Multi-source permission aggregation and dynamic inheritance decoupling permission management system and method
By constructing a three-tier permission storage structure and an inverted index module, the difficulties in tracing permissions from multiple sources, the low efficiency of decoupling independent permission pages, and the cache consistency issues in DevOps scenarios are resolved, achieving efficient and accurate permission management and improving system performance and response speed.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGZHOU CANWAY TECH CO LTD
- Filing Date
- 2026-04-20
- Publication Date
- 2026-05-26
AI Technical Summary
In DevOps scenarios, existing permission management systems suffer from problems such as difficulty in tracing permissions from multiple sources, low efficiency in dynamic decoupling between independent permission pages and parent pages, poor performance in batch permission changes, and low efficiency in ensuring cache consistency. In particular, they are unable to meet the needs of real-time querying and efficient collaboration under large data volumes.
The permission management system adopts multi-source permission aggregation and dynamic inheritance decoupling. By constructing a three-layer permission storage structure, a reverse index module, a permission aggregation module, a source tracing module, an inheritance decoupling module, and a cache synchronization module, it achieves accurate source tracing, independent page permission management, and efficient cache synchronization.
It enables precise tracking of multi-source permissions in a DevOps environment, improves the dynamic decoupling efficiency of independent page permissions, optimizes the performance of batch permission changes, and enhances cache consistency assurance, while significantly reducing response time and storage overhead.
Smart Images
Figure CN122087797A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of software development and DevOps technology, and in particular to a permission management system and method that decouples multi-source permission aggregation and dynamic inheritance. Background Technology
[0002] In enterprise-level DevOps development processes, the knowledge base system serves as the core platform for the accumulation and collaboration of development assets, carrying key development assets such as requirement documents, technical solutions, interface documents, test cases, and deployment manuals. Page-level collaborator permission management is a core function to ensure the security of development assets and promote efficient team collaboration. Existing technologies typically employ role-based access control (RBAC) or access control lists (ACLs), allowing users to add collaborators to pages and grant permissions. As the organizational structure of DevOps teams becomes more complex, the methods for adding collaborators are becoming increasingly diverse, mainly including: (1) adding a single user directly; (2) granting permissions in batches through user groups (such as "Front-end Development Group"); and (3) granting permissions in batches through departments (such as "Technology Center"). This multi-source authorization method brings about the following technical problems:
[0003] 1. Difficulty in tracing the source of permissions: When users need to view "collaborators added to the current page" (rather than collaborators automatically inherited through user groups / departments), existing technologies struggle to accurately distinguish the source of permissions. Existing solutions typically require filtering the entire dataset on the front end or performing post-processing through complex multi-table join queries, resulting in poor performance with large datasets and failing to meet the real-time query requirements of DevOps scenarios.
[0004] 2. Low efficiency of dynamic decoupling between independent permission pages and parent pages: In the knowledge base's page tree structure, child pages inherit collaborator permissions from the parent page by default. When a user performs a "cancel inheritance" operation on a child page, the child page needs to establish an independent permission management system. Existing technologies typically use a method of "copying a snapshot of the parent page's permissions + independent storage." When the page tree is deep or the number of collaborators is large, this leads to significant storage redundancy, complex permission synchronization, and high operation response latency.
[0005] 3. Performance bottleneck of cascading updates for batch permission changes: When the permissions of a user group or department change (e.g., the permission of the entire "Front-end Development Team" is upgraded from "View" to "Edit"), the permission status of all related pages needs to be updated. Traditional solutions use real-time cascading updates, iterating through the affected pages one by one to perform database update operations. When the number of pages is large, this can lead to serious database write bottlenecks and response delays, affecting the overall collaboration efficiency of the DevOps team.
[0006] 4. Low efficiency in ensuring cache consistency: When rendering the page tree, traditional solutions require a full refresh of permission data. With a large number of pages, this results in significant data transfer and high rendering latency. After permission changes, the cache invalidation mechanism struggles to accurately determine the affected scope, leading to a low cache hit rate.
