A method for performance optimization of a document system
By constructing a tree-like directory and permission bitmap, combined with virtual permission markers and preloading technology, the performance bottleneck of permission management in the document system was solved, achieving fast permission query and an optimized user experience.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA DESIGN DIGITAL TECH CO LTD
- Filing Date
- 2026-02-09
- Publication Date
- 2026-05-29
AI Technical Summary
Existing document systems suffer from time-consuming recursive calculations, huge data storage space for permissions, and limited scalability in permission management. In particular, the permission calculation logic is complex in complex scenarios, which affects user experience and system performance.
Construct a tree-like directory, allocate unique bits to generate a permission bitmap, and store real permission records and virtual permission markers in the database. The visibility problem of intermediate directories in the tree structure is solved by virtual permission markers. Permission data is preloaded and the directory structure is rendered differently.
By pre-storing virtual permission tags, the system can directly obtain the complete tree structure, avoiding real-time calculations, improving permission query efficiency and user experience, and optimizing document management performance.
Smart Images
Figure CN122113133A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of access control, and in particular to a method for performance optimization of a document system. Background Technology
[0002] In current document systems, as time goes on, the document catalogs managed by enterprises are increasing on a large scale, and access permissions for files are frequently required.
[0003] The industry primarily employs two permission recording methods for document system permission management. The first approach is recursive authorization, where granting permissions to a directory recursively applies the same permissions to all subdirectories and files within that directory. The advantage of this approach is its flexibility in permission recording, supporting complex scenarios where different resources within the same directory have different permissions. However, this approach has certain drawbacks in environments with massive amounts of files: permission operations require extensive recursive calculations, which are extremely time-consuming; recording permissions separately for each file and directory results in huge storage space consumption for permission data, limiting system scalability.
[0004] The second approach is the path inheritance model, where permission information is only recorded on the authorized directory node, and the permissions of subdirectories and files are determined by calculating the parent node's permissions at runtime. The advantage of this approach is its fast authorization speed and small data storage space for permissions. However, its disadvantage is that the permission calculation logic becomes extremely complex when different sub-resources within the same directory require different permissions.
[0005] In document permission systems, there's at least one requirement: displaying all folders and files a user has permissions to on the client side. When granting permissions to the / D directory, typically the user is also granted the same permissions to the / D directory and its subfolder / E, or only / D can be granted permissions. When displaying this on the client side, due to the tree-structured data, even if the / A / C directories aren't authorized, the user must still have permissions to the / D subfolder under / A / C, so the / A / C directory must be visible. When the permission service system queries the user's authorized data, since neither of these methods records the permissions for / A / C, this record must be completed for the client to render a normal tree structure. Completing this data is computationally difficult and has very poor performance in complex and flexible scenarios.
[0006] Solving this technical problem is a technical challenge that needs to be overcome by those skilled in the art. Summary of the Invention
[0007] This application provides a method for optimizing the performance of a document system, thereby at least partially solving the above-mentioned technical problems.
[0008] To achieve the above objectives, according to a first aspect of this application, a method for optimizing the performance of a document system is provided, comprising: Construct a tree-like directory structure; the tree-like directory includes a root directory, intermediate parent directories, and leaf child directories; assign unique bits to each permission type in the tree-like directory to construct a permission bitmap; When granting permissions to a subdirectory, virtual permission markers are generated in all parent directories of the subdirectory; the virtual permission markers are stored separately from the real permission records and the virtual permission markers cannot coexist with the real permission records in the same directory node; the virtual permission markers are only used for directory structure display and cannot be used for file operations. Storing both real permission records and virtual permission markers in the database allows for direct retrieval of the complete tree-like directory structure during permission queries. Generate a cache identifier for permission data based on the user ID and directory path, and preload the user's permission data in the current directory and its subdirectories; When a user requests access to a resource, complete permission data containing virtual permission flags and real permission records is returned, and a tree-like directory is rendered differently based on the permission type.
