Permission determination method and device, storage medium and electronic equipment

Abstract

The invention discloses a permission determination method and device, a storage medium and electronic equipment, and relates to the technical field of computers.The permission determination method comprises the steps that in response to an access request of a user for a first interface, at least one piece of role information corresponding to the user and the incidence relation between the at least one piece of role information and the first interface are determined from a target database; generating role permission information corresponding to the at least one piece of role information according to the association relationship; determining a permission information set corresponding to the user based on the role permission information; the operable control in the first interface is updated based on the permission information set, a second page is obtained, and the second interface is used for being accessed by the user. Compared with the prior art, the permission determination accuracy is improved by associating the permission association relationship between the user role and the target interface; the interface operable control is dynamically updated based on the permission information set, real-time adaptation of permission and interface display is achieved, and user operation experience and permission management efficiency can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a permission determination method and device, a storage medium and an electronic device. BACKGROUND

[0002] The permission determination technology for data management and control scenarios is a key supporting technology in enterprise digital transformation, and is mainly used for realizing fine control of user roles and page access, and guaranteeing data operation safety and compliance.

[0003] At present, in the case that a user has multiple roles, the existing permission determination method will superimpose permissions according to a fixed order of roles. Using this way makes the range after superimposing permissions fuzzy, and the situation that the permissions do not match the actual business requirements may occur, which leads to low precision of permission determination, and further affects the experience of user operation. SUMMARY

[0004] Therefore, the present application provides a permission determination method and device, a storage medium and an electronic device, which mainly aims to improve the technical problem that the range after superimposing permissions in the prior art is fuzzy, the situation that the permissions do not match the actual business requirements may occur, which leads to low precision of permission determination, and further affects the experience of user operation.

[0005] In a first aspect, the present application provides a permission determination method, comprising: In response to a user's access request for a first interface, determining at least one role information corresponding to the user and an association relationship between the at least one role information and the first interface from a target database; Generating role permission information corresponding to the at least one role information according to the association relationship; Determining a permission information set corresponding to the user based on the role permission information; Updating an operable control in the first interface based on the permission information set to obtain a second page, and the second interface is used for the user to access.

[0006] Optionally, after the updating of the operable control in the first interface based on the permission information set to obtain the second page, the method further comprises: Determining an operation frequency of the operable control in the second interface by the user; Determining target operable content of the operable control according to the operation frequency, and updating the operable control based on the target operable content.

[0007] Optionally, the method further comprises: determine target permission information corresponding to the user based on the frequency of operation of the user on the second interface and the target operable content; generate permission recommendation information corresponding to the user according to the target permission information, the permission recommendation information being used to recommend the user to request to open the target permission information.

[0008] Optionally, after the role permission information is determined, the method further comprises: marking the user identifier of the user on the permission information set to obtain a target permission information set; storing the target permission information set in a target cache location, the target permission information set being used to determine the access permission of the user on the operable control in the first interface.

[0009] Optionally, the method further comprises: in response to the permission update data of the first interface being stored in the target database, determining at least one second user related to the permission update data; generating permission update information corresponding to the permission update data; sending the permission update information to the at least one second user.

[0010] Optionally, before the at least one target user related to the permission update data of the first interface is determined, the method further comprises: in response to the permission update data of the first interface, determining update user information and / or update role information corresponding to the permission update data; storing the permission update data and the update user information and / or update role information in the target database.

[0011] In a second aspect, the application provides a permission determination apparatus, comprising: a determination module configured to determine at least one role information corresponding to a user and an association relationship between the at least one role information and a first interface in response to an access request of the user on the first interface; a generation module configured to generate role permission information corresponding to the at least one role information according to the association relationship; the determination module is further configured to determine a permission information set corresponding to the user based on the role permission information; an update module configured to update an operable control in the first interface based on the permission information set to obtain a second page, the second interface being used for the user to access.

[0012] In a third aspect, the present application provides a computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the permission determination method of the first aspect.

[0013] In a fourth aspect, the present application provides an electronic device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the permission determination method of the first aspect when executing the computer program.