[0007] In summary, existing solutions have limitations in areas such as multi-source permission tracing, dynamic decoupling of independent permission pages from their parent pages, performance of batch permission changes, and cache consistency assurance. This invention differs from conventional RBAC / ACL permission management solutions. Its core lies in constructing a permission management system that supports multi-source permission aggregation, precise source tracing, dynamic decoupling of independent page permissions from their parent pages, and efficient cache synchronization. It is suitable for knowledge asset permission management in complex DevOps collaborative environments. Summary of the Invention
[0008] This invention provides a permission management system and method that decouples multi-source permission aggregation and dynamic inheritance. The system aims to solve core problems in permission management for multi-source collaborators in DevOps scenarios, such as difficulty in tracing the source, low efficiency in decoupling independent permission pages from their parent pages, poor performance of cascading updates for batch permission changes, and low efficiency in ensuring cache consistency. Ultimately, it achieves efficient, accurate, and scalable multi-source collaborator permission management.
[0009] The technical solution adopted in this invention is as follows:
[0010] In a first aspect, the present invention provides a permission management system that decouples multi-source permission aggregation and dynamic inheritance, the system comprising a permission storage module, a reverse index module, a permission aggregation module, a source tracing module, an inheritance decoupling module, and a cache synchronization module; wherein, The permission storage module is used to construct a three-tiered permission storage structure, which includes a direct user storage area, a user group mapping storage area, and a department mapping storage area. The user group mapping storage area and the department mapping storage area adopt a non-expanded storage method and use bitmap indexing to achieve constant time complexity for user ownership determination. The reverse index module is used to build a two-level hash reverse index for each user group and department. When the permissions of a user group or department change, the affected page is accurately located through the reverse index, and the permission records are updated asynchronously in batches through a message queue. The permission aggregation module is used to perform a union operation on the permission records of the three-layer storage area in response to the collaborator permission query request, and obtain an aggregated collaborator permission list, wherein multiple permission records of the same user are merged by bitwise OR operation; The source tracing module is used to respond to a collaborator source tracing request by calculating the difference between the aggregated collaborator permission list and the inheritance set to obtain the directly added collaborator permission list. The inheritance decoupling module is used to maintain an inheritance flag and a custom permission mask for each page in the page tree. When a child page cancels inheritance, the inheritance flag is set to valid and the permission inheritance chain with the parent page is broken. When a child page resumes inheritance, the inheritance chain is re-established and the parent page's permissions and the custom permission mask are merged. The cache synchronization module is used to maintain a three-layer version number for each page, including its own version number, inherited version number, and aggregate version number. When the page permissions change, the inherited version number of the relevant child pages is updated through the inheritance chain version number propagation mechanism. When the front end makes a request, incremental synchronization is achieved by comparing the aggregate version number. The inheritance chain version number propagation mechanism includes: when the parent page permissions change, only child pages with an inheritance flag of 0 are traversed and their inherited version numbers are updated, while child pages with an inheritance flag of 1 are not affected.
[0011] In some embodiments, the permission storage module includes a direct user storage unit, a user group mapping storage unit, a department mapping storage unit, and a bitmap index unit; wherein, the direct user storage unit is used to store collaborator records added directly at the user level; the user group mapping storage unit is used to store authorization records added at the user group level, using a non-expanded storage method; the department mapping storage unit is used to store authorization records added at the department level, using a non-expanded storage method; the bitmap index unit is used to construct a fixed-length bitmap for each user group and department, where each bit corresponds to a hash mapping of a user ID, and permission determination is performed using a bitwise AND operation to achieve constant time complexity.
[0012] In some embodiments, the reverse index module includes an index building unit and a batch update unit; wherein, the index building unit uses a Redis Hash structure to store the reverse index, with the key being group_page_index:{group_id} or dept_page_index:{dept_id}, the field being the page identifier, and the value being a timestamp; the reverse index is maintained in real time when user groups or departments are authorized to add, modify, or delete; the batch update unit is used to obtain a list of affected pages based on the reverse index when user group or department permissions change, generate a permission update task and send it to a message queue, and after the consumer updates the permission records in batches, increment the aggregate version number of the affected pages.