[0009] Optionally, the generation and management of the virtual permission tokens includes the following steps: When granting real permissions to a subdirectory, all parent directories of that subdirectory are identified; the parent directories include the direct parent directory, all indirect parent directories, and the root directory. For each identified parent directory, check whether the parent directory already has a real permission record; if no real permission record exists, mark the parent directory as a candidate virtual permission mark directory. For each candidate virtual permission-marked directory, verify that it is not a leaf subdirectory; for the root directory, verify that it has at least one subdirectory with real permission records; for intermediate parent directories, verify that it has at least one subdirectory with real permission records that is not directly associated with a file. A virtual permission tag is generated for the candidate virtual permission tag directories that have passed the verification; the unique identifier of the virtual permission tag is generated by performing a combined hash operation on the directory path, user ID and system timestamp. When it is detected that virtual permission markers and real permission records coexist in the same intermediate parent directory or root directory, remove the virtual permission markers on the intermediate parent directory or root directory and retain the real permission records. When all real permission records of all subdirectories under a certain intermediate parent directory or root directory have been removed and no real permission records exist, remove the virtual permission marker of that intermediate parent directory or root directory. When adding a real permission record to an intermediate parent directory or a subdirectory of the root directory that already has a virtual permission tag, the existing virtual permission tag is retained and reused.
[0010] Optionally, a unique bit is assigned to each permission type on the tree directory to construct a permission bitmap, including: Initialize the permission bitmap configuration table and assign unique bit positions to different permission types; bit 0 is assigned to view permission, bit 1 to download permission, bit 2 to edit permission, and bit 3 to delete permission. Define a minimum set of permissions for each directory operation; the minimum set of permissions represents the lowest combination of permissions required to perform a specific operation. Convert multiple user permission types in a specific directory into corresponding bit settings to generate a permission bitmap represented by a single integer value.
[0011] Optionally, when granting permissions to a subdirectory, virtual permission markers are generated in all parent directories of the subdirectory, including: Receive permission change requests and parse the target directory, user ID, and requested permission type set; Obtain the current real permission records and associated virtual permission markers of the target directory, and construct a snapshot of the permission state before the change; Compare the requested permissions with the current permissions, and generate a set of permission increments and a set of permission decrements; Update the permission bitmap for the incremental permission set based on the newly added permission types, while retaining the original permissions unchanged; Check permission dependencies on the permission reduction set; if the removed permission is the basis for other user permissions, trigger the permission dependency evaluation process. Update the virtual permission marker reference counter for each affected directory node. When the reference counter reaches zero, trigger the virtual permission marker cleanup process. When the directory structure is reorganized, a directory dependency graph is built and the permission update order is determined to ensure that updates are performed layer by layer from the root directory to the leaf subdirectories. Generate a reversible permission change operation log to record the state before the change, the change operation, and the state after the change.
[0012] Optionally, a cache identifier for permission data is generated based on the user ID and directory path, including: Receive user ID and directory path as input, combine them with the current permission data version number, and generate a raw key in the format of ; The MD5 hash algorithm is applied to the original key to generate a 16-byte binary hash value as a cache identifier.
[0013] Optionally, preload user permission data in the current directory and its subdirectories, including: Collect and analyze the frequency and depth of user access to each directory within a preset historical time period. The directories are divided into three categories: high-frequency access directories, medium-frequency access directories, and low-frequency access directories. Configure a full subtree preloading strategy for frequently accessed directories to preload permission data for all levels of subdirectories under that directory; Configure a partial subtree preloading strategy for the mid-frequency access directory to preload the subdirectory permission data under this directory until the first virtual permission marker node is encountered; Configure a minimal preloading strategy for infrequently accessed directories, loading only the permission data of the current directory and its direct subdirectories; When a user first accesses the directory, the permission data for the immediate subdirectories is loaded, and the permission data for the remaining subtrees is loaded asynchronously in the background.
[0014] Optionally, a tree-structured directory can be constructed, including: Initialize the directory structure metadata storage table, assign a unique identifier to each directory node, and establish the association between parent and child nodes; Construct a common prefix for all directory paths and organize index nodes according to a B+ tree structure; Record the number of visits and timestamps for each directory node in real time; adjust the position weight of the node in the index based on the access frequency; The aggregated permission information of each directory node is recursively calculated from the leaf node to the root node, and the calculation results are stored in the cache table. When adding a new directory causes the subtree depth to exceed the system's preset threshold, a shortcut path mapping that directly reaches the root node is created for the deep directory. Generate a complete path hash value for each directory node.