[0014] According to the above technical solution, the permission determination method, device, storage medium and electronic device provided by the present application determine at least one role information corresponding to the user and the association relationship between the at least one role information and the first interface from the target database in response to the access request of the user to the first interface; generate role permission information corresponding to the at least one role information according to the association relationship; determine a permission information set corresponding to the user based on the role permission information; update the operable control in the first interface based on the permission information set to obtain a second page, and the second interface is used for the user to access. Compared with the prior art, the present application accurately generates role permission information and integrates it into a user-specific permission set by associating the user role with the permission association relationship of the target interface, thereby realizing the accuracy of permission determination; by dynamically updating the interface operable control based on the permission information set, the real-time adaptation of the permission and the interface display is realized, which can improve the user operation experience and the permission management efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0015] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without creative labor.

[0017] Figure 1 A flowchart of a permission determination method provided by an embodiment of the present application is shown; Figure 2 A flowchart of a permission determination method provided by an embodiment of the present application is shown; Figure 3 A schematic diagram of an example provided by an embodiment of the present application is shown; Figure 4 A schematic diagram of an example provided by an embodiment of the present application is shown; Figure 5 This illustration shows a schematic diagram of the structure of an authorization determination device provided in an embodiment of this application; Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0018] The embodiments of this application will now be described in more detail with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0019] To address the technical issue of ambiguous scope resulting from overlapping permissions in existing technologies, which leads to mismatches between permissions and actual business needs, resulting in low accuracy in permission determination and consequently impacting user experience, this embodiment provides a permission determination method, such as... Figure 1 As shown, the method includes: Step 101: In response to the user's access request to the first interface, determine at least one role information corresponding to the user from the target database, as well as the association relationship between at least one role information and the first interface.

[0020] In this embodiment, role information refers to the identification information assigned to a user in the system to define their scope of operation and permission level. For example, the role information in this embodiment can specifically be role identification information preset by the system or created by the administrator in the role management interface. Role information can be used to associate corresponding menu permissions, operation permissions, and interface permissions. Specifically, role information can include different types of roles such as administrator, member 1, member 2, and data reporter. Each role can correspond to a different permission range; for example, the administrator role can correspond to full menu access and all operation permissions, while the data reporter role can correspond to only data reporting related menus and operation permissions.

[0021] In this embodiment, the first interface can be a system page for which a user initiates an access request. The first interface can include various functional modules and operable controls. For example, the first interface in this embodiment can specifically be a system homepage, a report management page, a data reporting page, etc. For instance, the first interface can be any page accessed by a user through a browser or system client. The first interface can include operable controls such as a menu list, operation buttons, and a data viewing area. Different interfaces can correspond to different business functions and permission control requirements.

[0022] For the embodiment of the present application, the target database can be a storage medium for storing user information, role information, interface information and various association relationship data in the system. For example, the target database in the embodiment of the present application can be a relational database, such as a MySQL database, which can include account table, role table, menu table, user-role association table, role-menu association table and other data tables, which respectively store corresponding data information, and can realize ordered storage and efficient query of user, role, interface and permission association data through structured data table design.

[0023] For the embodiment of the present application, the association relationship can be a permission corresponding relationship between the role information and the first interface, and the association relationship can include whether the role has the permission to access the first interface and operate the operable control in the first interface. For example, the association relationship in the embodiment of the present application can be a mapping relationship between the role and the interface configured in the target database. For example, the association relationship between the member 1 role and the report management page can be to have the permission to view report data and export report, and the association relationship between the data reporting staff role and the report management page can be to have the permission to only view report data.

[0024] In the embodiment of the present application, when the user initiates an access request for the first interface, the system can first receive the access request, which can carry the identity information of the user, such as account ID; the system queries at least one role information corresponding to the user from the user-role association table of the target database based on the user identity information. At the same time, the system queries the association relationship between the at least one role information and the first interface from the role-menu association table of the target database, that is, determines whether each role has the permission to access the first interface and the specific operation permission range.

[0025] Step 102, generating role permission information corresponding to at least one role information according to the association relationship.

[0026] For the embodiment of the present application, the role permission information can be the permission information that the role specifically has in the first interface based on the association relationship between the role information and the first interface, and the role permission information can include access permission, operation permission, interface calling permission, etc. For example, the role permission information in the embodiment of the present application can be a set of information including accessible menu ID, operable button identifier, callable interface URL, etc.