[0013] In some embodiments, the permission aggregation module includes a direct user query unit, a user group bitmap determination unit, a department bitmap determination unit, and a merging unit; wherein, the direct user query unit is used to obtain user-level permission records from the direct user storage area; the user group bitmap determination unit is used to obtain user group-level authorization records from the user group mapping storage area, and determine whether a user belongs to the user group through a bitwise AND operation of the bitmap index, with a constant time complexity; the department bitmap determination unit is used to obtain department-level authorization records from the department mapping storage area, and determine whether a user belongs to the department through a bitwise AND operation of the bitmap index, with a constant time complexity; the merging unit is used to perform a union of the three permission records obtained by the direct user query unit, the user group-level authorization records obtained by the user group bitmap determination unit, and the department-level authorization records obtained by the department bitmap determination unit, and to perform a bitwise OR operation on multiple permission records of the same user.
[0014] In some embodiments, the source tracing module includes a full set acquisition unit, an inheritance set acquisition unit, and a difference set operation unit; wherein, the full set acquisition unit is used to acquire the complete set of collaborator permissions output by the permission aggregation module; the inheritance set acquisition unit is used to acquire the set of collaborator permissions indirectly obtained through the user group mapping storage area and the department mapping storage area; the difference set operation unit uses a hash set to perform difference set operation to obtain the set of collaborator permissions to be directly added.
[0015] In some embodiments, the inheritance decoupling module includes an inheritance flag management unit, a custom permission storage unit, and a permission calculation unit; wherein, the inheritance flag management unit is used to maintain the inheritance flag bit of each page, where 0 indicates inheritance of parent page permissions and 1 indicates cancellation of inheritance; the custom permission storage unit is used to store the custom permission mask of the page when inheritance is cancelled; the permission calculation unit is used to calculate the effective permission mask = parent page effective permission mask | custom permission mask when the inheritance flag bit is 0; and the effective permission mask equals the custom permission mask when the inheritance flag bit is 1.
[0016] In some embodiments, the cache synchronization module includes a version number maintenance unit and an incremental synchronization unit. The version number maintenance unit maintains three layers of version numbers for each page: its own version number, stored in Redis with the key `page_self_version:{page_id}`, recording the number of changes to the page's own permissions; an inherited version number, stored in Redis with the key `page_inherit_version:{page_id}`, recording the number of changes to permissions on the inheritance chain; and an aggregate version number, stored in Redis with the key `page_agg_version:{page_id}`, which is the bitwise OR result of the own version number and the inherited version number. The incremental synchronization unit carries the cached aggregate version number mapping table when the frontend requests the page tree. The server compares the current aggregate version number of each page with the cached version number and only returns permission data for pages with inconsistent version numbers.
[0017] Secondly, the present invention provides a permission management method that decouples multi-source permission aggregation and dynamic inheritance, comprising the following steps: Step 1: Construct a three-tiered permission storage structure, including a direct user storage area, a user group mapping storage area, and a department mapping storage area. Use non-expanded storage and bitmap indexing to achieve constant time complexity for user ownership determination. Step 2: Build a secondary hash inverted index for each user group and department. When permissions change, locate the affected page through the inverted index and update it asynchronously in batches through a message queue. Step 3: In response to the collaborator's permission query request, perform a union operation on the three-level storage area to merge multiple permissions of the same user through a bitwise OR operation; Step 4: In response to the collaborator source tracing request, calculate the difference between the aggregated permission list and the inherited set to obtain the directly added collaborator permission list; Step 5: Maintain an inheritance flag and a custom permission mask for each page in the page tree to achieve dynamic inheritance and decoupling of permissions between child pages and parent pages; Step 6: Maintain a three-level version number for each page and achieve incremental synchronization through the inheritance chain version number propagation mechanism. When the parent page permissions change, only the child pages with the inheritance flag of 0 are traversed to update their inheritance version number.
[0018] The advantages or beneficial effects of the above technical solutions include at least the following:
[0019] 1. Achieved precise source tracing for multi-source permissions: By combining a three-layer independent storage structure with difference operations, it can accurately distinguish between directly added and indirectly inherited collaborator permissions through user groups / departments, solving the problem of difficult source tracing for multi-role permissions in DevOps scenarios. The difference operation is implemented using a hash set, with a time complexity of O(n), and a response time of less than 10ms with a scale of 1000 collaborators.