[0015] Optionally, virtual permission markers and real permission records are stored separately, and virtual permission markers cannot coexist with real permission records in the same directory node, including: Configure a reference counter for each virtual permission tag; the reference counter records the number of real permission records in the subdirectories that reference the virtual permission tag; when the value of the reference counter reaches zero, the corresponding virtual permission tag is cleared. Construct an inheritance table of virtual permission markers; the inheritance table records the association between each virtual permission marker and the actual permission records of its subdirectories; When a virtual permission tag sharing component is deployed, and multiple subdirectories under the same parent directory are granted permissions simultaneously, the virtual permission tag sharing component generates and stores only one copy of the virtual permission tag. Configure a virtual permission tag recycling manager; the virtual permission tag recycling manager monitors the last access timestamp of the real permission record associated with the virtual permission tag, and sets the virtual permission tag that has not been accessed for more than a preset time to a pending state.
[0016] In summary, the embodiments of this application, through the above technical solutions, enable the system to directly obtain the complete tree structure by pre-storing virtual permission tags without real-time calculation, thus solving the technical performance bottleneck and improving the user experience, thereby optimizing the performance of document management.
[0017] Other features and advantages of this application will be described in detail in the following detailed description section. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1 This is a flowchart illustrating the steps of a performance optimization method for a document system provided in an exemplary embodiment of this application; Figure 2 This is a diagram illustrating the directory authorization process. Detailed Implementation
[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the protection scope of this application.
[0021] This application provides a method for optimizing the performance of a document system. Please refer to [link / reference]. Figure 1 The document system performance optimization method provided in this application includes the following steps: Step 101: Construct a tree-like directory; the tree-like directory includes a root directory, intermediate parent directories, and leaf child directories; assign unique bits to each permission type in the tree-like directory to construct a permission bitmap.
[0022] Specifically, a tree-like directory is a data structure where the root directory is at the top level, leaf directories are final nodes that do not contain any subdirectories, and intermediate parent directories have both parent and child nodes. In this invention, unique bits are assigned to different permission types; for example, bit 0 is assigned to view permission, bit 1 to download permission, bit 2 to edit permission, and bit 3 to delete permission, thereby constructing a permission bitmap.
[0023] Step 102: When authorizing a subdirectory, generate virtual permission markers in all parent directories of the subdirectory; the virtual permission markers are stored separately from the real permission records and the virtual permission markers cannot coexist with the real permission records in the same directory node; the virtual permission markers are only used for directory structure display and cannot be used for file operations.
[0024] Specifically, a virtual permission marker, or virtual permission for short, is a permission record used to solve the visibility problem of intermediate directories in a tree structure. It is fundamentally different from a real permission record; the aforementioned real permission record refers to the actual operational permissions a user possesses, or real permissions for short. For example... Figure 2 As shown, when a user is authorized to access the / D directory, the system generates virtual permission markers in all parent directories of / D (i.e., / C and / A), making these intermediate directories visible to the client. These virtual permission markers do not grant the user any actual operational permissions; they are only used to demonstrate the integrity of the directory structure. Users cannot perform operations such as downloading or deleting on directories with only virtual permissions.
[0025] Separate storage of virtual permission markers and real permission records refers to using different data tables or fields to store these two types of permission information in the database design, which facilitates system management and querying. Virtual permission markers and real permission records cannot coexist in the same directory node. That is, when a directory node is granted real permissions, if a virtual permission marker already exists on that node, the system will clear the virtual permission marker and only retain the real permission record, ensuring the consistency of permission representation.
[0026] Step 103: Store real permission records and virtual permission flags in the database simultaneously so that the complete tree-like directory structure can be directly obtained when querying permissions.
[0027] Specifically, traditional permission systems typically require recursive calculations or data completion to construct a complete directory tree structure when querying resources that a user has permission to access. This invention, by pre-storing real permission records and virtual permission markers in the database, allows the system to directly retrieve all relevant permission data from the database upon receiving a permission query request, eliminating the need for real-time calculations. For example, when querying resources a user has permission to access, the system only needs to execute a single database query to obtain all permission records, including virtual permission markers. These records are then assembled into a complete tree structure and returned to the client, simplifying the complexity of permission queries. What originally required multiple database accesses and complex calculations is reduced to a single database query and simple data assembly, thus improving system performance.
[0028] Step 104: Generate a cache identifier for permission data based on the user ID and directory path, and preload the user's permission data in the current directory and its subdirectories.
