Control method, system, device, processor and storage medium for realizing separation of administrative level and data visibility in multi-tenant system

Abstract

The application relates to a control method for realizing separation of administrative hierarchy and data visibility in a multi-tenant system, comprising the following steps: establishing an administrative link record, the administrative link record storing the hierarchical relationship of all tenants on a complete administrative link in the form of a string Path; independently configuring a visibility parameter for each tenant in a tenant configuration; when a first tenant initiates a data query request, performing prefix matching through the string Path to calculate a visible tenant set that the first tenant has access to; within the visible tenant set, querying data resources that meet a preset visibility level and returning. The control method for realizing separation of administrative hierarchy and data visibility in the multi-tenant system, the system, the device, the processor and the computer readable storage medium thereof adopt the application, which guarantees administrative logic compliance and data ownership clarity, reduces the complexity of administrative link storage redundancy and organization transfer, and improves query and change efficiency.

Description

Technical Field

[0001] This invention relates to the field of computer software technology, and more particularly to the fields of multi-tenant systems, access control, data isolation, and administrative hierarchy management. Specifically, it refers to a control method, system, device, processor, and computer-readable storage medium for separating administrative hierarchy from data visibility in a multi-tenant system. Background Technology

[0002] In a multi-tenant system, the tenant is the most crucial unit of isolation. Currently, mainstream multi-tenant data isolation solutions include: 1. Independent database mode: Each tenant has an independent database, which provides the strongest isolation, but has high management costs and cannot achieve cross-tenant data sharing.

[0003] 2. Shared database, independent schema mode: Each tenant has an independent schema, which provides good isolation, but cross-schema queries are difficult.

[0004] 3. Shared database and shared schema mode: The most common mode is to distinguish the ownership of data by the tenant_id field, but cross-tenant permission control is complicated.

[0005] In scenarios involving multiple levels of administrative agencies (such as a four-level structure of province, city, district, and police station), existing technologies have the following problems: Question 1: The mandatory binding of administrative hierarchy and data visibility in existing systems means that the scope of data visibility is often directly determined by the administrative hierarchy. That is, "superiors can naturally see all data of subordinates", and it is impossible to achieve flexible control such as "both superiors choose to see subordinates, while B chooses not to see subordinates".

[0006] Question 2: Coarse-grained cross-tenant visibility control. Existing multi-tenant systems are either completely isolated (completely invisible between tenants) or completely open (globally visible), lacking a fine-grained control mechanism that allows "superiors to see subordinates, but subordinates cannot block superiors, and peers can independently control visibility."

[0007] Question 3: Redundancy and high change costs in administrative link storage. Traditionally, relational databases are used to store organizational hierarchy (parent_id, level, etc.). N-level relationships require N records. Querying the superior requires recursion or join. Organizational transfer requires updating the foreign keys of N records, which is inefficient.

[0008] Question 4: Confusion between intra-tenant organizational tree and cross-tenant administrative hierarchy. In existing technology, the intra-tenant organizational structure (departments, offices, etc.) and the administrative hierarchy between tenants are often confused, resulting in: cross-tenant mounting of organizational nodes (attaching a department of tenant A under the organizational tree of tenant B); destruction of the independence of the organizational tree; and confusion of business data ownership.

[0009] Furthermore, in existing patent technology, prior art document 1 (CN202511532407.3) discloses a method for cross-tenant management of users in a group-level multi-tenant software system. This method mainly solves the problem of account transfer between multiple tenants, and realizes cross-tenant login of personnel through the mechanism of "global area user table" and "tenant area user table". Its core process is as follows: Personnel A first adds to the global area user table and the tenant A user table; the tenant B administrator initiates a request to add cross-tenant users; after approval by both parties, personnel A obtains login permissions for tenant B; when logging in, personnel A can select a tenant and enter the corresponding work area. This scheme can realize cross-tenant collaboration of personnel, but it is essentially a "binary choice model" - "can enter" or "cannot enter", that is, it can only control whether personnel can enter a specific tenant, without involving what data can be seen after entering the tenant, let alone the administrative hierarchy between tenants. In addition, all tenants in prior art document 1 are flat, and there is no superior-subordinate relationship, no administrative link, and no hierarchical path between tenants.

[0010] Reference document 2 (CN202511246210.3) discloses a multi-tenant data isolation access method, the core of which lies in constructing a user organization permission tree. By intercepting the original data query statement, user organization permission information is written into the query statement to achieve data access control. However, this solution is only applicable to single-tenant internal scenarios. The construction of its organization permission tree depends on the premise of "belonging tenant". All organization nodes belong to the same tenant. The recursive query and SQL rewriting mechanism are naturally limited by the single-tenant boundary and cannot be directly used to express and query cross-tenant administrative hierarchy relationships.