[0020] 2. Achieved efficient dynamic decoupling between independent page permissions and parent page permissions: Through the design of inheriting flags + custom permission masks, when a child page cancels inheritance, it does not need to copy the complete permission data of the parent page; it only needs to store a flag and a permission mask. In a page with 50 collaborators, storage overhead is reduced by approximately 70%; when restoring inheritance, no recalculation is required, and operation response time is reduced by approximately 85%.
[0021] 3. Performance optimization for batch permission changes: By using a two-level hash reverse index to accurately locate affected pages and combining it with asynchronous message queue processing, the impact of user group permission changes has been optimized from "full database scan" to "precise location". In a test with 100,000 pages, the permission change response time was reduced from an average of 3.2 seconds to 0.15 seconds, and the database write pressure was reduced by approximately 95%.
[0022] 4. Achieved highly efficient cache consistency guarantee: Through a three-layer version number design (own version number, inherited version number, and aggregate version number), combined with the inheritance chain version number propagation mechanism, accurate incremental synchronization of permission data was achieved. The amount of data transmitted during page tree permission refresh was reduced by an average of approximately 99.5%, and the average waiting time for users to switch pages was reduced by approximately 90%. Attached Figure Description
[0023] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the described drawings are only a part of the embodiments of the present invention, and not all of them. Based on the drawings in the present invention, those skilled in the art can obtain other related drawings without creative effort.
[0024] Figure 1 This is a schematic diagram of the structure of a permission management system that decouples multi-source permission aggregation and dynamic inheritance according to the present invention; Figure 2 This is a flowchart illustrating a permission management method based on the decoupling of multi-source permission aggregation and dynamic inheritance according to the present invention. Detailed Implementation
[0025] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of this application. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.
[0026] As attached Figure 1 As shown, this invention provides a permission management system that combines multi-source permission aggregation with dynamic inheritance decoupling. The system includes a permission storage module, a reverse index module, a permission aggregation module, a source tracing module, an inheritance decoupling module, and a cache synchronization module. The following provides a detailed description of each module:
[0027] 1. Permission storage module The permission storage module is used to construct a three-tiered permission storage structure. The three tiers include a direct user storage area, a user group mapping storage area, and a department mapping storage area. The user group mapping storage area and the department mapping storage area use a non-expanded storage method and achieve constant-time user attribution determination through bitmap indexing. This module includes a direct user storage unit, a user group mapping storage unit, a department mapping storage unit, and a bitmap indexing unit. (1) Direct user storage unit, used to store collaborator records added directly through the user dimension; (2) User group mapping storage unit, used to store authorization records added through the user group dimension, using a non-expanded storage method; (3) Department mapping storage unit, used to store authorization records added through the department dimension, using a non-expanded storage method; (4) Bitmap index unit, used to build a fixed-length bitmap for each user group and department. Each bit corresponds to a hash mapping of a user ID. Permission determination is achieved by bitwise AND operation to achieve constant time complexity.
[0028] 2. Inverted Index Module The reverse index module is used to build a two-level hash reverse index for each user group and department. When the permissions of a user group or department change, the affected page is accurately located through the reverse index, and the permission records are updated asynchronously in batches via a message queue. This module includes an index building unit and a batch update unit. (1) Index building unit: Redis Hash structure is used to store the reverse index, the key is group_page_index:{group_id} or dept_page_index:{dept_id}, the field is the page identifier, and the value is the timestamp; the reverse index is maintained in real time when user groups or departments are authorized to add, modify, or delete. (2) Batch update unit, used to obtain the list of affected pages based on the reverse index when the permissions of user groups or departments change, generate permission update tasks and send them to the message queue. After the consumer updates the permission records in batches, it increments the aggregate version number of the affected pages.