[0029] Specifically, the cache identifier is a key-value pair used for unique identification and fast retrieval of cached data. This invention generates a raw key by combining the user ID and directory path with the current permission data version number, and then applies the MD5 hash algorithm to this raw key to generate a 16-byte binary hash value as the final cache identifier. Preloading refers to the system loading the permission data of the currently accessed directory and its subdirectories into the cache to reduce response latency for subsequent operations. For example, when a user accesses the / A directory, the system searches for the permission data of the / A directory and its subdirectories based on the cache identifier. If the data is not found in the cache, it is loaded from the database and stored in the cache so that subsequent user operations can respond quickly, reducing the number of database accesses.
[0030] Step 105: When a user requests access to a resource, return complete permission data containing virtual permission flags and real permission records, and render a tree-like directory based on the permission type.
[0031] Specifically, differentiated rendering refers to the client displaying the directory tree differently based on the permission type of directory nodes. For example, for directory nodes with only virtual permission markers, the client renders them as expandable but not operable, typically indicated by gray text or a special icon; for directory nodes with actual permission records, corresponding operation buttons, such as download and delete buttons, are displayed according to the specific permission type. By returning complete permission data containing both virtual permission markers and actual permission records, the client does not need to perform additional permission calculations and can directly render the complete directory tree structure based on the received permission data, significantly improving the user experience.
[0032] By adopting the above scheme, the complexity of the permission query process is reduced by pre-compiling and storing the virtual permission tags of intermediate directories. When the client needs to display the complete directory tree that the user has the right to access, the traditional scheme needs to recursively calculate all intermediate nodes from each authorized leaf node upwards, and the computational complexity increases exponentially with the directory depth. However, by pre-storing the virtual permission tags, the system can directly obtain the complete tree structure without real-time calculation, which solves the technical performance bottleneck and improves the user experience.
[0033] In some embodiments, the generation and management of the virtual permission token includes the following steps: When granting real permissions to a subdirectory, all parent directories of that subdirectory are identified; the parent directories include the direct parent directory, all indirect parent directories, and the root directory. For each identified parent directory, check whether the parent directory already has a real permission record; if no real permission record exists, mark the parent directory as a candidate virtual permission mark directory. For each candidate virtual permission-marked directory, verify that it is not a leaf subdirectory; for the root directory, verify that it has at least one subdirectory with real permission records; for intermediate parent directories, verify that it has at least one subdirectory with real permission records that is not directly associated with a file. A virtual permission tag is generated for the candidate virtual permission tag directories that have passed the verification; the unique identifier of the virtual permission tag is generated by performing a combined hash operation on the directory path, user ID and system timestamp. When it is detected that virtual permission markers and real permission records coexist in the same intermediate parent directory or root directory, remove the virtual permission markers on the intermediate parent directory or root directory and retain the real permission records. When all real permission records of all subdirectories under a certain intermediate parent directory or root directory have been removed and no real permission records exist, remove the virtual permission marker of that intermediate parent directory or root directory. When adding a real permission record to an intermediate parent directory or a subdirectory of the root directory that already has a virtual permission tag, the existing virtual permission tag is retained and reused.
[0034] Specifically, when granting real permissions to a subdirectory, the system identifies all parent directories of that subdirectory and checks whether these parent directories already have real permission records. If not, they are marked as candidate directories with virtual permissions. Then, each candidate directory is verified to ensure that it is not a leaf node and meets specific conditions. These specific conditions can be: the root directory must have at least one subdirectory with real permissions, and intermediate parent directories must have subdirectories with real permissions that are not directly associated with files. After verification, a virtual permission tag is generated, and its unique identifier is generated by combining a hash operation of the directory path, user ID, and timestamp.
[0035] When virtual permissions and real permissions coexist in the same directory, remove virtual permissions and retain real permissions; when real permissions are removed from all subdirectories under a directory and the directory has no real permissions, clear its virtual permission markers; when adding authorization to a directory with existing virtual permission markers, reuse the existing virtual permission markers instead of creating them again.
[0036] The above scheme generates virtual permission tags for display purposes only in all parent directories when a subdirectory is authorized. This transforms permission queries from complex recursive calculations into simple data retrieval, avoiding the exponentially increasing computational complexity of traditional schemes and keeping storage overhead within a reasonable range through the virtual permission tag reuse mechanism.
[0037] In some embodiments, a unique bit is assigned to each permission type on the tree directory to construct a permission bitmap, including: Initialize the permission bitmap configuration table and assign unique bit positions to different permission types; bit 0 is assigned to view permission, bit 1 to download permission, bit 2 to edit permission, and bit 3 to delete permission. Define a minimum set of permissions for each directory operation; the minimum set of permissions represents the lowest combination of permissions required to perform a specific operation. Convert multiple user permission types in a specific directory into corresponding bit settings to generate a permission bitmap represented by a single integer value.