[0027] For the embodiments of the present application, after determining the at least one role information corresponding to the user and the association relationship between each role and the first interface, the system can generate the role permission information corresponding to each role according to the association relationship. For example, the system can extract the permission data corresponding to each role from the role-menu association table, the role-operation association table and the role-interface association table of the target database, and generate the role permission information corresponding to each role after integrating the permission data. It should be noted that during the generation of the role permission information, the format specification of the permission data can be referred to to ensure the uniformity and standardization of the role permission information, so as to facilitate the integration and use of the subsequent permission information.

[0028] Step 103, determining the permission information set corresponding to the user based on the role permission information.

[0029] In the embodiments of the present application, the permission information set can be a set of all the permission information actually possessed by the user in the first interface after integrating the at least one role permission information corresponding to the user. For example, the permission information set in the embodiments of the present application can specifically include the intersection or union of a plurality of role permission information.

[0030] In the embodiments of the present application, after obtaining the at least one role permission information corresponding to the user, the system can integrate and process the role permission information based on the permission calculation rule to determine the permission information set corresponding to the user. The permission calculation rule can be a set operation algorithm, for example, the intersection method of Apache Commons Collections tool class is used for intersection calculation, or can include but not limited to other set operation algorithms or self-defined permission merging rules.

[0031] For example, when the user corresponds to multiple roles, the system performs intersection calculation on the same type of permission set of each role, for example, respectively performs intersection operation on the menu access permission set and the operation button permission set, filters out the permission content shared by multiple roles, and forms the permission information set of the user; if the user only corresponds to one role, the role permission information of the role is directly taken as the permission information set of the user.

[0032] Step 104, updating the operable control in the first interface based on the permission information set, to obtain a second page.

[0033] The second interface is used for the user to access.

[0034] For the embodiment of the present application, the operable control can be a control in the first interface that the user can operate, and can include menu options, operation buttons, input boxes, data export controls, etc. For example, the operable control in the embodiment of the present application can specifically include operation buttons such as adding, deleting, exporting, and filtering, as well as various menu list items, data query input boxes, etc.

[0035] For the embodiment of the present application, the second page can be a page suitable for current user access formed after the operable control in the first interface is updated based on the set of permission information, and can include operable controls that the user has permission for. For example, the second page in the embodiment of the present application can be a page filtered by permission.

[0036] In the embodiment of the present application, the system can update the operable control in the first interface based on the set of permission information after determining the set of permission information corresponding to the user. For example, the system can first parse the permission content in the set of permission information to determine the type and identifier of the operable control that the user has permission for; then, the operable control in the first interface is iterated and verified, the operable control that the user has permission for is retained, and the operable control that the user has no permission for is hidden, disabled, or removed; after the above update is completed, the second page is obtained, which can include the control that the user has the right to operate, and the user can perform operations within the permission range based on the second page. During the page update process, the front-end VueRouter can call the addRoutes method to dynamically add routes to achieve permission-based page access control.

[0037] Compared with the prior art, the embodiment of the present application accurately generates role permission information and integrates it into a user-specific permission set by associating the user role with the permission association relationship of the target interface, thereby achieving the accuracy of permission determination; and by dynamically updating the operable control of the interface based on the set of permission information, the real-time adaptation of the permission and the interface display is achieved, which can improve the user operation experience and the efficiency of permission management.

[0038] As an optional way, after performing "updating the operable control in the first interface based on the set of permission information to obtain the second page", the following method can be used, but is not limited to this, as shown in Figure 2 , comprising: Step 201, determining the operation frequency of the user on the operable control in the second interface.

[0039] In the embodiment of the present application, the operation frequency can be the number of times that the user operates each operable control in the second interface within a certain time range. For example, the operation frequency in the embodiment of the present application can specifically include daily operation frequency, monthly operation frequency, etc.

[0040] In the embodiment of the present application, the system can record the user ID, operation time, operation control identifier and other information by intercepting the operation of the user on the operable control in the second interface through aspect-oriented programming (AOP), and store them in the user operation log. The user operation log can be stored in a target database or a non-relational database, such as a Redis database. The system can extract the operation records of the user on each operable control in the second interface from the user operation log according to a preset statistical period, and count the number of operations corresponding to each operable control to determine the operation frequency of each operable control. It should be noted that in the statistical process, conventional statistical algorithms can be used, including but not limited to summation statistics, de-duplication statistics, etc.

