A multi-tenant resource processing method, apparatus and device

Abstract

This application provides a multi-tenant resource processing method, apparatus, and device, relating to the field of resource processing. The method includes: acquiring a user-input access request for a target business application; obtaining a user-level resource structure tree corresponding to the user based on the user's user identifier and the identifier of the target tenant to which the user belongs, using a preset resource data table of the target business application; using a strategy parsing engine to determine the identifier of the target business model corresponding to each business module; using a model scheduling engine to call the target business model based on the identifier of the target business model, thereby associating the target business model with the target business application; and rendering the target business application page based on the user-level resource structure tree to obtain the target page. This achieves accurate adaptation of business models and resources in multi-tenant scenarios, meeting the business needs of tenants and users through the dynamic generation and rendering of the user-level resource structure tree.

Description

Technical Field

[0001] This invention relates to the field of resource processing technology, and more specifically, to a multi-tenant resource processing method, apparatus, and device. Background Technology

[0002] As software architecture rapidly evolves from traditional private deployments to multi-tenant cloud service models like Software as a Service (SaaS), SaaS systems must simultaneously address three core requirements: functional complexity, personalized adaptation, and security isolation. In real-world business scenarios, SaaS systems commonly face the complex situation of multiple applications, versions, tenants, and service packages coexisting, giving rise to four key requirements: First, data isolation, requiring independent storage and access control for business data from different tenants to prevent cross-data leakage risks; second, resource isolation, requiring on-demand allocation of computing resources based on the business characteristics of different applications and versions to avoid service stability issues caused by resource contention; third, functional differentiation, requiring flexible feature tailoring across different versions of the same application, while tenant customization needs must be accessible only to the target tenant, without affecting other tenants; and fourth, access control, requiring differentiated menu and resource access permissions for different users within a tenant to achieve least privilege management and ensure system security.

[0003] Currently, the mainstream solutions for the above-mentioned requirements of SaaS multi-tenant systems are mainly divided into two categories: one is the hard-coded logic control solution, which directly controls the business processing logic of different versions, tenants and users by embedding a large number of conditional judgment statements, strategy branches, configuration identifiers and other methods in the business code; the other is the multi-environment replication and operation solution, which deploys independent system instances for different tenants or different versions, and realizes the customization of data, resources and functions through physical isolation. However, both of these solutions have significant technical bottlenecks: First, they lack flexibility. When faced with business changes, hard-coded solutions require modification of core business code, while multi-instance solutions require the addition of independent deployment instances. Both result in long response cycles and difficulty adapting to the rapid pace of business iteration. Second, they have high system coupling. In hard-coded solutions, version and tenant-related logic are deeply bound to core business code, leading to large amounts of code redundancy, poor readability, and high development and maintenance costs. Third, they consume a lot of resources and are difficult to manage. Multi-instance deployment modes result in the repeated use of hardware resources such as servers and storage, leading to low resource utilization. At the same time, as the number of tenants and versions increases, the complexity of system deployment and maintenance increases exponentially, and it is difficult to upgrade or downgrade resources on demand based on tenant subscription relationships. Fourth, they have weak customization support capabilities. A large number of scattered tenant customization functions cannot be managed uniformly, which easily leads to fragmentation of customization. This not only results in low efficiency of function iteration but also causes system compatibility risks, making it difficult to quickly respond to market changes and tenant personalized needs. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of the prior art by providing a multi-tenant resource processing method, apparatus, and device. This allows for precise adaptation of business models and resources in multi-tenant scenarios through a closed loop of request reception, resource calculation, model matching, model invocation, and page rendering. It not only shields the differences between underlying multi-models by using context-driven model scheduling and a unified resource interface, reducing system coupling, but also ensures the implementation of personalized needs and permission control for tenants and users through the dynamic generation and rendering of user-level resource structure trees, significantly improving page loading efficiency and user experience.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a multi-tenant resource processing method, the method comprising: Obtain user-input access requests for the target business application; Based on the user's user identifier and the identifier of the target tenant to which the user belongs, a user-level resource structure tree corresponding to the user is obtained using a preset resource data table of the target business application; the user-level resource structure tree includes: at least two business modules of the user for the target business application; A strategy parsing engine is used to determine the identifier of the target business model corresponding to each of the aforementioned business modules; Based on the identifier of the target business model, the model scheduling engine is used to invoke the target business model to associate the target business model with the target business application; Based on the user-level resource structure tree, the target business application is rendered to obtain the target page.

[0006] In an optional implementation, the preset resource data table includes: a preset tenant data table, and a preset user data table for each tenant; obtaining the user-level resource structure tree corresponding to the user based on the user's user identifier and the tenant identifier to which the user belongs includes: Based on the identifier of the target tenant, the tenant-level resource structure tree of the target tenant is obtained using the preset tenant data table; Based on the user identifier and the tenant-level resource structure tree, the user-level resource structure tree is obtained using the target tenant's preset user data table.

[0007] In an optional implementation, the preset tenant data table includes a resource data table and a resource structure data table. The step of obtaining the tenant-level resource structure tree of the target tenant using the preset tenant data table based on the target tenant's identifier includes: Based on the identifier of the target tenant, the tenant-level resource set of the target tenant is determined using the resource data table; Based on the target tenant's identifier and the target tenant's tenant-level resource set, the target tenant's tenant-level resource structure tree is determined using the resource structure data table.