[0011] Simply combining the technical solutions in the two comparative documents only achieves functionality in two independent dimensions: "cross-tenant login" and "data isolation within the tenant's organizational hierarchy." However, it still fails to address the core issue of "how tenant A (as the superior administrative unit) can flexibly control the visibility of data to subordinate tenants such as tenants B, C, and D." Neither solution involves the technical concept of "decoupling administrative hierarchy from data visibility," nor does it provide technical means such as using string paths to express cross-tenant administrative links, configuring independent tenant visibility parameters, physically separating the organizational tree from the administrative hierarchy, or providing two-layer lossless secondment authorization. Summary of the Invention

[0012] The purpose of this invention is to overcome the shortcomings of the prior art and provide a control method, system, device, processor and its computer-readable storage medium for separating administrative hierarchy and data visibility in a multi-tenant system, which has good integrity, flexible management and wide applicability.

[0013] To achieve the above objectives, the present invention provides a control method, system, apparatus, processor, and computer-readable storage medium for separating administrative hierarchy and data visibility in a multi-tenant system, as follows: The control method for separating administrative hierarchy and data visibility in a multi-tenant system is characterized by the following steps: (1) Establish an administrative link record, wherein the administrative link record stores the hierarchical relationship of all tenants on a complete administrative link in the form of a string Path. The string Path uses a first separator to represent the superior-subordinate relationship and a second separator to represent the peer relationship, and the first separator is added to both the beginning and the end of the string Path. (2) Configure visibility parameters independently for each tenant in the tenant configuration. The visibility parameters include visibility range mode, or include visibility range mode and visible target list. (3) When the first tenant initiates a data query request, the set of visible tenants that the first tenant is authorized to access is calculated by performing prefix matching on the string Path in the administrative link record based on the visibility parameter of the first tenant; (4) Within the set of visible tenants, query and return data resources that meet the preset visibility level; The visibility parameters are independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link are configured with different visibility parameters.

[0014] Preferably, the first separator is a slash, and the second separator is a vertical line, wherein the slash is used to separate tenant identifiers with a hierarchical relationship, and the vertical line is used to connect tenant identifiers with a peer relationship.

[0015] Preferably, the method further includes a step of querying the parent tenant based on the string Path, specifically including the following processing steps: After removing the first and last forward slashes from the string Path, split it by forward slashes to obtain multiple tenant identifier elements. Take all elements except the last one, re-concatenate them by forward slashes, and add forward slashes at the beginning and end to obtain the path of the parent tenant.

[0016] Preferably, the method further includes a step of querying the next-level tenant based on the string Path, specifically including the following processing steps: Using the current tenant's string Path as a prefix, perform prefix matching in the administrative link record, and identify tenants whose string Path is prefixed with the current tenant's string Path and whose string Path is not equal to the current tenant's string Path as subordinate tenants.

[0017] Preferably, the visibility range modes include a first mode, a second mode, a third mode, and a fourth mode. The first mode only shows the data of the current tenant; the second mode shows the data of the current tenant and all administrative subordinate tenants; the third mode shows the data of the current tenant and designated subordinate tenants; and the fourth mode shows the data of all tenants.

[0018] Preferably, step (3) specifically includes the following steps: (3.1) When the visibility range mode is the first mode, the set of visible tenants is determined as the current tenant itself; (3.2) When the visibility range mode is the second mode, obtain all paths in the administrative link record, and take the tenants whose paths are prefixed with the current tenant's string Path and are not equal to the current tenant's string Path, together with the current tenant itself, as the visible tenant set; (3.3) When the visibility range mode is the third mode, the path with the current tenant's string Path as the prefix is ​​selected from the visible target list, and the tenants corresponding to the selected paths and the current tenant itself are used together as the visible tenant set; (3.4) When the visibility range mode is the fourth mode, all tenants are taken as the visible tenant set.

[0019] Preferably, in the third mode, the path of the visible sub-tenant is specified through the visible target list, and an exact match query is performed based on the path in the visible target list.

[0020] Preferably, the query in step (4) satisfies the data resources with a preset visibility level, including a first-level filter and a second-level filter. The first-level filter calculates the set of visible tenants based on the visibility parameters, and the second-level filter filters the data resources within the set of visible tenants based on the visibility level of the data resources. The data resources include a tenant identifier field that identifies the tenant to which the data belongs and a visibility level field that identifies the visible range of the data.