[0038] Specifically, during the initialization phase, a permission bitmap configuration table is constructed, assigning a unique bit position to each permission type; by defining an operation-oriented minimum permission set mechanism, business operations, such as copying files and moving directories, are mapped to the required minimum permission combination, thereby preventing over-authorization; through the permission bitmap generation and verification mechanism, multiple permissions of users in a specific directory are converted into corresponding bit settings, generating a single integer value, simplifying the multi-record mode into single-value storage.
[0039] The above scheme, through a permission bitmap mechanism, compresses multi-dimensional permissions into a single integer value for storage. This simplifies permission checks from multiple database queries and conditional judgments to a single bitwise operation, reducing the data storage space required for permission data and improving permission verification speed. By defining a minimum permission set mechanism, the scheme avoids the problems of over-granting or under-granting permissions found in traditional schemes, achieving efficient permission management while ensuring security.
[0040] In some embodiments, when authorizing a subdirectory, virtual permission markers are generated in all parent directories of the subdirectory, including: Receive permission change requests and parse the target directory, user ID, and requested permission type set; Obtain the current real permission records and associated virtual permission markers of the target directory, and construct a snapshot of the permission state before the change; Compare the requested permissions with the current permissions, and generate a set of permission increments and a set of permission decrements; Update the permission bitmap for the incremental permission set based on the newly added permission types, while retaining the original permissions unchanged; Check permission dependencies on the permission reduction set; if the removed permission is the basis for other user permissions, trigger the permission dependency evaluation process. Update the virtual permission marker reference counter for each affected directory node. When the reference counter reaches zero, trigger the virtual permission marker cleanup process. When the directory structure is reorganized, a directory dependency graph is built and the permission update order is determined to ensure that updates are performed layer by layer from the root directory to the leaf subdirectories. Generate a reversible permission change operation log to record the state before the change, the change operation, and the state after the change.
[0041] Specifically, by generating virtual permission markers for all parent directories during subdirectory authorization, the system solves the problems of low query efficiency and incomplete data structure caused by the lack of permission records for intermediate parent directories in traditional permission management systems. When a user attempts to access a specific directory or its subdirectories, it is no longer necessary to perform complex recursive calculations to determine the user's visibility scope. The system directly judges based on the pre-generated virtual permission markers, improving system performance, especially in handling large-scale document systems and high-concurrency scenarios, significantly reducing query time and increasing response speed.
[0042] In some embodiments, generating a cache identifier for permission data based on the user ID and directory path includes: Receive user ID and directory path as input, combine them with the current permission data version number, and generate a raw key in the format of ; The MD5 hash algorithm is applied to the original key to generate a 16-byte binary hash value as a cache identifier.
[0043] In some embodiments, preloading user permission data in the current directory and its subdirectories includes: Collect and analyze the frequency and depth of user access to each directory within a preset historical time period. The directories are divided into three categories: high-frequency access directories, medium-frequency access directories, and low-frequency access directories. Configure a full subtree preloading strategy for frequently accessed directories to preload permission data for all levels of subdirectories under that directory; Configure a partial subtree preloading strategy for the mid-frequency access directory to preload the subdirectory permission data under this directory until the first virtual permission marker node is encountered; Configure a minimal preloading strategy for infrequently accessed directories, loading only the permission data of the current directory and its direct subdirectories; When a user first accesses the directory, the permission data for the immediate subdirectories is loaded, and the permission data for the remaining subtrees is loaded asynchronously in the background.
[0044] Specifically, we collect and analyze users' directory access behavior over historical time periods, such as the past 30 days, to build a personalized access model, focusing on two key dimensions: access frequency, i.e., the number of times a directory is accessed; and access depth characteristics, i.e., the subdirectory levels that users typically explore within that directory.
[0045] Based on the analysis results, the system divides the directory into three categories: high-frequency, medium-frequency, and low-frequency, and configures an optimized preloading strategy for each category. High-frequency directories use full subtree preloading to ensure that users can get immediate responses in these critical work areas; medium-frequency directories use partial subtree preloading, and specifically utilize virtual permission marker nodes as preloading boundaries to avoid loading deep directories that users cannot operate on; low-frequency directories use a minimal preloading strategy, loading only the necessary data.