[0008] In an optional implementation, the resource data table includes: a tenant-application version-service package relationship table, an application version definition table, a service package-resource relationship table, and a resource-application version-tenant relationship table; the step of determining the tenant-level resource set of the target tenant based on the identifier of the target tenant using the resource data table includes: Based on the identifier of the target tenant, the target application version and target service package are determined using the tenant-application version-service package relationship table; Based on the target application version, the basic resource set is determined using the application version definition table; Based on the target service package, the value-added dataset is determined using the service package-resource relationship table. Based on the target tenant's identifier and the target application version, a customized resource set is determined using the resource-application version-tenant relationship table; Based on the basic resource set, the value-added dataset, and the customized resource set, the tenant-level resource set of the target tenant is determined.

[0009] In an optional implementation, the resource structure data table includes: a resource structure-application version-tenant relationship table and a resource structure definition table. The step of determining the tenant-level resource structure tree of the target tenant using the resource structure data table, based on the target tenant's identifier and the target tenant's tenant-level resource set, includes: Based on the identifier of the target tenant, the resource structure-application version-tenant relationship table is used to determine whether the target tenant has a customized resource structure; If it is determined that the target tenant does not have the customized resource structure, then based on the identifier of the target tenant, the resource structure-application version-tenant relationship table is used to determine whether the target tenant has a version resource structure; If it is determined that the target tenant does not have the version resource structure, then the basic resource structure is determined based on the identifier of the target tenant using the resource structure definition table; Based on the customized resource structure, the version resource structure, or the basic resource structure, determine the tenant-level resource structure tree of the target tenant.

[0010] In an optional implementation, the preset user data table includes: a user definition table, a tenant-user relationship table, and a user permission table; the step of obtaining the user-level resource structure tree based on the user identifier and the tenant-level resource structure tree, using the preset user data table of the target tenant, includes: Based on the user identifier, the tenant-user relationship table and the user definition table are used to determine the tenant-level resource set of the target tenant; Based on the user identifier, the user permission table is used to determine the set of restricted access resources for the user; The user's resource set is determined based on the tenant-level resource set and the restricted access resource set; The user-level resource structure tree of the user is determined based on the user resource set and the tenant-level resource structure tree.

[0011] In an optional implementation, the method further includes: Cache the user-level resource structure tree to a cache data table; If the user's login request is received again within the preset cache validity period, the user-level resource structure tree is directly retrieved from the cache data table. If a change in the user's permissions is detected, the user-level resource structure tree is cleared from the cached data table.

[0012] In an optional implementation, before obtaining the user-level resource structure tree corresponding to the user using a preset resource data table of the target business application based on the user's user identifier and the identifier of the target tenant to which the user belongs, the method further includes: Obtain the registration request for the target business application input by the user; Based on the registration request, determine the user's user identifier and the identifier of the target tenant to which the user belongs, as well as the target business application, the version of the target business application, and the service package corresponding to the version of the target business application entered by the user; Based on the user identifier, the target tenant identifier, the target business application, the version of the target business application, and the service package corresponding to the version of the target business application, update the preset resource data table of the target business application.

[0013] Secondly, embodiments of this application also provide a multi-tenant resource processing apparatus, comprising: The acquisition module is used to acquire user input of access requests for the target business application; The acquisition module is further configured to acquire the user-level resource structure tree corresponding to the user based on the user identifier of the user and the identifier of the target tenant to which the user belongs, using a preset resource data table of the target business application; the user-level resource structure tree includes: at least two business modules of the user for the target business application; The determination module is used to use the strategy parsing engine to determine the identifier of the target business model corresponding to each of the business modules; The invocation module is used to invoke the target business model using the model scheduling engine based on the identifier of the target business model, so as to associate the target business model with the target business application; The rendering module is used to render the target business application page according to the user-level resource structure tree to obtain the target page.

[0014] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of the multi-tenant resource processing method as described in any of the first aspects.

[0015] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the multi-tenant resource processing method as described in any of the first aspects.

[0016] The beneficial effects of this application are: This application provides a multi-tenant resource processing method, apparatus, and device. The method includes: acquiring an access request for a target business application input by a user; obtaining a user-level resource structure tree corresponding to the user based on the user's user identifier and the identifier of the target tenant to which the user belongs, using a preset resource data table of the target business application; the user-level resource structure tree includes at least two business modules of the target business application for the user; determining the identifier of the target business model corresponding to each business module using a policy parsing engine; calling the target business model using a model scheduling engine based on the identifier of the target business model to associate the target business model with the target business application; and rendering the target business application page according to the user-level resource structure tree to obtain a target page.