[0029] 3. Permission Aggregation Module The permission aggregation module, in response to collaborator permission query requests, performs a union operation on the permission records of the three-layer storage area to obtain an aggregated list of collaborator permissions. Multiple permission records for the same user are merged using a bitwise OR operation. This module includes a direct user query unit, a user group bitmap determination unit, a department bitmap determination unit, and a merging unit. (1) Direct user query unit, used to retrieve user-level permission records from the direct user storage area; (2) User group bitmap determination unit, used to obtain user group-level authorization records from user group mapping storage area, and determine whether a user belongs to the user group by bitwise AND operation of bitmap index, with constant time complexity; (3) Department bitmap determination unit, used to obtain department-level authorization records from the department mapping storage area, and determine whether the user belongs to the department through bitwise AND operation of bitmap index, with constant time complexity; (4) Merging unit, used to merge the three parts of permission records: user-level permission records obtained by the direct user query unit, user group-level authorization records obtained by the user group bitmap determination unit, and department-level authorization records obtained by the department bitmap determination unit, and to perform bitwise OR operation on multiple permission records of the same user.
[0030] 4. Source Traceability Module The source tracing module is used to respond to collaborator source tracing requests by calculating the difference between the aggregated collaborator permission list and the inheritance set to obtain the directly added collaborator permission list; this module includes a full set acquisition unit, an inheritance set acquisition unit, and a difference operation unit; wherein... (1) The complete set acquisition unit is used to acquire the complete set of all collaborator permissions output by the permission aggregation module; (2) Inheritance set acquisition unit, used to acquire the set of collaborator permissions indirectly obtained through user group mapping storage area and department mapping storage area; (3) Difference operation unit: The difference operation is implemented using a hash set to obtain the set of collaborator permissions to be added directly.
[0031] 5. Inheritance Decoupling Module The inheritance decoupling module maintains an inheritance flag and a custom permission mask for each page in the page tree. When a child page cancels inheritance, the inheritance flag is set to valid, and the permission inheritance chain with the parent page is broken. When a child page resumes inheritance, the inheritance chain is re-established, and the parent page's permissions and the custom permission mask are merged. This module includes an inheritance flag management unit, a custom permission storage unit, and a permission calculation unit. (1) Inheritance flag management unit, used to maintain the inheritance flag bit of each page, 0 indicates inheritance of parent page permissions, 1 indicates cancellation of inheritance; (2) A custom permission storage unit is used to store the custom permission mask of the page when inheritance is canceled; (3) Permission calculation unit, used to calculate the effective permission mask = parent page effective permission mask | custom permission mask when the inheritance flag is 0; when the inheritance flag is 1, the effective permission mask is equal to the custom permission mask.
[0032] 6. Cache synchronization module The cache synchronization module maintains a three-tiered version number for each page, including its own version number, inherited version number, and aggregate version number. When page permissions change, the inherited version number of the relevant child pages is updated through an inheritance chain version number propagation mechanism. Incremental synchronization is achieved by comparing the aggregate version number during frontend requests. The inheritance chain version number propagation mechanism includes: when the parent page permissions change, only child pages with an inheritance flag of 0 are traversed, and their inherited version numbers are updated; child pages with an inheritance flag of 1 are unaffected. This module includes a version number maintenance unit and an incremental synchronization unit. (1) Version number maintenance unit, used to maintain three levels of version numbers for each page: self version number, stored in Redis, key is page_self_version:{page_id}, which records the number of times the page's own permissions have changed; inherited version number, stored in Redis, key is page_inherit_version:{page_id}, which records the number of times permissions have changed on the inheritance chain; aggregate version number, stored in Redis, key is page_agg_version:{page_id}, which is the bitwise OR result of self version number and inherited version number; (2) Incremental synchronization unit, used to carry the cached aggregate version number mapping table when the front end requests the page tree. The server compares the current aggregate version number of each page with the cached version number and only returns the permission data of pages with inconsistent version numbers.
[0033] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments. This embodiment takes the collaborator permission management on the "Project A Technical Solution" page of an enterprise DevOps knowledge base system as an example to illustrate the system's working process.