[0021] Preferably, the administrative link record is physically separated from the organizational tree record within each tenant. The organizational tree record is limited to a single tenant and isolated by a tenant identifier. The administrative link record manages the administrative hierarchy relationship across tenants through the string Path. The administrative link record and the organizational tree record are associated through the tenant identifier and each maintains an independent tree structure.

[0022] Preferably, the method further includes a step of cross-tenant borrowing authorization, specifically including the following processing steps: Personnel secondment involves adding personnel secondment information to the extended fields of the organization member record. The personnel secondment information includes the target tenant identifier, target organization identifier, role, and validity period. Departmental secondment: Add departmental secondment information to the extended fields of the organization record. The departmental secondment information includes the target tenant identifier, default role, and validity period. The departmental secondment information is automatically inherited to all members under the organization, including newly joined members.

[0023] The personnel secondment and the departmental secondment do not change the original organizational relationship, and the role of the seconded person is configured independently within the target tenant.

[0024] Preferably, if the same member has both a personal role configured for personnel secondment and a departmental default role configured for departmental secondment, then the member's final role in the target tenant is the union of the personal role and the departmental default role, and the personal role has a higher priority than the departmental default role.

[0025] Preferably, step (3) further includes the following steps: Subordinate tenants cannot prevent superior tenants from viewing their data. Whether a superior tenant can view a subordinate tenant's data depends solely on the superior tenant's own visibility mode. Subordinate tenants hide private data by setting the visibility level of data resources to the private level.

[0026] The control system for separating administrative hierarchy and data visibility in a multi-tenant system is characterized in that the system comprises: The administrative link management module is used to store and manage administrative link records in the form of a string Path. The string Path uses a first separator to represent the hierarchical relationship and a second separator to represent the peer relationship, and the first separator is added at both the beginning and the end. The tenant visibility configuration module, connected to the administrative link management module, is used to independently configure visibility parameters for each tenant. The visibility parameters include a visibility range mode, or a visibility range mode and a list of visible targets. The visibility calculation module, connected to the tenant visibility configuration module, is used to receive the data query request of the first tenant, calculate and output the set of visible tenants that the first tenant has the right to access based on the visibility parameters of the first tenant and by performing prefix matching on the string Path in the administrative link record. The data query module, connected to the visibility calculation module, is used to query data resources that meet the preset visibility level within the set of visible tenants and output the query results. The visibility parameters are independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link are configured with different visibility parameters.

[0027] Preferably, the system further includes an organization tree management module and a secondment authorization module. The organization tree management module is used to manage organization tree records that are limited to a single tenant and isolated by a tenant identifier. The organization tree records are physically separated from the administrative link records. The secondment authorization module is used to add personnel secondment information to the extended fields of the organization member records and add department secondment information to the extended fields of the organization records. The personnel secondment information includes the target tenant identifier, the target organization identifier, the role, and the validity period. The department secondment information includes the target tenant identifier, the default role, and the validity period.

[0028] The control device for separating administrative hierarchy and data visibility in a multi-tenant system is characterized by the following: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the control method described above for separating administrative hierarchy and data visibility in a multi-tenant system.

[0029] The control processor that realizes the separation of administrative hierarchy and data visibility in a multi-tenant system is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the control method for realizing the separation of administrative hierarchy and data visibility in a multi-tenant system are implemented.

[0030] The computer-readable storage medium is characterized in that it stores a computer program that can be executed by a processor to implement the steps of the control method described above for separating administrative hierarchy and data visibility in a multi-tenant system.

[0031] This invention employs a control method, system, device, processor, and computer-readable storage medium for separating administrative hierarchy and data visibility in a multi-tenant system. By storing the complete cross-tenant administrative link in the form of a string path and configuring visibility parameters independently for each tenant, it enables differentiated data visibility range control for tenants at different levels or within the same administrative link, eliminating the limitation of the mandatory binding of administrative hierarchy and data visibility in traditional solutions. This method physically separates the administrative hierarchy relationship between tenants from the internal organizational tree of the tenants and introduces a two-layer secondment authorization mechanism to ensure that organizational restructuring does not affect the administrative hierarchy positioning and that cross-tenant personnel and departmental collaboration does not disrupt the original organizational affiliation. Thus, while improving the flexibility and granularity of cross-tenant data visibility configuration, it ensures the compliance of administrative logic and the clarity of data affiliation, reduces administrative link storage redundancy and organizational transfer complexity, improves query and change efficiency, and enhances the overall reliability of the multi-tenant system and its ability to adapt to complex administrative collaboration scenarios. Attached Figure Description

[0032] Figure 1 This is a system architecture diagram of the control system for separating administrative hierarchy and data visibility in a multi-tenant system, as described in this invention.