[0041] In step 202, the target operable content of the operable control is determined according to the operation frequency, and the operable control is updated based on the target operable content.

[0042] For the embodiment of the present application, the target operable content can be the operable control content suitable for the current user filtered based on the operation frequency of the operable control. The target operable content can include the control function corresponding to high-frequency operation or low-frequency operation or the simplified control content. For example, the target operable content in the embodiment of the present application can specifically include operable controls for high-frequency operation that retain complete functions and operable controls for low-frequency operation that hide part of the advanced functions.

[0043] For the embodiment of the present application, after determining the operation frequency of each operable control, the system can first preset a frequency threshold, for example, the high-frequency operation threshold is monthly access greater than or equal to 10 times, and the low-frequency operation threshold is monthly access less than or equal to 3 times. Then, the operation frequency of each operable control is compared with the preset threshold, the operable content of the operable control corresponding to high-frequency operation is retained in its entirety, the simplified operable content of the operable control corresponding to low-frequency operation is determined, the target operable content is generated, and the operable control in the second interface is updated based on the determined target operable content.

[0044] As an optional way, the embodiment can also use the following method, but is not limited thereto. The method includes: determining the target permission information corresponding to the user that has not been opened based on the operation frequency of the user on the second interface and the target operable content; generating the permission recommendation information corresponding to the user according to the target permission information, and the permission recommendation information is used to recommend the user to request to open the target permission information.

[0045] In the embodiment of the present application, the target permission information can be the permission information that the user has not opened at present but may need based on the operation behavior and demand. For example, the target permission information in the embodiment of the present application can specifically include the operable control permission that has not been opened, the menu access permission, etc.

[0046] In the embodiments of the present application, the permission recommendation information can be prompt information for prompting the user to open the target permission information. For example, the permission recommendation information in the embodiments of the present application can specifically include a target permission name, a permission function description, an opening suggestion and the like.

[0047] For the embodiments of the present application, the system can analyze the operation habits and potential needs of the user in combination with the operation frequency of the user on the second interface and the target operable content. For example, the system can use a collaborative filtering algorithm to construct a user operation matrix, which can include user, operation and operation frequency information; and then train an ALS (Alternating Least Squares) model through Spark MLlib, which can also include but is not limited to using other machine learning models, input the user operation matrix and output the preference score of the user on the unused operation, filter out the permission information that the user may need but has not opened as the target permission information based on the preference score; then, the system generates permission recommendation information according to the target permission information, which can include the function introduction of the target permission, the convenience after opening and the like; the system can pop up a recommendation pop-up window at a specified position of the second interface to display the permission recommendation information, so that the user can select whether to apply for opening the target permission, thereby realizing intelligent recommendation and distribution of the permission. At the same time, the system can also count the permissions that the user has not used in the past 90 days and currently has, to generate an idle permission list and prompt the administrator.

[0048] Optionally, after performing “determining the permission information set corresponding to the user based on the role-based permission information”, the following method can be used but is not limited thereto, which includes: marking the user identifier of the user on the permission information set to obtain a target permission information set; storing the target permission information set at a target cache location, and the target permission information set is used to determine the access permission of the user on the operable control in the first interface.

[0049] In the embodiments of the present application, the user identifier can be identification information for identifying the identity of the user. For example, the user identifier in the embodiments of the present application can specifically include an account ID, a user name, a user number and the like.

[0050] In the embodiments of the present application, the target permission information set can be a permission information set marked with a user identifier, and the target permission information set can include association data of the user identifier and the permission information set.

[0051] For the embodiments of the present application, the target cache location can be a storage location for temporarily storing the target permission information set, and the target cache location can be a non-relational database, for example, a Redis database.

[0052] For example, the system can first associate the user identifier of the user with the target permission information set, for example, add a user identifier field in the head of the permission information set to form a target permission information set; then, the system stores the target permission information set in a target cache location, i.e., a Redis cache; the storage form of the target permission information set in the cache can be a JSON string, and the cache expiration time can be set to 2 hours, consistent with the user login token validity period; when the user accesses the first interface or other related interfaces again, the system can preferentially read the target permission information set corresponding to the user from the target cache location; when the user permission is changed, the system can actively delete the target permission information set corresponding to the target cache location.