[0034] Example: Collaborator Permission Management on the DevOps Knowledge Base Page
[0035] 1. Permission storage and inverted index construction (system initialization) The system first constructs a three-tier storage structure and then builds inverted indexes for each user group and department: (1) Example of a direct user storage area record: Add Product Manager U1 (Zhang San) directly on page P (Project A Technical Solution) and grant him viewing and editing permissions (mask=3); (2) Example of user group mapping storage area record: Page P is granted viewing permissions (mask=1) through user group G1 (front-end development team) and a bitmap index is built; The inverted index records group_page_index:G1 containing page P; (3) Example of department mapping storage area record: Page P is authorized by department D1 (Technical Center) to grant comment permissions (mask=4) and build a bitmap index; The inverted index record dept_page_index:D1 contains page P.
[0036] 2. Collaborator permission aggregation query (user requests to view all collaborators) (1) When a user requests to view all collaborators on page P, the system performs permission aggregation: (2) Obtain from direct user storage: U1 (mask=3); (3) From the user group mapping storage area, determine that front-end development groups U2 and U3 belong to the group through bitmap index, and obtain mask=1 for each; (4) From the department mapping storage area, determine that the technical center U4, U5 and U1 belong to the department through the bitmap index, and obtain mask=4 for each; (5) After merging, for U1, calculate the final mask = 3 | 4 = 7 (view + edit + comment); (6) Return the complete list of collaborators.
[0037] 3. Collaborator source tracing (users click "View all collaborators") When a user clicks the "View all collaborators" button and requests to view "additional collaborators added on the current page": (1) The universal set S_all contains U1, U2, U3, U4, and U5; (2) The inheritance set S_inherited contains U2, U3, U4, and U5; (3) The difference set S_direct = {U1} means that the only collaborator added directly is U1.
[0038] In the front-end interface, U1 is marked as "Add directly", U2 and U3 are marked as "Add through the front-end development team", and U4 and U5 are marked as "Add through the technology center".
[0039] 4. Disable inheritance of page permissions (subpages can be managed independently) Assuming page P is the parent page, and child page C inherits the permissions of P by default. When the user performs the "cancel inheritance" operation on child page C: (1) The system sets page C.inherit_flag to 1; (2) Set page C.custom_permission_mask to the currently valid permission mask; (3) Permission changes on page C are no longer affected by the parent page P; (4) Create a separate entry for page C in the reverse index.
[0040] 5. Batch update of user group permissions (optimization of permission changes) (1) When the administrator upgrades the permissions of the front-end development group (G1) from "view" (mask=1) to "edit" (mask=2): (2) The system quickly locates the list of affected pages (including page P and all related pages) based on the inverted index group_page_index:G1. (3) Generate a permission update task and send it to the message queue; (4) The consumer asynchronously updates the permission_mask field of the corresponding record in the group_permission table; (5) After the update is completed, increment the aggregate version number of the affected pages.
[0041] 6. Incremental synchronization of three-level version numbers (cache consistency) Suppose page P changes its own permissions: (1)page_self_version:{P} += 1 (2) page_agg_version:{P} = page_self_version:{P} | page_inherit_version:{P} Assuming the parent page Q's permissions change, the child page P's inherit_flag is set to 0: (1)page_inherit_version:{P} += 1 (2) page_agg_version:{P} = page_self_version:{P} | page_inherit_version:{P} When rendering the front-end page tree, a request to the server is sent carrying a cached version number mapping table. After comparing the aggregated version numbers, the server only returns page data for which permissions have changed, and the front-end then merges and updates the data.
[0042] As another embodiment, the present invention provides a permission management method that decouples multi-source permission aggregation and dynamic inheritance, as shown in the appendix. Figure 2 As shown, the process includes the following steps: S101: Construct a three-tiered permission storage structure, including a direct user storage area, a user group mapping storage area, and a department mapping storage area. Use non-expanded storage and bitmap indexing to achieve constant-time complexity user ownership determination. S102: Build a secondary hash reverse index for each user group and department. When permissions change, locate the affected page through the reverse index and update it asynchronously in batches through a message queue. S103: In response to a collaborator's permission query request, perform a union operation on the three-level storage area to merge multiple permissions of the same user through a bitwise OR operation; S104: In response to the collaborator source tracing request, calculate the difference between the aggregated permission list and the inherited set to obtain the directly added collaborator permission list; S105: Maintain an inheritance flag and a custom permission mask for each page in the page tree to achieve dynamic inheritance and decoupling of permissions between child pages and parent pages; S106: Maintain a three-level version number for each page and achieve incremental synchronization through the inheritance chain version number propagation mechanism. When the parent page permissions change, only the child pages with the inheritance flag bit set to 0 are traversed to update their inheritance version number.