[0017] The method in this application achieves precise adaptation of business models and resources in multi-tenant scenarios through a complete closed loop of request reception, resource calculation, model matching, model invocation, and page rendering. It not only shields the differences between underlying multi-models by using context-driven model scheduling and a unified resource interface, reducing system coupling, but also ensures the implementation of personalized needs and permission control for tenants and users through the dynamic generation and rendering of user-level resource structure trees. This significantly improves page loading efficiency and user experience, while avoiding the problems of poor flexibility and resource waste caused by traditional hard coding and multi-instance deployment, thus supporting the SaaS system to respond efficiently to business changes. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts illustrating a multi-tenant resource processing method provided in an embodiment of this application; Figure 2 A second schematic flowchart illustrating a multi-tenant resource processing method provided in this application embodiment; Figure 3 A third flowchart illustrating a multi-tenant resource processing method provided in this application embodiment; Figure 4 A fourth flowchart illustrating a multi-tenant resource processing method provided in this application embodiment; Figure 5 The fifth flowchart illustrates a multi-tenant resource processing method provided in this application embodiment; Figure 6 A flowchart illustrating a multi-tenant resource processing method provided in this application embodiment is shown in Figure 6. Figure 7 The seventh flowchart illustrating a multi-tenant resource processing method provided in this application embodiment; Figure 8 A functional module diagram of a multi-tenant resource processing device provided in an embodiment of this application; Figure 9 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0021] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0022] In the description of this application, it should be noted that if the terms "upper", "lower", etc. appear to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship that the product of this application is usually placed in, it is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0023] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0025] To facilitate the management of multi-tenant resources, this application provides a multi-tenant resource processing method applied to SaaS systems, a cloud-based software delivery model. Users access and use software via the internet without needing to install and maintain it locally. SaaS systems are typically hosted and managed by service providers, with users subscribing on demand and paying only for usage. This model offers advantages such as high flexibility, low cost, and ease of expansion and updates, and is widely used in enterprise management, customer relations, human resources, and financial management. Based on the unified management of multi-application, multi-version, and multi-tenant business models within the SaaS system, and according to each user's access requests for target business applications, the method provides the required resources to each user, resulting in the target page for the target business application.

[0026] The multi-tenant resource processing method provided in this application will be explained in detail below with reference to the accompanying drawings and specific examples. Figure 1 This is one of the flowcharts illustrating a multi-tenant resource processing method provided in an embodiment of this application; such as Figure 1 As shown, the method includes: S101. Obtain the user's input access request for the target business application.

[0027] In this embodiment, the user logs into the SaaS system through a terminal page, enters their user account and encrypted password, and clicks login to initiate an access request for the SaaS system. The access request carries basic information such as user identifier and network type.

[0028] After receiving an access request, the access layer of the SaaS system calls the security authentication module to authenticate the validity of the user account and encrypted password. Specifically, it traverses the user definition table based on the user identifier to determine whether the authentication is successful. If the authentication is successful, a session is generated, and the tenant-user relationship table is traversed based on the user identifier to determine the identifier of the target tenant to which the user belongs. The session message includes the user identifier, the identifier of the target tenant, and the authentication identifier.

[0029] If authentication fails, an authentication failure message will be returned, such as incorrect account or password.

[0030] S102. Based on the user's user identifier and the identifier of the target tenant to which the user belongs, obtain the user-level resource structure tree corresponding to the user using the preset resource data table of the target business application.

[0031] The user-level resource structure tree includes at least two business modules for the user's target business application.

[0032] Specifically, after user authentication is successful, the SaaS system extracts the user identifier and the identifier of the target tenant from the session, and calculates the user-level resource structure tree based on the preset resource data table of the target business application. The user-level resource structure tree defines the hierarchical relationship between at least two business modules, such as order reports and data centers. The user-level resource structure tree defines that the menu for order reports is moved under data centers.

[0033] S103. Use a strategy parsing engine to determine the identifier of the target business model corresponding to each business module.

[0034] Specifically, the strategy parsing engine extracts the context information corresponding to the access request. For example, if the target business application's identifier is AppID=CRM001, the target business application's version number is VersionID=V3.0, the target tenant's identifier is TenantID=Ten012, the user's identifier is UserID=User007, the business module includes order reports, and the model type is a menu model, then it matches the preset strategy rule base. If the condition TenantID=Ten012 AND Version=V3.0 AND ModelType=Menu is matched, the corresponding target business model identifier is determined to be "CRM001_V3.0_Svc008_Ten012_Menu"; similarly, the data export module matches the model identifier "CRM001_V3.0_Svc009_Ten012_Report", ensuring that each business module is accurately associated with the corresponding customized model.

[0035] S104. Based on the identifier of the target business model, the model scheduling engine is used to call the target business model to associate the target business model with the target business application.

[0036] Specifically, after receiving the CRM001_V3.0_Svc008_Ten012_Menu identifier, the model scheduling engine first checks if the model exists in the memory cache. If it finds that the model is not loaded, it pulls the corresponding model container (containing the rendering logic of the customer management menu, data isolation rules, etc.) from the model repository, loads it into memory, and caches it for 2 hours. Then, it calls the initialization method of the model container, passing in the context parameters of user User007 and target tenant Ten012, to complete the association between the model and the current target business application session, so that the menu display and data query of the order report module follow the customized rules of Ten012.

[0037] The SaaS model encapsulates the functional logic, data structure, permission policies, and lifecycle configurations of each type of model into independent model containers, thereby decoupling the model from the core system code. The core components of the container are: Logic layer: the model's business processing code (such as menu structure calculation logic and permission verification logic); Data layer: the data table mapping relationships and data filtering rules that the model depends on (such as tenant data isolation conditions); Configuration layer: the model's lifecycle parameters (such as cache expiration time and maximum concurrency) and a list of dependent models (such as the user permission model depending on the tenant resource model).

[0038] S105. Based on the user-level resource structure tree, render the target business application to obtain the target page.

[0039] Specifically, after receiving the JSON data from the user-level resource structure tree, the front-end renders the page navigation bar according to the hierarchical relationship of the target business model based on the resource structure in the user-level resource structure tree. For example, the first-level menu displays the data center. Clicking the first-level menu expands the corresponding sub-functions, such as order reports under the data center, and binds the corresponding access URL. The menu sorting and display names all meet the customization requirements of the target tenant Ten012, ultimately presenting a target page that fits the user's business scenario and is easy to operate.