[0053] Optionally, the embodiment can also adopt the following method, but is not limited thereto, and the method comprises: storing the permission update data of the first interface in the target database in response, determining at least one second user related to the permission update data; generating permission update information corresponding to the permission update data; and sending the permission update information to the at least one second user.

[0054] In the embodiment of the present application, the permission update data can be data generated after the permission configuration of the first interface is modified. For example, the permission update data in the embodiment of the present application specifically includes data corresponding to operations such as adding new permissions, deleting permissions, and adjusting permission ranges.

[0055] In the embodiment of the present application, the second user can be a user affected by the permission update data. For example, the second user in the embodiment of the present application can specifically be a user whose permission changes after the permission is updated, such as a user whose permission is added, deleted, or adjusted.

[0056] For the embodiment of the present application, the permission update information can be prompt information for informing the second user of the change in permission. For example, the permission update information in the embodiment of the present application can specifically include information such as permission change content, change time, and change impact.

[0057] For the embodiments of the present application, when the permission configuration of the first interface changes, the system will first store the corresponding permission update data into the target database; the system determines at least one second user affected by the permission update data based on the permission update data, and specifically can filter out all users corresponding to the role whose permission changes as the second user by querying the role-user association table and the role-permission association table in the target database; then, the system can generate permission update information corresponding to the permission update data to explicitly indicate the specific content of the permission change and the impact on the user; finally, the system sends the permission update information to the at least one second user through the WebSocket long connection, and the front end can pop up a prompt box to inform the user of the permission change or display a prompt mark in the upper right corner of the page to remind the user to check the permission update content after receiving the information.

[0058] Optionally, before performing "storing the permission update data in response to the first interface in the target database, and determining at least one target user related to the permission update data", the following method can be used but is not limited to this, which includes: determining the update user information and / or update role information corresponding to the permission update data in response to the first interface; storing the permission update data and the update user information and / or update role information in the target database.

[0059] In the embodiments of the present application, the update user information can be user information related to the permission update data. For example, the update user information in the embodiments of the present application can specifically include user identification, user name and other information related to the permission update operation.

[0060] In the embodiments of the present application, the update role information can be role information related to the permission update data. For example, the update role information in the embodiments of the present application can specifically include role identification, role name and other information related to the permission update operation.

[0061] In the embodiments of the present application, when the system receives the permission update data of the first interface, the system can first parse the permission update data to determine the corresponding update user information and / or update role information, wherein the update user information can be the user information of the user performing the permission update operation, and the update role information can be the role information related to the permission update operation; then, the system stores the above permission update data, update user information and / or update role information in the target database, which can be stored in the permission change log table. It should be noted that the system can ensure the atomicity of data storage through transactions during storage to avoid incomplete or erroneous data storage.

[0062] Exemplarily, the target database in the embodiments of the present application can specifically include a menu database, a role database or an account database, etc. The menu database is shown in Table 1, and can include a menu ID, a page name, a prefix icon, a display order, an associated component, an enable state, an access path, a parent page (ID), etc. The role database is shown in Table 2, and can include a role ID, a role name, a role value, an enable state, a list of accessible menus (ID), etc. The account database is shown in Table 3, and can include an account ID, an account name, an account password, a real name, an email, a description, an enable state, a homepage path, etc. The multi-table association can be used to store the user, role, menu and permission mapping relationship. If an account is associated with multiple roles, a new association table is needed, as shown in Table 4, which includes an ID, an account ID and a role ID.

[0063] Table 1

[0064] Table 2

[0065] Table 3

[0066] Table 4

[0067] As an optional mode, the embodiments of the present application further provide an example that the front-end visual configuration module is developed based on the Vue.js framework, and can include three graphical interactive pages of a menu management interface, a role management interface and an account management interface (i.e. the first interface or the second interface in the embodiments of the present application). Each interface realizes function reuse through component-based design, and the specific implementation steps are as follows: Step 1: Menu management interface implementation, interface layout: adopt the structure of left tree menu list + right form configuration, left side shows existing menu items (including hierarchical relationship), right side is menu item editing form (including "title", "icon selector", "sorting number", "route address", "whether to display" and other fields); configuration operation: administrator clicks the left menu item or "add menu" button, the right form automatically loads the metadata of the corresponding menu item (i.e. the permission update data in the embodiment of the application, which is empty when initially loaded); administrator inputs / modifies form fields (such as selecting icons to call the Icon component of Ant Design Vue to display the available icon library, and the sorting number is limited to positive integers through a numerical input box), and clicks the "save" button to trigger front-end validation (such as non-empty title and legal route address format); data submission: after passing the validation, the front end sends a POST request to the backend interface through Axios, and the request body carries parameters such as menu ID, title, icon code, sorting number, and route address; the backend returns a "success" identifier after processing is completed, and the front end refreshes the left tree list and prompts the configuration to take effect.