[0046] A progressive loading mechanism was designed for first-time user visits: permission data for the current directory and its immediate subdirectories is loaded immediately, allowing the user interface to be displayed quickly; the remaining subtree data is loaded asynchronously in the background, preparing for subsequent user operations. This design avoids long waiting times for first-time visits.
[0047] In some embodiments, constructing a tree-like directory includes: Initialize the directory structure metadata storage table, assign a unique identifier to each directory node, and establish the association between parent and child nodes; Construct a common prefix for all directory paths and organize index nodes according to a B+ tree structure; Record the number of visits and timestamps for each directory node in real time; adjust the position weight of the node in the index based on the access frequency; The aggregated permission information of each directory node is recursively calculated from the leaf node to the root node, and the calculation results are stored in the cache table. When adding a new directory causes the subtree depth to exceed the system's preset threshold, a shortcut path mapping that directly reaches the root node is created for the deep directory. Generate a complete path hash value for each directory node.
[0048] In some embodiments, virtual permission markers and real permission records are stored separately, and virtual permission markers cannot coexist with real permission records in the same directory node, including: Configure a reference counter for each virtual permission tag; the reference counter records the number of real permission records in the subdirectories that reference the virtual permission tag; when the value of the reference counter reaches zero, the corresponding virtual permission tag is cleared. Construct an inheritance table of virtual permission markers; the inheritance table records the association between each virtual permission marker and the actual permission records of its subdirectories; When a virtual permission tag sharing component is deployed, and multiple subdirectories under the same parent directory are granted permissions simultaneously, the virtual permission tag sharing component generates and stores only one copy of the virtual permission tag. Configure a virtual permission tag recycling manager; the virtual permission tag recycling manager monitors the last access timestamp of the real permission record associated with the virtual permission tag, and sets the virtual permission tag that has not been accessed for more than a preset time to a pending state.
[0049] It should be noted that the permission management system in the document system provided in this embodiment of the invention is used to execute all the process steps of the performance optimization method for the document system in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.
[0050] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.
[0051] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0052] The embodiments, implementation methods, and related technical features of this application can be combined and substituted for each other without conflict.
[0053] The above are merely preferred embodiments of this application and are not intended to limit this application in any way. Any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of this application without departing from the scope of the technical solution of this application shall still fall within the scope of the technical solution of this application.
Claims
1. A performance optimization method for a document system, characterized in that, include: Build a tree-like directory; A tree-like directory structure includes a root directory, intermediate parent directories, and leaf child directories. A unique bit is assigned to each permission type on the tree-like directory to construct a permission bitmap; When granting permissions to a subdirectory, virtual permission markers are generated in all parent directories of the subdirectory. The virtual permission markers and real permission records are stored separately, and the virtual permission markers and real permission records cannot coexist in the same directory node; The virtual permission marker is only used to display the directory structure and cannot be used for file operations; Storing both real permission records and virtual permission markers in the database allows for direct retrieval of the complete tree-like directory structure during permission queries. Generate a cache identifier for permission data based on the user ID and directory path, and preload the user's permission data in the current directory and its subdirectories; When a user requests access to a resource, complete permission data containing virtual permission flags and real permission records is returned, and a tree-like directory is rendered differently based on the permission type.
2. The method according to claim 1, characterized in that, The generation and management of the virtual permission tokens include the following steps: When granting real permissions to a subdirectory, all parent directories of that subdirectory are identified; the parent directories include the direct parent directory, all indirect parent directories, and the root directory. For each identified parent directory, check whether the parent directory already has a real permission record; if no real permission record exists, mark the parent directory as a candidate virtual permission mark directory. For each candidate virtual permission marked directory, verify that it is not a leaf subdirectory; for the root directory, verify that it has at least one subdirectory with real permission records; for intermediate parent directories, verify that it has at least one subdirectory with real permission records that is not directly associated with a file. A virtual permission tag is generated for the candidate virtual permission tag directories that have passed the verification; the unique identifier of the virtual permission tag is generated by performing a combined hash operation on the directory path, user ID and system timestamp. When it is detected that virtual permission markers and real permission records coexist in the same intermediate parent directory or root directory, remove the virtual permission markers on the intermediate parent directory or root directory and retain the real permission records. When all real permission records of all subdirectories under a certain intermediate parent directory or root directory have been removed and no real permission records exist, remove the virtual permission marker of that intermediate parent directory or root directory. When adding a real permission record to an intermediate parent directory or a subdirectory of the root directory that already has a virtual permission tag, the existing virtual permission tag is retained and reused.