[0040] In summary, this application provides a multi-tenant resource processing method, which includes: obtaining an access request for a target business application input by a user; obtaining a user-level resource structure tree corresponding to the user based on the user's user identifier and the identifier of the target tenant to which the user belongs, using a preset resource data table of the target business application; the user-level resource structure tree includes at least two business modules of the target business application for the user; determining the identifier of the target business model corresponding to each business module using a policy parsing engine; calling the target business model using a model scheduling engine based on the identifier of the target business model to associate the target business model with the target business application; and rendering the target business application page according to the user-level resource structure tree to obtain the target page.

[0041] The method in this application achieves precise adaptation of business models and resources in multi-tenant scenarios through a complete closed loop of request reception, resource calculation, model matching, model invocation, and page rendering. It not only shields the differences between underlying multi-models by using context-driven model scheduling and a unified resource interface, reducing system coupling, but also ensures the implementation of personalized needs and permission control for tenants and users through the dynamic generation and rendering of user-level resource structure trees. This significantly improves page loading efficiency and user experience, while avoiding the problems of poor flexibility and resource waste caused by traditional hard coding and multi-instance deployment, thus supporting the SaaS system to respond efficiently to business changes.

[0042] This application also provides another possible implementation of the multi-tenant resource processing method. The preset resource data table includes: a preset tenant data table, and a preset user data table for each tenant. Figure 2 This is a second flowchart illustrating a multi-tenant resource processing method provided in an embodiment of this application, as shown below. Figure 2 As shown, based on the user's user ID and the tenant ID to which the user belongs, the user-level resource structure tree corresponding to the user is obtained, including: S201. Based on the identifier of the target tenant, use the preset tenant data table to obtain the tenant-level resource structure tree of the target tenant.

[0043] In this embodiment, the preset tenant data table corresponding to the target tenant's identifier includes a tenant-application version-service package relationship table, a resource structure-version-tenant relationship table, etc. The SaaS system first queries the application version and service package ordered by the target tenant, integrates basic resources, value-added resources and customized resources to obtain a tenant resource set, and then, according to the resource structure priority, adopts the resource structure customized by the target tenant to generate a tenant-level resource structure tree containing complete tenant resources and hierarchical relationships.

[0044] S202. Based on the user identifier and the tenant-level resource structure tree, obtain the user-level resource structure tree using the target tenant's preset user data table.

[0045] The user identifier is associated with preset user data tables such as a tenant-user relationship table and a user permission table. Querying these tables reveals the user's role within the target tenant, and the user permission table records the resources they are prohibited from accessing. Based on this restriction, the SaaS system filters prohibited resource nodes and associated sub-functions in the tenant-level resource structure tree, retaining the remaining resources and maintaining the original hierarchical relationships, ultimately forming the user's user-level resource structure tree.

[0046] The method provided in this application first obtains the complete resource structure of the tenant, and then uses a hierarchical logic based on user permission filtering. This ensures that the customized resource structure at the tenant level is fully preserved, while also achieving fine-grained control of user permissions. It ensures that different users can only access resources within their own permission scope, which satisfies the tenant-user hierarchical permission isolation requirement, simplifies the logical complexity of resource structure calculation, avoids deep binding of permission judgment and business logic, and improves system maintenance efficiency.

[0047] This application also provides another possible implementation of the multi-tenant resource processing method. The preset tenant data table includes: a resource data table and a resource structure data table. Figure 3 This is the third flowchart illustrating a multi-tenant resource processing method provided in this application embodiment, as shown below. Figure 3As shown, based on the target tenant's identifier, a preset tenant data table is used to obtain the target tenant's tenant-level resource structure tree, including: S301. Based on the identifier of the target tenant, use the resource data table to determine the tenant-level resource set of the target tenant.

[0048] In this embodiment, the tenant-level resource set of the target tenant is determined from the resource data table based on the target tenant's identifier.

[0049] Optionally, the resource data tables include: a tenant-application version-service package relationship table, an application version definition table, a service package-resource relationship table, and a resource-application version-tenant relationship table.

[0050] Figure 4 This is the fourth flowchart illustrating a multi-tenant resource processing method provided in this application embodiment, as shown below. Figure 4 As shown, step S301 specifically includes: S401. Based on the target tenant's identifier, use the tenant-application version-service package relationship table to determine the target application version and the target service package.

[0051] Specifically, the resource data tables also include: an application definition table and an application service package table. The application definition table stores basic information about each business application. The application service package table stores information about value-added service packages, such as data export and multi-terminal adaptation. In addition, the tenant-application version-service package relationship table records the application versions and service packages subscribed to by each tenant, such as Ten005 subscribing to V2.0+Svc003.

[0052] Based on the target tenant's identifier, the tenant-application version-service package relationship table is traversed to determine the target application version and target service package subscribed by the target tenant.

[0053] S402. Based on the target application version, use the application version definition table to determine the basic resource set.

[0054] The application version definition table stores the version information of each business application and defines the basic functional scope of the version. Based on the target application version, the application version definition table is traversed to determine the basic resource set. For example, the target application version V2.0 includes resources such as order list and order details by default.

[0055] S403. Based on the target service package, use the service package-resource relationship table to determine the value-added dataset.