[0033] Figure 2 This is a flowchart illustrating the visibility calculation process of the control method for separating administrative hierarchy and data visibility in a multi-tenant system, as described in this invention.

[0034] Figure 3 This is a schematic diagram of administrative link changes for the control method of separating administrative hierarchy and data visibility in a multi-tenant system according to the present invention.

[0035] Figure 4 This is a schematic diagram of a two-layer secondment authorization method for implementing the separation of administrative hierarchy and data visibility in a multi-tenant system according to the present invention. Detailed Implementation

[0036] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0037] The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to the present invention includes the following steps: (1) Establish an administrative link record, wherein the administrative link record stores the hierarchical relationship of all tenants on a complete administrative link in the form of a string Path. The string Path uses a first separator to represent the superior-subordinate relationship and a second separator to represent the peer relationship, and the first separator is added to both the beginning and the end of the string Path. (2) Configure visibility parameters independently for each tenant in the tenant configuration. The visibility parameters include visibility range mode, or include visibility range mode and visible target list. (3) When the first tenant initiates a data query request, the set of visible tenants that the first tenant is authorized to access is calculated by performing prefix matching on the string Path in the administrative link record based on the visibility parameter of the first tenant; (4) Within the set of visible tenants, query and return data resources that meet the preset visibility level; The visibility parameters are independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link are configured with different visibility parameters.

[0038] In a preferred embodiment of the present invention, the first separator is a slash and the second separator is a vertical line, wherein the slash is used to separate tenant identifiers with a hierarchical relationship and the vertical line is used to connect tenant identifiers with a peer relationship.

[0039] In a preferred embodiment of the present invention, the method further includes a step of querying the parent tenant based on the string Path, specifically including the following processing steps: After removing the first and last forward slashes from the string Path, split it by forward slashes to obtain multiple tenant identifier elements. Take all elements except the last one, re-concatenate them by forward slashes, and add forward slashes at the beginning and end to obtain the path of the parent tenant.

[0040] In a preferred embodiment of the present invention, the method further includes a step of querying the lower-level tenant based on the string Path, specifically including the following processing steps: Using the current tenant's string Path as a prefix, perform prefix matching in the administrative link record, and identify tenants whose string Path is prefixed with the current tenant's string Path and whose string Path is not equal to the current tenant's string Path as subordinate tenants.

[0041] In a preferred embodiment of the present invention, the visibility range modes include a first mode, a second mode, a third mode, and a fourth mode. The first mode only shows the data of the current tenant; the second mode shows the data of the current tenant and all administrative subordinate tenants; the third mode shows the data of the current tenant and designated subordinate tenants; and the fourth mode shows the data of all tenants.

[0042] In a preferred embodiment of the present invention, step (3) specifically includes the following steps: (3.1) When the visibility range mode is the first mode, the set of visible tenants is determined as the current tenant itself; (3.2) When the visibility range mode is the second mode, obtain all paths in the administrative link record, and take the tenants whose paths are prefixed with the current tenant's string Path and are not equal to the current tenant's string Path, together with the current tenant itself, as the visible tenant set; (3.3) When the visibility range mode is the third mode, the path with the current tenant's string Path as the prefix is ​​selected from the visible target list, and the tenants corresponding to the selected paths and the current tenant itself are used together as the visible tenant set; (3.4) When the visibility range mode is the fourth mode, all tenants are taken as the visible tenant set.

[0043] In a preferred embodiment of the present invention, in the third mode, the path of the visible sub-tenant is specified by the visible target list, and an exact matching query is performed based on the path in the visible target list.

[0044] As a preferred embodiment of the present invention, the query of data resources in step (4) that meet the preset visibility level includes a first-level filter and a second-level filter. The first-level filter calculates the set of visible tenants based on the visibility parameters. The second-level filter filters the set of visible tenants based on the visibility level of the data resources. The data resources include a tenant identifier field that identifies the tenant to which the data belongs and a visibility level field that identifies the visible range of the data.

[0045] In a preferred embodiment of the present invention, the administrative link record is physically separated from the organizational tree record within each tenant. The organizational tree record is limited to a single tenant and isolated by a tenant identifier. The administrative link record manages the administrative hierarchy relationship across tenants through the string Path. The administrative link record and the organizational tree record are associated through the tenant identifier and each maintains an independent tree structure.