[0043] The embodiments described above are merely examples of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.
Claims
1. A permission management system that decouples multi-source permission aggregation and dynamic inheritance, characterized in that, The system includes a permission storage module, a reverse index module, a permission aggregation module, a source tracing module, an inheritance decoupling module, and a cache synchronization module; among which, The permission storage module is used to construct a three-tiered permission storage structure, which includes a direct user storage area, a user group mapping storage area, and a department mapping storage area. The user group mapping storage area and the department mapping storage area adopt a non-expanded storage method and use bitmap indexing to achieve constant time complexity for user ownership determination. The reverse index module is used to build a two-level hash reverse index for each user group and department. When the permissions of a user group or department change, the affected page is accurately located through the reverse index, and the permission records are updated asynchronously in batches through a message queue. The permission aggregation module is used to perform a union operation on the permission records of the three-layer storage area in response to the collaborator permission query request, and obtain an aggregated collaborator permission list, wherein multiple permission records of the same user are merged by bitwise OR operation; The source tracing module is used to respond to a collaborator source tracing request by calculating the difference between the aggregated collaborator permission list and the inheritance set to obtain the directly added collaborator permission list. The inheritance decoupling module is used to maintain an inheritance flag and a custom permission mask for each page in the page tree. When a child page cancels inheritance, the inheritance flag is set to valid and the permission inheritance chain with the parent page is broken. When a child page resumes inheritance, the inheritance chain is re-established and the parent page's permissions and the custom permission mask are merged. The cache synchronization module is used to maintain a three-layer version number for each page, including its own version number, inherited version number, and aggregate version number. When the page permissions change, the inherited version number of the relevant child pages is updated through the inheritance chain version number propagation mechanism. When the front end makes a request, incremental synchronization is achieved by comparing the aggregate version number. The inheritance chain version number propagation mechanism includes: when the parent page permissions change, only child pages with an inheritance flag of 0 are traversed and their inherited version numbers are updated, while child pages with an inheritance flag of 1 are not affected.
2. The permission management system with decoupling of multi-source permission aggregation and dynamic inheritance according to claim 1, characterized in that, The permission storage module includes a direct user storage unit, a user group mapping storage unit, a department mapping storage unit, and a bitmap index unit; wherein... The direct user storage unit is used to store collaborator records added directly through the user dimension; The user group mapping storage unit is used to store authorization records added through the user group dimension, and adopts a non-expanded storage method; The department mapping storage unit is used to store authorization records added through the department dimension, and adopts a non-expanded storage method; The bitmap index unit is used to construct a fixed-length bitmap for each user group and department. Each bit corresponds to a hash mapping of a user ID. Permission determination is achieved in constant time complexity through bitwise AND operations.
3. The permission management system with decoupling of multi-source permission aggregation and dynamic inheritance according to claim 1, characterized in that, The reverse index module includes an index building unit and a batch update unit; wherein... The index building unit uses a Redis Hash structure to store the reverse index, with the key being group_page_index:{group_id} or dept_page_index:{dept_id}, the field being the page identifier, and the value being the timestamp; the reverse index is maintained in real time when user groups or departments are authorized to add, modify, or delete. The batch update unit is used to obtain a list of affected pages based on the reverse index when the permissions of user groups or departments change, generate a permission update task and send it to the message queue. After the consumer updates the permission records in batches, it increments the aggregate version number of the affected pages.
