embodiment provides three optional methods for determining all second organizations corresponding to the authority field. Through the above methods, different second organizations can be configured for different authority fields, thereby improving the reliability of this application and the accuracy of authority configuration.

[0130] Next, we will combine Figure 2 The rights management device provided in the present application is introduced in detail. The rights management device provided below can be compared with the rights management method provided above.

[0131] See also Figure 2 It can be found that the rights management device may include:

[0132] The construction module 10 is used to respond to the user's operation of configuring role permissions, construct a target role, and determine whether customized permission configuration is required for the target role; if so, call the determination module 20; if not, call the setting module 30;

[0133] The determination module 20 is used to respond to the user's selection operation in the permission configuration interface, determine all the first organizations of the target role, and when the target role corresponds to more than two first organizations, trace the superior organization of each first organization upward according to the subordinate relationship of each organization, until each first organization belongs to the same superior organization, and construct a tree relationship diagram including each first organization and each superior organization; set the data management authority of the target role for each first organization in the tree relationship diagram;

[0134] The setting module 30 is used to determine the authority scope of the target role and determine all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role according to the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

[0135] Further, the determination module 20 may include:

[0136] The target affiliation organization utilization unit is used to respond to the user's selection operation on the permission configuration interface, determine the target affiliation organization and target permission type of the target role, and determine all first organizations of the target role based on the target permission type and the target affiliation organization; wherein the target permission type is used to indicate the selection range of the first organization corresponding to the target role.

[0137] Furthermore, the target affiliation institution utilization unit may include:

[0138] A business type utilizing component, for determining each organization consistent with the business type of the target affiliated organization as each first organization when the target authority type indicates that the first organization selection range covers all organizations;

[0139] A subordinate organization selection component, used to select each first organization from each subordinate organization of the target affiliated organization when the target permission type indicates that the selection range of the first organization is a subordinate branch organization;

[0140] A subordinate organization selection component, used for determining that the target affiliated organization is the first organizational structure when the target permission type indicates that the first organizational structure selection range is a subordinate organization;

[0141] The superior organization component is used to select each first organization from each superior organization of the target affiliated organization when the target permission type indicates that the selection range of the first organization is the superior branch organization.

[0142] Further, the subordinate agency selection component may include:

[0143] A target level number determination subcomponent, used to determine the target level number in response to the user's operation of setting the level of organization selection when the target permission type indicates that the first organization selection range is a lower-level branch organization;

[0144] The target number of levels utilizes a subcomponent for checking the subordinate organizations of the target organization downwards according to the subordinate relationship of the target organization, and selecting subordinate organizations that meet the target number of levels as each first organization.

[0145] Furthermore, the affiliated organization selection component may include:

[0146] The permission limitation subcomponent is used to respond to the user's marking operation in the permission configuration interface. When the target affiliation organization is the first organization of the target role, it is determined based on the marking operation whether the target role has the authority to manage other roles in the first organization; if not, the permission of the target role is limited.

[0147] Furthermore, the determination module 20 may also include:

[0148] The organization selection unit is used to respond to the user's operation of selecting an organization on the authority configuration interface and use all the organizations selected by the user as first organizations.

[0149] Further, the setting module 30 may include:

[0150] A first setting unit is used to use each organization affiliated to the functional field as each second organization when the authority field is a functional field;

[0151] A second setting unit is used to use various organizations affiliated to the business field as various second organizations when the authority field is the business field;

[0152] The third setting unit is used to set all organizations as second organizations when the authority domain is the entire domain.

[0153] The rights management device provided in the embodiment of the present application can be applied to rights management devices, such as PC terminals, cloud platforms, servers and server clusters. Figure 3 The hardware structure diagram of the rights management device is shown in FIG. Figure 3,The hardware structure of the rights management device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4;

[0154] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 communicate with each other through the communication bus 4;

[0155] The processor 1 may be a central processing unit CPU, or an application-specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention, etc.;

[0156] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), etc., such as at least one disk memory;

[0157] The memory stores a program, and the processor can call the program stored in the memory, wherein the program is used to:

[0158] In response to the user's operation of configuring role permissions, a target role is constructed, and it is determined whether customized permission configuration is required for the target role;

[0159] If so, in response to the user's selection operation in the authority configuration interface, all first organizations of the target role are determined, and when the target role corresponds to more than two first organizations, the superior organization of each first organization is traced upward according to the subordinate relationship of each organization, until each first organization belongs to the same superior organization, and a tree relationship diagram including each first organization and each superior organization is constructed; the data management authority of the target role to each first organization in the tree relationship diagram is set;

[0160] If not, determine the authority scope of the target role, and determine all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role based on the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

[0161] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0162] The embodiment of the present application further provides a readable storage medium, which may store a program suitable for execution by a processor, wherein the program is used to:

[0163] In response to the user's operation of configuring role permissions, a target role is constructed, and it is determined whether customized permission configuration is required for the target role;