[0046] In a preferred embodiment of the present invention, the method further includes a step of cross-tenant borrowing authorization, specifically including the following processing steps: Personnel secondment involves adding personnel secondment information to the extended fields of the organization member record. The personnel secondment information includes the target tenant identifier, target organization identifier, role, and validity period. Departmental secondment: Add departmental secondment information to the extended fields of the organization record. The departmental secondment information includes the target tenant identifier, default role, and validity period. The departmental secondment information is automatically inherited to all members under the organization, including newly joined members. The personnel secondment and the departmental secondment do not change the original organizational relationship, and the role of the seconded person is configured independently within the target tenant.

[0047] In a preferred embodiment of the present invention, if the same member has both a personal role configured for personnel secondment and a departmental default role configured for departmental secondment, then the member's final role in the target tenant is the union of the personal role and the departmental default role, and the personal role has a higher priority than the departmental default role.

[0048] In a preferred embodiment of the present invention, step (3) further includes the following steps: Subordinate tenants cannot prevent superior tenants from viewing their data. Whether a superior tenant can view a subordinate tenant's data depends solely on the superior tenant's own visibility mode. Subordinate tenants hide private data by setting the visibility level of data resources to the private level.

[0049] The present invention provides a control system for separating administrative hierarchy and data visibility in a multi-tenant system, wherein the system comprises: The administrative link management module is used to store and manage administrative link records in the form of a string Path. The string Path uses a first separator to represent the hierarchical relationship and a second separator to represent the peer relationship, and the first separator is added at both the beginning and the end. The tenant visibility configuration module, connected to the administrative link management module, is used to independently configure visibility parameters for each tenant. The visibility parameters include a visibility range mode, or a visibility range mode and a list of visible targets. The visibility calculation module, connected to the tenant visibility configuration module, is used to receive the data query request of the first tenant, calculate and output the set of visible tenants that the first tenant has the right to access based on the visibility parameters of the first tenant and by performing prefix matching on the string Path in the administrative link record. The data query module, connected to the visibility calculation module, is used to query data resources that meet the preset visibility level within the set of visible tenants and output the query results. The visibility parameters are independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link are configured with different visibility parameters.

[0050] In a preferred embodiment of the present invention, the system further includes an organization tree management module and a secondment authorization module. The organization tree management module is used to manage organization tree records that are limited to a single tenant and isolated by a tenant identifier. The organization tree records are physically separated from the administrative link records. The secondment authorization module is used to add personnel secondment information to the extended fields of the organization member records and to add department secondment information to the extended fields of the organization records. The personnel secondment information includes the target tenant identifier, the target organization identifier, the role, and the validity period. The department secondment information includes the target tenant identifier, the default role, and the validity period.

[0051] The control device of the present invention for separating administrative hierarchy and data visibility in a multi-tenant system includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the control method described above for separating administrative hierarchy and data visibility in a multi-tenant system.

[0052] The present invention discloses a control processor for separating administrative hierarchy and data visibility in a multi-tenant system, wherein the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the control method for separating administrative hierarchy and data visibility in a multi-tenant system are implemented.

[0053] The computer-readable storage medium of the present invention stores a computer program that can be executed by a processor to implement the various steps of the control method for separating administrative hierarchy and data visibility in a multi-tenant system as described above.

[0054] This invention aims to solve the following technical problems: 1. Decoupling of administrative hierarchy and data visibility: This allows each tenant in the same administrative chain to independently control its data visibility scope, without being constrained by its position in the administrative hierarchy.

[0055] 2. Fine-grained cross-tenant visibility control: Provides four levels of control modes: Mode 1 (only itself), Mode 2 (itself and all administrative subordinates), Mode 3 (itself + specified subordinates), and Mode 4 (all), and supports the visible_targets field to achieve fixed-point visibility.

[0056] 3. High-efficiency administrative link expression and query: The complete administrative link is expressed by the string Path. One record carries N levels of relationship. The upper level can be queried in O(1) time and the lower level can be queried by the prefix index.

[0057] 4. Separation of intra-tenant organizational tree and cross-tenant administrative hierarchy: The organizational tree is limited to a single tenant, and the cross-tenant administrative hierarchy is managed through an independent tenant_hierarchy table, and the two do not interfere with each other.

[0058] 5. Support for cross-tenant secondment scenarios: Personnel secondment does not change organizational relationships, department secondment does not move the organizational tree, and roles are configured independently within the target tenant.