[0056] The service package-resource relationship table associates service packages with resources (such as menus and interfaces). For example, service package Svc003 contains report export resources. Based on the target service package, the service package-resource relationship table is traversed to determine the value-added dataset. For example, target service package Svc003 contains order reports and data export resources.

[0057] S404. Based on the target tenant's identifier and the target application version, determine the customized resource set using the resource-application version-tenant relationship table.

[0058] The Resource-Application Version-Tenant Relationship Table records the customized resources for each tenant for the application version. Based on the target tenant's identifier and the target application version, the Resource-Application Version-Tenant Relationship Table is traversed to determine the set of customized resources. For example, the target tenant Ten005 can add custom fields to set resources or delete refund application resources.

[0059] S405. Based on the basic resource set, the value-added data set, and the customized resource set, determine the tenant-level resource set for the target tenant.

[0060] Specifically, the final calculation of the tenant-level resource set is: basic resource set + value-added resource set ± customized resource set.

[0061] S302. Based on the target tenant's identifier and the target tenant's tenant-level resource set, use a resource structure data table to determine the target tenant's tenant-level resource structure tree.

[0062] Optionally, the resource structure data table includes: a resource structure-application version-tenant relationship table and a resource structure definition table.

[0063] Figure 5 This is the fifth flowchart illustrating a multi-tenant resource processing method provided in this application embodiment, as shown below. Figure 5 As shown, step S302 specifically includes: S501. Based on the target tenant's identifier, use the resource structure-application version-tenant relationship table to determine whether the target tenant has a customized resource structure.

[0064] Specifically, the resource structure-application version-tenant relationship table defines the personalized structure of resources at the version / tenant level, and an empty TenantID indicates a version-level structure.

[0065] Based on the target tenant's identifier, the resource structure-application version-tenant relationship table is traversed to determine whether the target tenant has a customized resource structure. For example, if the target tenant Ten005 moves the order report menu to the data center, it indicates that the target tenant Ten005 has a customized resource structure. In this case, the target tenant's tenant-level resource structure tree is a customized resource structure tree.

[0066] S502. If it is determined that the target tenant does not have a customized resource structure, then based on the target tenant's identifier, the resource structure-application version-tenant relationship table is used to determine whether the target tenant has a versioned resource structure.

[0067] Specifically, if the target tenant is determined to be empty, it indicates that the target tenant does not have a customized resource structure but has a version-level structure. Therefore, the tenant-level resource structure tree of the target tenant is determined to be the version resource structure tree.

[0068] S503. If it is determined that the target tenant does not have a version resource structure, the basic resource structure shall be determined based on the identifier of the target tenant using the resource structure definition table.

[0069] S504. Determine the tenant-level resource structure tree of the target tenant based on the customized resource structure, version resource structure, or basic resource structure.

[0070] Specifically, the resource structure definition table defines the basic structure of resources, such as the URL and parent menu of the order management menu. If it is determined that the target tenant does not have a version resource structure, then based on the target tenant's identifier, the resource structure definition table is traversed to determine the basic resource structure, and the tenant-level resource structure tree of the target tenant is determined as the basic resource structure tree.

[0071] The method provided in this application embodiment first accurately aggregates the basic resources, value-added resources, and customized resources ordered by tenants by linking the resource data table and the resource structure data table. Then, it determines the resource structure according to the priority of tenant-version-application. This ensures the integrity and accuracy of the tenant resource set and realizes personalized adaptation of the resource structure, avoiding the problem of fragmentation in customization. At the same time, it simplifies the organization and calculation logic of multi-dimensional resources, improves the generation efficiency of the tenant-level resource structure tree, and lays a solid foundation for subsequent user permission filtering.

[0072] This application also provides another possible implementation of the multi-tenant resource processing method. The preset user data table includes: a user definition table, a tenant-user relationship table, and a user permission table. Figure 6 This is the sixth flowchart illustrating a multi-tenant resource processing method provided in this application embodiment, as shown below. Figure 6 As shown, based on the user identifier and the tenant-level resource structure tree, the user-level resource structure tree is obtained using the target tenant's preset user data table, including: S601. Based on the user identifier, use the tenant-user relationship table and user definition table to determine the tenant-level resource set of the target tenant.

[0073] In this embodiment, the tenant-user relationship table associates tenants and users, records the user's role within the tenant, and the user definition table defines the business roles within the tenant.

[0074] User identifiers are linked to target tenants through the tenant-user relationship table. The subscription information of the tenant to which the user belongs is confirmed by combining the user definition table. Then, the tenant-level resource set corresponding to the target tenant is retrieved to ensure that subsequent permission filtering is based on the complete range of resources already owned by the tenant.

[0075] S602. Based on the user identifier, use the user permission table to determine the set of resources that the user is restricted from accessing.

[0076] The user permission table records the access permissions of users / roles to specific resources. Based on the user identifier, the user permission table is traversed to determine the set of resources that the user is restricted to access.

[0077] S603. Determine the user's resource set based on the tenant-level resource set and the restricted access resource set.

[0078] Specifically, if the user's restricted access resource set is determined to be the order report resource that is prohibited from being accessed, based on the user identifier and by traversing the user permission table, then the user's user resource set = tenant-level resource set - restricted access resource set.

[0079] S604. Determine the user-level resource structure tree for each user based on the user resource set and the tenant-level resource structure tree.