4. The permission management system with decoupling of multi-source permission aggregation and dynamic inheritance according to claim 1, characterized in that, The permission aggregation module includes a direct user query unit, a user group bitmap determination unit, a department bitmap determination unit, and a merging unit; wherein... The direct user query unit is used to retrieve user-level permission records from the direct user storage area; The user group bitmap determination unit is used to obtain user group-level authorization records from the user group mapping storage area, and determine whether a user belongs to the user group through bitwise AND operation of the bitmap index, with a time complexity of constant time complexity. The department bitmap determination unit is used to obtain department-level authorization records from the department mapping storage area and determine whether a user belongs to the department through bitwise AND operation of the bitmap index, with a time complexity of constant time complexity. The merging unit is used to merge the user-level permission records obtained by the direct user query unit, the user group-level authorization records obtained by the user group bitmap determination unit, and the department-level authorization records obtained by the department bitmap determination unit, and to perform a bitwise OR operation on multiple permission records of the same user.
5. The permission management system with decoupling of multi-source permission aggregation and dynamic inheritance according to claim 1, characterized in that, The source tracing module includes a complete set acquisition unit, an inheritance set acquisition unit, and a difference set operation unit; wherein... The complete set acquisition unit is used to acquire the complete set of all collaborator permissions output by the permission aggregation module; The inheritance set acquisition unit is used to acquire the set of collaborator permissions indirectly obtained through the user group mapping storage area and the department mapping storage area. The difference operation unit uses a hash set to perform the difference operation, and obtains the set of collaborator permissions to be added directly.
6. The permission management system with decoupling of multi-source permission aggregation and dynamic inheritance according to claim 1, characterized in that, The inheritance decoupling module includes an inheritance flag management unit, a custom permission storage unit, and a permission calculation unit; wherein... The inheritance flag management unit is used to maintain the inheritance flag bit of each page, where 0 indicates that the parent page's permissions are inherited and 1 indicates that inheritance is canceled. The custom permission storage unit is used to store the custom permission mask of the page when inheritance is canceled; The permission calculation unit is used to calculate the effective permission mask = parent page effective permission mask | custom permission mask when the inheritance flag is 0; and the effective permission mask equals the custom permission mask when the inheritance flag is 1.
7. The permission management system with decoupling of multi-source permission aggregation and dynamic inheritance according to claim 1, characterized in that, The cache synchronization module includes a version number maintenance unit and an incremental synchronization unit; wherein... The version number maintenance unit is used to maintain three levels of version numbers for each page: The page's own version number is stored in Redis with the key page_self_version:{page_id}, which records the number of times the page's own permissions have been changed; The inherited version number is stored in Redis with the key page_inherit_version:{page_id}, which records the number of permission changes on the inheritance chain; The aggregate version number is stored in Redis with the key page_agg_version:{page_id}, which is the bitwise OR result of its own version number and inherited version numbers; The incremental synchronization unit is used to carry the cached aggregate version number mapping table when the front-end requests the page tree. The server compares the current aggregate version number of each page with the cached version number and only returns the permission data of pages with inconsistent version numbers.
8. A permission management method that decouples multi-source permission aggregation and dynamic inheritance, applied to the permission management system that decouples multi-source permission aggregation and dynamic inheritance as described in any one of claims 1-7, characterized in that, include: Step 1: Construct a three-tiered permission storage structure, including a direct user storage area, a user group mapping storage area, and a department mapping storage area. Use non-expanded storage and bitmap indexing to achieve constant time complexity for user ownership determination. Step 2: Build a secondary hash inverted index for each user group and department. When permissions change, locate the affected page through the inverted index and update it asynchronously in batches through a message queue. Step 3: In response to the collaborator's permission query request, perform a union operation on the three-level storage area to merge multiple permissions of the same user through a bitwise OR operation; Step 4: In response to the collaborator source tracing request, calculate the difference between the aggregated permission list and the inherited set to obtain the directly added collaborator permission list; Step 5: Maintain an inheritance flag and a custom permission mask for each page in the page tree to achieve dynamic inheritance and decoupling of permissions between child pages and parent pages; Step 6: Maintain a three-level version number for each page and achieve incremental synchronization through the inheritance chain version number propagation mechanism. When the parent page permissions change, only the child pages with the inheritance flag of 0 are traversed to update their inheritance version number.