[0059] The present invention provides a control method for separating administrative hierarchy and data visibility in a multi-tenant system, comprising: Establish an administrative link record, which stores the hierarchical relationship of all tenants on a complete administrative link in the form of a string Path; Configure visibility parameters independently for each tenant. The visibility parameters include a visibility range mode, or a visibility range mode and a list of visible targets. When the first tenant initiates a data query request, the set of tenants that the first tenant is entitled to access is calculated based on the first tenant's visibility parameters; Within the tenant set, query data resources that meet the preset visibility level; The visibility parameter is independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link can configure different visibility parameters.

[0060] The format of the string Path is: Use " / " as a separator to indicate hierarchical relationships, and use "|" as a separator to indicate peer relationships. " / " must be added to the beginning and end of the Path.

[0061] The visibility range mode includes: First mode: Only the current tenant's own data is visible; Second mode: Data of the current tenant and all subordinate administrative tenants is visible; Third mode: Viewable data of the current tenant and specified sub-tenants; Fourth mode: Data for all tenants is visible.

[0062] In the custom mode, the path of the visible sub-tenant is specified through the visible target list, and the system performs an exact match query based on the path in the visible target list.

[0063] The method further includes: when it is necessary to adjust the administrative level position of a tenant, only one Path string in the administrative link record needs to be modified, as well as the path in the visibility parameter of the tenant itself, without modifying other related records.

[0064] The administrative link record is independent of the organization tree record within each tenant. The organization tree record is limited to a single tenant and is isolated by the tenant ID.

[0065] The method also includes a cross-tenant borrowing authorization method: Personnel secondment: Add secondment information to the extended fields of the organization member record, including the target tenant, target organization, role, and validity period; Departmental secondment: Add secondment information to the extended fields of the organization record, including the target tenant, default role, and validity period; The secondment to the department is automatically inherited by all members under that organization; The roles are configured independently within the target tenant and do not inherit from the original tenant roles.

[0066] When both personnel secondment and departmental secondment exist, the final role merging rule is: take the union of the individual role and the department's default role, with the individual role having higher priority than the department's default role.

[0067] A control system for separating administrative hierarchy and data visibility in a multi-tenant system includes: Administrative Link Management Module: Used to store and manage administrative link records in the form of strings (Path). Tenant visibility configuration module: used to configure visibility parameters independently for each tenant; Visibility calculation module: used to calculate the set of tenants that the tenant who initiated the query has the right to access based on the tenant's visibility parameters; Data Query Module: Used to query data resources within the set of tenants.

[0068] This invention proposes a control method for separating administrative hierarchy and data visibility in a multi-tenant system.

[0069] This invention uses the string "Path" as a complete representation of administrative links: Path format definition: / Separator: Indicates hierarchical relationship | Separator: Indicates a peer relationship Forced addition of / at the beginning and end Data example: A complete four-level link: province → city → district → institute: {path:" / T_province / T_city / T_district / T_institute / ",type:"hierarchy"} Units at the same level: {path:" / T_Traffic Police Detachment|T_Emergency Management Bureau / ",type:"hierarchy"} Comparison with traditional solutions: Check the parent method (O(1) complexity, no database query required): path:=" / T_province / T_city / T_district / " pathParts:=strings.Split(strings.Trim(path," / ")," / ") / / pathParts=["T_Province","T_City","T_District"] superiorPath:=" / "+strings.Join(pathParts[:len(pathParts)-1]," / ")+" / " / / superiorPath=" / T_province / T_city / " The core of this invention lies in the separation of administrative hierarchy and data visibility, which is achieved through independent control of the visible_scope and visible_targets fields in the tenants table.

[0070] Tenant configuration data structure: type Tenant struct{ ID string / / Unique identifier for tenant Path string / / Administrative level location, such as " / T_province / T_city / " VisibleScope string / / Visible range mode VisibleTargets[]string / / List of tenant paths that are visible to fixed targets in custom mode } The specific values ​​for the visible range mode are as follows: First mode (visibility range mode field value is org): Only the data of the current tenant is visible; Second mode (visibility range mode field value is org_children): Data of the current tenant and all administrative subordinate tenants is visible; Third mode (visibility range mode field value is custom): Data of the current tenant and specified sub-tenants is visible; Fourth mode (visibility range mode field value is all): Data is visible to all tenants.

[0071] Among them, org, org_children, custom, and all are the literal values ​​of the visibility range pattern fields in data storage, and their corresponding Chinese semantics are the first to the fourth patterns, respectively.