[0080] Based on the tenant-level resource structure tree, all resource nodes contained in the user resource set are retained, while order report nodes and related sub-functions, access URLs, and other information are deleted. At the same time, the hierarchical relationship and sorting order of the remaining resources are maintained to form the final user-level resource structure tree.

[0081] The method provided in this application embodiment achieves accurate conversion from tenant resources to user resources through precise comparison and filtering of tenant resource sets and user restricted access resource sets. This not only strictly follows the principle of least privilege control, ensuring data security and resource isolation, but also ensures that the resource structure tree obtained by the user is concise, efficient, and free of redundant functions, thus improving the convenience of user operation. At the same time, this process does not require modification of the core code and can be completed only through data table queries and calculations, reducing system development and maintenance costs.

[0082] This application also provides another possible implementation of a multi-tenant resource processing method. The method further includes: The user-level resource structure tree is cached in a cache table. If a login request from the user is received again within the preset cache validity period, the user-level resource structure tree is retrieved directly from the cache table. If a change in user permissions is detected, the user-level resource structure tree is cleared from the cache table.

[0083] In this embodiment, after the SaaS system generates the user-level resource structure tree, it caches it in JSON format to the Redis cache data table. According to the caching rule: Key = "UserResource_APPID+" + UserID, the user's user-level resource structure tree is set to "UserResource_CRM001_User007", and the cache validity period is configured to 2 hours to ensure that the resource structure tree can be quickly obtained when the user visits repeatedly in a short period of time, thereby improving page loading efficiency.

[0084] For example, if user User007 logs into the SAAS system again within 1.5 hours of the cache validity period, after the access layer verifies the session validity, the core layer directly queries the data with the key "UserResource_CRM001_User007" in the Redis cache. After the cache is hit, there is no need to repeat the resource calculation, permission filtering and other processes. The cached user-level resource structure tree is directly returned to the front end.

[0085] If the administrator of target tenant Ten012 adds order report permissions to user User007 through the system backend, the permission change operation triggers a cache cleanup event. The SAAS system automatically calls the Redis client to delete the cached data with the key "UserResource_CRM001_User007". When user User007 logs in next time, the core layer will recalculate the user-level resource structure tree containing order report resources and update the cache to ensure that the permission change takes effect in real time.

[0086] The method provided in this application embodiment, through the caching, validity management and active expiration mechanism of the user-level resource structure tree, not only avoids repeated calculations when users access the same resource repeatedly, significantly shortens page loading time, improves system operating efficiency and resource utilization, but also ensures that the latest resource structure can be obtained in real time after user permissions change, thus guaranteeing the accuracy and timeliness of permission control.

[0087] This application also provides another possible implementation of a multi-tenant resource processing method. Figure 7 This is the seventh flowchart illustrating a multi-tenant resource processing method provided in this application embodiment, as shown below. Figure 7 As shown, before obtaining the user-level resource structure tree corresponding to the user using the preset resource data table of the target business application based on the user's user identifier and the identifier of the target tenant to which the user belongs, the method further includes: S701. Obtain the user's input registration request for the target business application.

[0088] S702. Based on the registration request, determine the user's user identifier and the identifier of the target tenant to which the user belongs, as well as the target business application, the version of the target business application, and the service package corresponding to the version of the target business application entered by the user.

[0089] S703. Update the preset resource data table of the target business application based on the user identifier, the target tenant identifier, the target business application, the version of the target business application, and the service package corresponding to the version of the target business application.

[0090] In this embodiment, the user selects the target business application as CRM001 through the registration page of the SAAS system, fills in the tenant name, user account, password and other information, selects the subscription version and service package, and initiates a registration request. The request includes the relevant configuration information of the tenant, user, application version and service package.

[0091] After verifying the registration information (tenant ID Ten015 is not duplicated, service package is compatible with version V3.0), the SAAS system generates user ID User015 (automatically assigned by the system), confirms that the target tenant ID is Ten015, the target business application is App001, the target version is V3.0, and the target service package is Svc008 (basic function enhancement package), and determines the business model of the target business application. Based on this information, a multi-dimensional identifier is generated, specifically: application identifier (AppID) + application version identifier (VersionID) + service package identifier (ServiceID) + tenant identifier (TenantID) + business model type identifier (ModelType, such as "menu" or "permission"); Example: App001_V3.0_Svc008_Ten015_Menu (representing the menu model of application App001, version V3.0, service package Svc008, and tenant Ten015).

[0092] Then, the uniqueness of the identifier is verified. If the identifier is found to be unique, the SaaS system stores the menu model in the model repository and automatically updates the default resource data table of App001: a new association record for Ten015 with V3.0 and Svc008 is added to the tenant-application version-service package relationship table, recording the subscription time and validity period; a new association record for Ten015 with User015 is added to the tenant-user relationship table; and a new authorization record for User015 is added to the role definition table and user authorization table, granting it editable permissions for all resources, ensuring that Ten015 can use the subscribed application version and service package functions normally after registration.

[0093] The method provided in this application embodiment achieves rapid access and resource configuration for new tenants and users by extracting information from registration requests and automatically updating preset resource data tables. It can complete the association and binding of application versions, service packages, tenants, and users, as well as the automatic allocation of roles and permissions without manual intervention, which greatly shortens the online cycle of new tenants and improves the scalability and operational efficiency of the SaaS system. At the same time, the standardized registration process and data table update logic ensure the standardization of tenant information and resource configuration, providing accurate data support for subsequent resource calculation and permission control.