[0164] If so, in response to the user's selection operation in the authority configuration interface, all first organizations of the target role are determined, and when the target role corresponds to more than two first organizations, the superior organization of each first organization is traced upward according to the subordinate relationship of each organization, until each first organization belongs to the same superior organization, and a tree relationship diagram including each first organization and each superior organization is constructed; the data management authority of the target role to each first organization in the tree relationship diagram is set;

[0165] If not, determine the authority scope of the target role, and determine all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role based on the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

[0166] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0167] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0168] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0169] The above description of the disclosed embodiments enables professionals and technicians in the field to implement or use the present application. Various modifications to these embodiments will be apparent to professionals and technicians in the field, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. The various embodiments of the present application can be combined with each other. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A rights management method, characterized in that: include: In response to the user's operation of configuring role permissions, a target role is constructed, and it is determined whether customized permission configuration is required for the target role; If so, in response to the user's selection operation in the authority configuration interface, all first organizations of the target role are determined, and when the target role corresponds to more than two first organizations, the superior organization of each first organization is traced upward according to the subordinate relationship of each organization, until each first organization belongs to the same superior organization, and a tree relationship diagram including each first organization and each superior organization is constructed; the data management authority of the target role to each first organization in the tree relationship diagram is set; If not, determine the authority scope of the target role, and determine all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role based on the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

2. The rights management method according to claim 1, characterized in that: The step of responding to the user's selection operation on the permission configuration interface and determining all first organizations of the target role includes: In response to the user's selection operation on the permission configuration interface, the target affiliation organization and the target permission type of the target role are determined, and based on the target permission type and the target affiliation organization, all first organizations of the target role are determined; wherein the target permission type is used to indicate the selection range of the first organization corresponding to the target role.

3. The rights management method according to claim 2, characterized in that: The determining of all first organizations of the target role based on the target permission type and the target affiliated organization includes: When the target authority type indicates that the selection range of the first organization covers all organizations, determining each organization consistent with the business type of the target affiliated organization as each first organization; or, When the target authority type indicates that the selection range of the first organization is a subordinate branch organization, each first organization is selected from each subordinate organization of the target affiliated organization; or, When the target permission type indicates that the selection range of the first organization is a subordinate organization, determining that the target subordinate organization is the first organization; or, When the target authority type indicates that the selection range of the first organization is the upper-level branch organization, each first organization is selected from each upper-level organization of the target affiliated organization.

4. The rights management method according to claim 3, characterized in that: When the target authority type indicates that the selection range of the first organization is a subordinate branch organization, selecting each first organization from each subordinate organization of the target affiliated organization includes: When the target permission type indicates that the first organization selection range is a lower-level branch organization, responding to the user's operation of setting the organization selection level, determining the target level number; According to the subordinate relationship of the target affiliated organization, the subordinate organizations of the target affiliated organization are checked downward, and the subordinate organizations that meet the target number of levels are selected as the first organizational organizations.

5. The rights management method according to claim 3, characterized in that: Also includes: In response to a marking operation of a user on a permission configuration interface, when the target affiliation is the first organization of the target role, determining whether the target role has the authority to manage other roles in the first organization according to the marking operation; If not, the target role is restricted in its permissions.

6. The rights management method according to claim 1, characterized in that: The step of responding to the user's selection operation on the permission configuration interface and determining all first organizations of the target role includes: In response to the user selecting an organization on the authority configuration interface, all organizations selected by the user are used as first organizations.

7. The rights management method according to claim 1, characterized in that: The determining of all second organizations corresponding to the authority area includes: When the area of ​​authority is a functional area, each organization affiliated to the functional area shall be regarded as the second organization; or, When the said area of ​​authority is the business area, each organization affiliated to the business area shall be regarded as each second organization; or, When the authority domain is the entire domain, all organizations are regarded as second organizations.

8. A rights management device, characterized in that: include: A construction module is used to respond to the user's operation of configuring role permissions, construct a target role, and determine whether customized permission configuration is required for the target role; If yes, then call the determination module; if no, then call the setting module; A determination module, for responding to a selection operation of a user in a permission configuration interface, determining all first organizations of the target role, and when the target role corresponds to more than two first organizations, tracing back to the superior organization of each first organization according to the subordinate relationship of each organization, until all first organizations belong to the same superior organization, and constructing a tree relationship diagram including each first organization and each superior organization; Setting the target role's data management authority for each first organization in the tree relationship diagram; A setting module is used to determine the authority scope of the target role and all second organizational structures corresponding to the authority scope, construct a contextual relationship diagram corresponding to the target role according to the subordinate relationships between the second organizational structures, and set the target role's data management authority over the second organizational structures in the contextual relationship diagram.

9. A rights management device, characterized in that: including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the rights management method as described in any one of claims 1 to 7.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, each step of the rights management method according to any one of claims 1 to 7 is implemented.

Images