[0068] Step 2: Role management interface implementation, interface layout: role list (including role name, permission range description) + right permission configuration panel popup window (including "menu permission", "operation permission", "interface permission" three parts); permission configuration: administrator selects the left role, and the right popup window obtains the current permissions of the role through the backend interface; in the "menu permission" tab page, the front end displays all menus through a tree component, and the selected menu is marked by a checked state, and the administrator checks / unchecks the menu, which updates the menuIds list cached by the front end in real time; similarly, the "operation permission" tab page displays button-level permissions (such as "add", "delete", "export"), and the "interface permission" tab page displays interface URL lists, supporting fuzzy search filtering; conflict pre-detection: during configuration, the front end calls the "checkPermissionConflict" local function of the intelligent enhancement layer in real time, and inputs the permission list of the current role (such as detecting that the "submit" and "approval" permissions are checked at the same time, and popping up a prompt box "There is a risk of permission conflict, do you want to continue?"); data submission: click the "save permission" button, and the front end sends the updated menuIds, roleIds, etc. to the "api / management / v1 / updateRoleItem" and "api / management / v1 / updateAccountItem" interfaces through the POST request, and the backend returns success information after updating the role-permission association table, and the front end prompts the configuration to be completed.

[0069] As an optional way, the embodiment of the application also provides an example, such as Figure 3As shown, the real-time synchronization mechanism mainly relies on three parts, i.e., the backend monitoring of related operations, the message passing between the front and backends through the persistent connection, and the page update after the front end receives the notification, and the specific process is as follows: the backend will pre-set the monitoring rules related to the permission changes in the core business links of processing menu, role, and user related operations, and will actively trigger the corresponding permission change monitoring process when operations such as saving menu, modifying role permission, and adjusting user associated role are executed and it is ensured that the operation is completely completed; then, the special monitoring module will capture these permission changes, and then analyze which users (i.e., the second user in the embodiment of the application) will be affected by this change, for example, when the menu changes, it will find out all the users corresponding to the roles associated with the menu, when the role permission is adjusted, it will directly locate to the user associated with the role, and finally it will sort out the list of users to be notified.

[0070] Optionally, in terms of the connection between the front and backends, after the user logs in the system, the front end will automatically establish a persistent connection channel with the backend, the backend will first verify the legality of the user identity, and after confirming that it is correct, it will record the correspondence between the user and the connection channel to facilitate subsequent accurate message passing; when the backend monitors the permission changes and determines the affected users, it will send the notification that the permission has been updated to these users one by one through the previously established connection channel (i.e., the permission update information in the embodiment of the application). After the front end receives such a notification, it will pop up a prompt box to ask the user whether to refresh the page immediately, if the user chooses to refresh immediately, the page will be directly reloaded; if the user does not refresh temporarily, a prompt mark will be displayed in the upper right corner of the page to remind that there is an unapplied permission update; regardless of whether the user actively triggers the refresh or the page is reloaded by other subsequent operations, the page will request the latest permission information and accessible function paths from the background again, and then reconfigure the usable functions and access rules according to the newly obtained information, to ensure that the permission changes take effect after the page is refreshed, without the need to restart the entire system.

[0071] It should be noted that through actual testing, the time spent from submitting the permission modification operation to the front end page completing the refresh and applying the new permission is less than 10 seconds, and the permission update of commonly used functions such as menu display or hiding can even be applied within one second, which is more than 80% faster than the traditional permission update method.