[0094] The following will continue to explain the multi-tenant resource processing apparatus and electronic device provided in any of the above embodiments of this application. The specific implementation process and the resulting technical effects are the same as those in the corresponding method embodiments. For the sake of brevity, the parts not mentioned in this embodiment can be referred to the corresponding content in the method embodiment.

[0095] Figure 8 This is a functional module diagram of a multi-tenant resource processing device provided in an embodiment of this application. Figure 8 As shown, the multi-tenant resource processing apparatus 100 includes: The acquisition module 110 is used to acquire the user's input access request for the target business application; The acquisition module 110 is also used to obtain the user-level resource structure tree corresponding to the user based on the user's user identifier and the identifier of the target tenant to which the user belongs, using the preset resource data table of the target business application; the user-level resource structure tree includes: at least two business modules of the user for the target business application; Module 120 is used to determine the identifier of the target business model corresponding to each business module using the strategy parsing engine; The calling module 130 is used to call the target business model using the model scheduling engine based on the identifier of the target business model, so as to associate the target business model with the target business application; The rendering module 140 is used to render the target business application page according to the user-level resource structure tree to obtain the target page.

[0096] Optionally, the preset resource data table includes: a preset tenant data table, and a preset user data table for each tenant; the acquisition module 110 is further configured to acquire the tenant-level resource structure tree of the target tenant based on the identifier of the target tenant and using the preset tenant data table; and to acquire the user-level resource structure tree based on the user identifier and the tenant-level resource structure tree and using the preset user data table of the target tenant.

[0097] Optionally, the preset tenant data table includes a resource data table and a resource structure data table. The acquisition module 110 is also used to determine the tenant-level resource set of the target tenant based on the identifier of the target tenant using the resource data table; and to determine the tenant-level resource structure tree of the target tenant based on the identifier of the target tenant and the tenant-level resource set of the target tenant using the resource structure data table.

[0098] Optionally, the resource data table includes: a tenant-application version-service package relationship table, an application version definition table, a service package-resource relationship table, and a resource-application version-tenant relationship table; the acquisition module 110 is further configured to determine the target application version and target service package based on the target tenant's identifier using the tenant-application version-service package relationship table; determine the basic resource set based on the target application version using the application version definition table; determine the value-added data set based on the target service package using the service package-resource relationship table; determine the customized resource set based on the target tenant's identifier and target application version using the resource-application version-tenant relationship table; and determine the tenant-level resource set of the target tenant based on the basic resource set, the value-added data set, and the customized resource set.

[0099] Optionally, the resource structure data table includes: a resource structure-application version-tenant relationship table and a resource structure definition table. The acquisition module 110 is also used to determine whether the target tenant has a customized resource structure based on the target tenant's identifier and using the resource structure-application version-tenant relationship table; if it is determined that the target tenant does not have a customized resource structure, then it uses the resource structure-application version-tenant relationship table to determine whether the target tenant has a versioned resource structure based on the target tenant's identifier; if it is determined that the target tenant does not have a versioned resource structure, then it uses the resource structure definition table to determine the basic resource structure based on the target tenant's identifier; and it determines the tenant-level resource structure tree of the target tenant based on the customized resource structure, versioned resource structure, or basic resource structure.

[0100] Optionally, the preset user data table includes: a user definition table, a tenant-user relationship table, and a user permission table; the acquisition module 110 is also used to determine the tenant-level resource set of the target tenant based on the user identifier, using the tenant-user relationship table and the user definition table; determine the user's restricted access resource set based on the user identifier and the user permission table; determine the user's user resource set based on the tenant-level resource set and the restricted access resource set; and determine the user's user-level resource structure tree based on the user resource set and the tenant-level resource structure tree.

[0101] Optionally, the device further includes: The caching module is used to cache the user-level resource structure tree to the cache data table; The acquisition module 110 is also used to directly retrieve the user-level resource structure tree from the cache data table if a user's login request is received again within the preset cache validity period. The clearing module is used to clear the user-level resource structure tree from the cache data table if a change in user permissions is detected.

[0102] Optionally, the device further includes: The acquisition module 110 is also used to acquire the user's input registration request for the target business application; The determination module 120 is also used to determine, based on the registration request, the user's user identifier and the identifier of the target tenant to which the user belongs, as well as the target business application, the version of the target business application, and the service package corresponding to the version of the target business application. The update module is used to update the preset resource data table of the target business application based on the user identifier, the target tenant identifier, the target business application, the version of the target business application, and the service package corresponding to the version of the target business application.

[0103] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0104] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0105] Figure 9 This is a schematic diagram of an electronic device provided in an embodiment of this application. This electronic device can be used for multi-tenant resource processing. Figure 9 As shown, the electronic device includes: a processor 210, a storage medium 220, and a bus 230.

[0106] Storage medium 220 stores machine-readable instructions executable by processor 210. When the electronic device is running, processor 210 communicates with storage medium 220 via bus 230, and processor 210 executes the machine-readable instructions to perform the steps of the above method embodiment. The specific implementation and technical effects are similar and will not be described again here.

[0107] Optionally, this application also provides a storage medium 220, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the above-described method embodiments. The specific implementation and technical effects are similar, and will not be repeated here.