3. The method according to claim 2, characterized in that, Assigning unique bits to each permission type on the tree-like directory to construct a permission bitmap includes: Initialize the permission bitmap configuration table and assign unique bit positions to different permission types; bit 0 is assigned to view permission, bit 1 to download permission, bit 2 to edit permission, and bit 3 to delete permission. Define a minimum set of permissions for each directory operation; the minimum set of permissions represents the lowest combination of permissions required to perform a specific operation. Convert multiple user permission types in a specific directory into corresponding bit settings to generate a permission bitmap represented by a single integer value.
4. The method according to claim 3, characterized in that, When granting permissions to a subdirectory, virtual permission markers are generated in all parent directories of the subdirectory, including: Receive permission change requests and parse the target directory, user ID, and requested permission type set; Obtain the current real permission records and associated virtual permission markers of the target directory, and construct a snapshot of the permission state before the change; Compare the requested permissions with the current permissions, and generate a set of permission increments and a set of permission decrements; Update the permission bitmap for the incremental permission set based on the newly added permission types, while retaining the original permissions unchanged; Check permission dependencies on the permission reduction set; if the removed permission is the basis for other user permissions, trigger the permission dependency evaluation process. Update the virtual permission marker reference counter for each affected directory node. When the reference counter reaches zero, trigger the virtual permission marker cleanup process. When the directory structure is reorganized, a directory dependency graph is built and the permission update order is determined to ensure that updates are performed layer by layer from the root directory to the leaf subdirectories. Generate a reversible permission change operation log to record the state before the change, the change operation, and the state after the change.
5. The method according to claim 4, characterized in that, A cache identifier for generating permission data based on the user ID and directory path includes: It takes the user ID and directory path as input, combines them with the current permission data version number, and generates a raw key in the format of ; The MD5 hash algorithm is applied to the original key to generate a 16-byte binary hash value as a cache identifier.
6. The method according to claim 5, characterized in that, Preload user permission data for the current directory and its subdirectories, including: Collect and analyze the frequency and depth of user access to each directory within a preset historical time period. The directories are divided into three categories: high-frequency access directories, medium-frequency access directories, and low-frequency access directories. Configure a full subtree preloading strategy for frequently accessed directories to preload permission data for all levels of subdirectories under that directory; Configure a partial subtree preloading strategy for the mid-frequency access directory to preload the subdirectory permission data under this directory until the first virtual permission marker node is encountered; Configure a minimal preloading strategy for infrequently accessed directories, loading only the permission data of the current directory and its direct subdirectories; When a user first accesses the directory, the permission data for the immediate subdirectories is loaded, and the permission data for the remaining subtrees is loaded asynchronously in the background.
7. The method according to claim 6, characterized in that, Constructing a tree-like directory includes: Initialize the directory structure metadata storage table, assign a unique identifier to each directory node, and establish the association between parent and child nodes; Construct a common prefix for all directory paths and organize index nodes according to a B+ tree structure; Record the number of visits and timestamps for each directory node in real time; adjust the position weight of the node in the index based on the access frequency; The aggregated permission information of each directory node is recursively calculated from the leaf node to the root node, and the calculation results are stored in the cache table. When adding a new directory causes the subtree depth to exceed the system's preset threshold, a shortcut path mapping that directly reaches the root node is created for the deep directory. Generate a complete path hash value for each directory node.
8. The method according to claim 7, characterized in that, virtual Permission markers and actual permission records are stored separately, and virtual permission markers cannot coexist with actual permission records in the same directory node, including: Configure a reference counter for each virtual permission tag; the reference counter records the number of real permission records in the subdirectories that reference the virtual permission tag; when the value of the reference counter reaches zero, the corresponding virtual permission tag is cleared. Construct an inheritance table of virtual permission markers; the inheritance table records the association between each virtual permission marker and the actual permission records of its subdirectories; When a virtual permission tag sharing component is deployed, and multiple subdirectories under the same parent directory are granted permissions simultaneously, the virtual permission tag sharing component generates and stores only one copy of the virtual permission tag. Configure a virtual permission tag recycling manager; the virtual permission tag recycling manager monitors the last access timestamp of the real permission record associated with the virtual permission tag, and sets the virtual permission tag that has not been accessed for more than a preset time to a pending state.