[0072] Four-level control mode: Visibility calculation process: (1) User logs in and obtains the visibility range mode configuration of the tenant; (2) Calculate the set of visible tenants based on the visibility range pattern; (3) Query the data that matches the visible_level within the visible tenant range.

[0073] The principle of "superiors have no authority": Subordinate units cannot prevent superiors from viewing their data; • Whether a superior can see a subordinate depends solely on the superior's own visibility mode settings; • Subordinates can only control the hiding of private data by setting the visibility level of data resources to the private level.

[0074] This invention also provides a two-tiered on-demand authorization mechanism across tenants: Personnel secondment layer: stored in Member.PostInfo.secondment, does not create new Member records; roles are configured independently within the target tenant; supports validity period, automatically expires upon expiration; does not affect the original organizational relationship.

[0075] Departmental secondment layer: stored in Organization.Extra.secondment, does not move the organization tree, and does not mount nodes across tenants; all members under this organization automatically inherit the secondment status; newly joined members automatically obtain it; default_roles uniformly configures the department's default role; individuals can override the department's default role.

[0076] Character merging rules: Final Role = Individual Role ∪ Department Default Role (Union, Individual Role Prioritized) In a specific embodiment of the present invention, the system deployment architecture is as follows: Application layer (multi-tenant SaaS platform); Account Service; Data layer (MongoDB): ├──tenants (tenant configuration table) ├──tenant_hierarchy (Administrative Hierarchy Table) ├──organizations (organizational tree) ├──members (Organization Member List) └──personal_users (personal user table) The complete implementation process is as follows: Step 1: Tenant Initialization Each organization automatically creates a separate tenant when it connects to the system, and writes it to the tenants table: / / T_A Provincial Public Security Bureau {"_id":"T_A","path":" / T_A / ","visible_scope":"org_children"} / / T_B City Public Security Bureau {"_id":"T_B","path":" / T_A / T_B / ","visible_scope":"org"} / / T_C District Public Security Bureau {"_id":"T_C","path":" / T_A / T_B / T_C / ","visible_scope":"org_children"} / / T_D Police Station {"_id":"T_D","path":" / T_A / T_B / T_C / T_D / ","visible_scope":"org"} Step 2: Establish administrative links The four tenants form a complete administrative chain, and the tenant_hierarchy table contains only one record: {"path":" / T_A / T_B / T_C / T_D / ","type":"hierarchy"} Step 3: Each tenant builds its internal organization tree Each tenant establishes its own organizational structure in the organizations table, isolated by tenant_id, and they do not interfere with each other.

[0077] Step 4: Data Creation and Visibility Markup Users can choose a visibility level when creating data: { "creator": "M_C1", "creator_type": "member", "tenant_id": "T_C", "org_id": "ORG_C2", "visible_level": "ORG_CHILDREN", "content": "..." } Step 5: Visibility calculation during data query User login, obtain tenant_id, and query tenant's visible_scope.

[0078] scope="org_children",path=" / T_A / T_B / T_C / " In tenant_hierarchy, the prefix matches path:"^ / T_A / T_B / T_C / ".

[0079] Get the set of visible tenants: [T_C(self), T_D(subordinates)].

[0080] Query the data that matches the visible_level for these tenants.

[0081] The present invention has the following embodiments: Example 1: Different Visibility at the Same Level Scenario: T_B (Municipal Public Security Bureau) and T_C (District Public Security Bureau) are both nodes in the administrative chain, but their visibility requirements are different.

[0082] The visibility scope mode configuration for each tenant is shown in the table below (the VisibleScope column in the table represents the literal values ​​of the fields in the data store): Technical effect: It enables each node in the same administrative link to independently control visibility, breaking through the traditional constraint that "superiors must see subordinates".

[0083] Example 2: Organizational Transfer Scenario: T_D is transferred from T_C to T_B as a direct pipe.

[0084] operate: 1. Update the path of T_D in tenant_hierarchy: / T_A / T_B / T_C / T_D / → / T_A / T_B / T_D / 2. Update the path of T_D in tenants: / T_A / T_B / T_C / T_D / → / T_A / T_B / Comparison before and after the change: Before the change: T_C prefix matches / T_A / T_B / T_C / → includes T_D After the change: The T_C prefix matches / T_A / T_B / T_C / → no longer includes T_D. To view T_D data, T_B should set its visibility mode to the third mode (field value: custom) and configure the visible target list to [" / T_A / T_B / T_D / "]. Technical effect: Organizational transfer can be completed with a single Path change, without the need to modify N records.