[0108] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0109] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0111] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0112] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for handling multi-tenant resources, characterized in that, The method includes: Obtain user-input access requests for the target business application; Based on the user's user identifier and the identifier of the target tenant to which the user belongs, a user-level resource structure tree corresponding to the user is obtained using a preset resource data table of the target business application; the user-level resource structure tree includes: at least two business modules of the user for the target business application; A strategy parsing engine is used to determine the identifier of the target business model corresponding to each of the aforementioned business modules; Based on the identifier of the target business model, the model scheduling engine is used to invoke the target business model to associate the target business model with the target business application; Based on the user-level resource structure tree, the target business application is rendered to obtain the target page.

2. The method as described in claim 1, characterized in that, The preset resource data table includes: a preset tenant data table, and a preset user data table for each tenant; obtaining the user-level resource structure tree corresponding to the user based on the user's user identifier and the tenant identifier to which the user belongs includes: Based on the identifier of the target tenant, the tenant-level resource structure tree of the target tenant is obtained using the preset tenant data table; Based on the user identifier and the tenant-level resource structure tree, the user-level resource structure tree is obtained using the target tenant's preset user data table.

3. The method as described in claim 2, characterized in that, The preset tenant data table includes a resource data table and a resource structure data table. The step of obtaining the tenant-level resource structure tree of the target tenant using the preset tenant data table based on the target tenant's identifier includes: Based on the identifier of the target tenant, the tenant-level resource set of the target tenant is determined using the resource data table; Based on the target tenant's identifier and the target tenant's tenant-level resource set, the target tenant's tenant-level resource structure tree is determined using the resource structure data table.

4. The method as described in claim 3, characterized in that, The resource data table includes: a tenant-application version-service package relationship table, an application version definition table, a service package-resource relationship table, and a resource-application version-tenant relationship table; the step of determining the tenant-level resource set of the target tenant based on the identifier of the target tenant using the resource data table includes: Based on the identifier of the target tenant, the target application version and target service package are determined using the tenant-application version-service package relationship table; Based on the target application version, the basic resource set is determined using the application version definition table; Based on the target service package, the value-added dataset is determined using the service package-resource relationship table. Based on the target tenant's identifier and the target application version, a customized resource set is determined using the resource-application version-tenant relationship table; Based on the basic resource set, the value-added dataset, and the customized resource set, the tenant-level resource set of the target tenant is determined.

5. The method as described in claim 3, characterized in that, The resource structure data table includes: a resource structure-application version-tenant relationship table and a resource structure definition table. The step of determining the tenant-level resource structure tree of the target tenant using the resource structure data table, based on the target tenant's identifier and the target tenant's tenant-level resource set, includes: Based on the identifier of the target tenant, the resource structure-application version-tenant relationship table is used to determine whether the target tenant has a customized resource structure; If it is determined that the target tenant does not have the customized resource structure, then based on the identifier of the target tenant, the resource structure-application version-tenant relationship table is used to determine whether the target tenant has a version resource structure; If it is determined that the target tenant does not have the version resource structure, then the basic resource structure is determined based on the identifier of the target tenant using the resource structure definition table; Based on the customized resource structure, the version resource structure, or the basic resource structure, determine the tenant-level resource structure tree of the target tenant.

6. The method as described in claim 3, characterized in that, The preset user data table includes: a user definition table, a tenant-user relationship table, and a user permission table; the step of obtaining the user-level resource structure tree based on the user identifier and the tenant-level resource structure tree, using the preset user data table of the target tenant, includes: Based on the user identifier, the tenant-user relationship table and the user definition table are used to determine the tenant-level resource set of the target tenant; Based on the user identifier, the user permission table is used to determine the set of restricted access resources for the user; The user's resource set is determined based on the tenant-level resource set and the restricted access resource set; The user-level resource structure tree of the user is determined based on the user resource set and the tenant-level resource structure tree.

7. The method as described in claim 2, characterized in that, The method further includes: Cache the user-level resource structure tree to a cache data table; If the user's login request is received again within the preset cache validity period, the user-level resource structure tree is directly retrieved from the cache data table. If a change in the user's permissions is detected, the user-level resource structure tree is cleared from the cached data table.

8. The method as described in claim 1, characterized in that, Before obtaining the user-level resource structure tree corresponding to the user using a preset resource data table of the target business application based on the user's user identifier and the identifier of the target tenant to which the user belongs, the method further includes: Obtain the registration request for the target business application input by the user; Based on the registration request, determine the user's user identifier and the identifier of the target tenant to which the user belongs, as well as the target business application, the version of the target business application, and the service package corresponding to the version of the target business application entered by the user; Based on the user identifier, the target tenant identifier, the target business application, the version of the target business application, and the service package corresponding to the version of the target business application, update the preset resource data table of the target business application.

9. A multi-tenant resource processing device, characterized in that, include: The acquisition module is used to acquire user input of access requests for the target business application; The acquisition module is further configured to acquire the user-level resource structure tree corresponding to the user based on the user identifier of the user and the identifier of the target tenant to which the user belongs, using a preset resource data table of the target business application; The user-level resource structure tree includes: at least two business modules of the user for the target business application; The determination module is used to use the strategy parsing engine to determine the identifier of the target business model corresponding to each of the business modules; The invocation module is used to invoke the target business model using the model scheduling engine based on the identifier of the target business model, so as to associate the target business model with the target business application; The rendering module is used to render the target business application page according to the user-level resource structure tree to obtain the target page.

10. An electronic device, characterized in that, include: The device includes a processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of the multi-tenant resource processing method as described in any one of claims 1 to 8.

Images