[0072] As an optional way, the embodiment of the application also provides an example, as shown in Figure 4 As shown, the user permission modification process can include steps such as user login, calling the backend interface, verifying the username and password, extracting the account association ID, retrieving the accessible menu ID set according to the role ID, generating a route data structure containing path / icon / sorting, returning the structured route to the front end, dynamically rendering the menu interface by the front end, and user accessing the function modules within the permission.

[0073] Compared with the prior art, the embodiments of the application improve the operation experience and system use efficiency by adaptively adjusting the content of the operable control, intelligently recommend target permissions based on user operation behavior, optimize the allocation of permission resources, store the permission information set in cache, reduce the database query pressure, provide real-time push of permission update information to affected users, improve the real-time nature of permission management, provide synchronous storage of permission update associated information, and ensure the compliance and security of permission management.

[0074] Further, as a specific implementation of the method shown in Figure 1 and Figure 2 The embodiments provide a permission determination apparatus, as shown in Figure 5 The apparatus comprises a determination module 31, a generation module 32, and an update module 33.

[0075] The determination module 31 is configured to determine at least one role information corresponding to the user and the association relationship between the at least one role information and the first interface from a target database in response to the user's access request for the first interface. The generation module 32 is configured to generate role permission information corresponding to the at least one role information according to the association relationship. The determination module 31 is further configured to determine the permission information set corresponding to the user based on the role permission information. The update module 33 is configured to update the operable control in the first interface based on the permission information set to obtain a second page, and the second interface is used for the user to access.

[0076] In some examples of the embodiments, the update module 33 is specifically configured to determine the operation frequency of the operable control in the second interface by the user, determine the target operable content of the operable control according to the operation frequency, and update the operable control based on the target operable content.

[0077] In some examples of the embodiments, the update module 33 is further configured to determine the target permission information that is not opened by the user based on the operation frequency of the second interface by the user and the target operable content, generate permission recommendation information corresponding to the user according to the target permission information, and the permission recommendation information is used to recommend the user to request to open the target permission information.

[0078] In some examples of the embodiments, the determination module 31 is specifically configured to mark the user identifier of the user on the permission information set to obtain a target permission information set, and store the target permission information set in a target cache location, and the target permission information set is used to determine the access permission of the operable control in the first interface by the user.

[0079] In some examples of the present embodiment, the determining module 31 is specifically further configured to store the permission update data in the target database in response to the first interface, determine at least one second user related to the permission update data, generate permission update information corresponding to the permission update data, and send the permission update information to the at least one second user.

[0080] In some examples of the present embodiment, the determining module 31 is specifically further configured to determine update user information and / or update role information corresponding to the permission update data in response to the first interface, and store the permission update data and the update user information and / or the update role information in the target database.

[0081] It should be noted that other corresponding descriptions of the functions of the various functional units involved in the permission determination apparatus provided in the present embodiment can be referred to the corresponding descriptions in Figure 1 and Figure 2 , which will not be repeated here.

[0082] Based on the above-mentioned methods as shown in Figure 1 and Figure 2 , correspondingly, the present embodiment also provides a computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the above-mentioned methods as shown in Figure 1 and Figure 2 .

[0083] Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.), and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of various implementation scenarios of the present application.

[0084] As shown in Figure 6 is a hardware structure schematic diagram of an electronic device, which includes: at least one processor 401; and a memory 402 connected with the at least one processor 401 for permission determination; wherein the memory 402 stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned permission determination method.

[0085] Figure 6 in

[0086] The electronic device can further include an input device 403 and an output device 404.

[0087] The processor 401, memory 402, input device 403, and output device 404 can be connected via a bus or other means. Figure 6 Taking the example of a connection between China and Israel via a bus.

[0088] Memory 402, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the program instructions / modules corresponding to the permission determination method in the embodiments of this application, for example, Figure 1 and Figure 2 The method flow is shown. The processor 401 executes various functional applications and permission determinations by running non-volatile software programs, instructions, and modules stored in the memory 402, thereby implementing the permission determination method in the above embodiments.

[0089] The memory 402 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the permission determination method. Furthermore, the memory 402 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 402 may optionally include memory remotely located relative to the processor 401, and these remote memories may be connected via a network to the apparatus performing the permission determination method. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile permission determination networks, and combinations thereof.

[0090] Input device 403 can receive user clicks and generate signal inputs related to user settings and function control for permission determination methods. Output device 404 may include display devices such as a display screen.

[0091] One or more modules are stored in memory 402, and when run by one or more processors 401, the permission determination method in any of the above method embodiments is executed.

[0092] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0093] Those skilled in the art can understand that the above-mentioned entity device structure provided by the embodiment does not constitute a limitation on the entity device, and can include more or fewer components, or combine certain components, or different component arrangements.

[0094] The storage medium can also include an operating system, a network permission determination module. The operating system is a program for managing hardware and software resources of the above-mentioned entity device, supporting the running of information processing programs and other software and / or programs. The network permission determination module is used to realize the permission determination between the components in the storage medium, and the permission determination with other hardware and software in the information processing entity device.

[0095] Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware platform, or by hardware. By applying the scheme of the embodiment, compared with the prior art, the present embodiment accurately generates role permission information and integrates it into a user-specific permission set by associating the user role with the permission association relationship of the target interface, realizes the accuracy of permission determination; by dynamically updating the interface operable control based on the permission information set, realizing the real-time adaptation of the permission and the interface display, it can improve the user operation experience and the permission management efficiency; by adaptively adjusting the operable control content, it improves the operation experience and the system use efficiency; based on the intelligent recommendation of the target permission according to the user operation behavior, it can optimize the permission resource configuration; the permission information set is cached and stored, which reduces the database query pressure; real-time push permission update information to the affected users, which improves the real-time performance of the permission management; provide synchronous storage of permission update association information, which can guarantee the compliance and security of the permission management.

[0096] It should be noted that, in this document, relational terms such as“first” and“second”, and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms“comprises”,“comprising”, or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement“comprises a……” does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0097] The foregoing detailed description of the application has been presented for purposes of illustration and description. Various modifications and changes can be made to these embodiments without departing from the spirit and scope of the application. It is intended that the scope of the application should not be limited by the particular representative embodiments described above.

Claims

1. A method for determining permissions, characterized in that, include: In response to a user's request to access the first interface, at least one role information corresponding to the user and the association relationship between the at least one role information and the first interface are determined from the target database. Based on the aforementioned association, generate role permission information corresponding to the at least one role information; Determine the set of permission information corresponding to the user based on the role permission information; Based on the permission information set, the operable controls in the first interface are updated to obtain a second page, which is used by the user for access.

2. The method according to claim 1, characterized in that, After updating the operable controls in the first interface based on the permission information set to obtain the second page, the method further includes: Determine the frequency of the user's operations on the operable controls in the second interface; The target operable content of the operable control is determined based on the operation frequency, and the operable control is updated based on the target operable content.

3. The method according to claim 2, characterized in that, The method further includes: Based on the frequency of the user's operation on the second interface and the target operable content, determine the target permission information that the user has not activated; Based on the target permission information, permission recommendation information corresponding to the user is generated. The permission recommendation information is used to recommend that the user request to enable the target permission information.

4. The method according to claim 1, characterized in that, After determining the set of permission information corresponding to the user based on the role permission information, the method further includes: The user identifier of the user is marked on the permission information set to obtain the target permission information set; The target permission information set is stored in the target cache location, and the target permission information set is used to determine the user's access permissions to the operable controls in the first interface.

5. The method according to claim 1, characterized in that, The method further includes: In response to the permission update data of the first interface, the data is stored in the target database, and at least one second user associated with the permission update data is identified. Generate permission update information corresponding to the permission update data; The permission update information is sent to the at least one second user.

6. The method according to claim 5, characterized in that, Before storing the permission update data in response to the first interface in the target database and determining at least one target user associated with the permission update data, the method further includes: In response to the permission update data on the first interface, determine the updated user information and / or updated role information corresponding to the permission update data; The permission update data, as well as the updated user information and / or updated role information, are stored in the target database.

7. An access control device, characterized in that, include: The determination module is configured to, in response to a user's access request to the first interface, determine from the target database at least one role information corresponding to the user, and the association relationship between the at least one role information and the first interface. The generation module is configured to generate role permission information corresponding to the at least one role information based on the association relationship; The determination module is also configured to determine the set of permission information corresponding to the user based on the role permission information; The update module is configured to update the operable controls in the first interface based on the permission information set to obtain a second page, which is used by the user for access.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

9. An electronic device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

10. A computer program product, the computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

Images