[0085] Example 3: Temporary Transfer Scenario Personnel secondment: A member of T_C is seconded to T_B. This is added to Member's PostInfo: { "post_info": { "secondment": [{ "target_tenant_id": "T_B", "target_org_id": "ORG_B1", "roles": ["ROLE_VIEWER"], "expire_at": "2026-07-31" }] } } Departmental secondment: An entire department of T_C is seconded to T_D. Add the following to the Extra section of the Organization: { "extra": { "secondment": [{ "target_tenant_id": "T_D", "default_roles": ["ROLE_PATROL"], "expire_at": "2026-08-31" }] } } Technical effect: Personnel secondment does not change organizational relationships, department secondment does not move the organizational tree, and roles are configured independently within the target tenant.

[0086] The Path in the technical solution of this invention is a link in the whole "hierarchy and visibility decoupling" system. It is not only a storage format, but also a matching anchor point during visibility calculation.

[0087] In the technical solution of this invention, tenants located at different positions within the same administrative link can independently select different visibility range modes, and this selection is not constrained by hierarchical position. This configuration result seems counterintuitive in traditional administrative logic, where superiors see less than subordinates, but this is precisely the power of the "decoupling" design of this invention, which is not mentioned in existing technologies.

[0088] The above configuration is not unrealistic, but corresponds to two real-world administrative business scenarios: (1) Special project scenario: The provincial department needs to submit a provincial special fund budget to the central government. This budget only involves provincial-level data. Allowing access to municipal bureau data may lead to inconsistencies in data scope or information leakage. In this case, the provincial department configures visible_scope=org to restrict itself to accessing only provincial-level data, ensuring data confidentiality and security.

[0089] (2) Hierarchical Authorization Audit Scenario: A municipal bureau is undergoing an audit by a higher authority. To ensure data isolation during the audit process, the audit team (located at the higher level) is configured to only view its own working papers and not the business data of the audited municipal bureau. The audited municipal bureau, on the other hand, is configured with visible_scope=org_children, granting the audit team access to all its subordinate data. This temporary configuration of "subordinates seeing more and superiors seeing less" is completely impossible to achieve in traditional hierarchical locking schemes.

[0090] The above scenarios demonstrate that the decoupled design of "whether a superior can see a subordinate depends on business needs, rather than being automatically determined by hierarchical position" can solve real administrative needs that existing technologies cannot meet.

[0091] The technical solution of this invention separates the tenant_hierarchy (administrative link) from the organizations (organizational tree), motivated by business semantics. The administrative link expresses the "jurisdiction relationship between tenants" (province-managed city, city-managed district). The organizational tree expresses the "departmental structure within a tenant" (criminal investigation department, public security department). If they are mixed together, it will lead to internal departmental adjustments within a tenant, mistakenly triggering changes in administrative hierarchy, and will also lead to cross-tenant departmental assignments, undermining the independence of the organizational tree and data ownership.

[0092] The mapping between the technical problems, technical means, and technical effects in the technical solution of this invention is as follows: (1) Technical Issues: Cascading updates require updating all relevant permission records when a tenant's administrative level changes. This solution uses Path prefix matching and on-demand visibility calculation. The resulting technical effect is that only one Path needs to be modified, and the visibility of all associated tenants is automatically recalculated, resulting in zero cascading updates.

[0093] (2) Technical Issues: Insufficient granularity of cross-tenant visibility. Existing technologies only offer binary control of "allow / disallow login," which cannot control the scope of data access after login. Solution: This solution uses a dual-separator Path with independent configuration dimensions for visibility range modes. The resulting technical effect: Tenants at different levels within the same administrative link can independently configure their visibility range (view only themselves / view all subordinates / view a specified level / custom).

[0094] (3) Technical Issues: Personnel secondment disrupts organizational stability. This solution employs the following technical means: an embedded secondment field (Member.PostInfo.secondment / Organization.Extra.secondment) + role merging rules (individual ∪ department, individual priority) + automatic expiration upon expiration. The resulting technical effects: Department members automatically inherit the secondment status during the secondment period; the secondment automatically takes effect when a new member joins; and it automatically expires upon expiration, maintaining organizational stability.

[0095] (4) Technical Issues: Coupling between the organizational tree and the administrative link leads to business semantic conflicts. Technical Solution: Physical separation of tenant_hierarchy and organizations. Technical Benefits: Internal departmental adjustments within a tenant do not affect the administrative link; physical separation avoids cross-tenant departmental mounting requirements, protecting the independence of the organizational tree.

[0096] (5) Technical problem: Superiors want to see subordinates, but RBAC cannot perceive tenant administrative relationships. Technical solution: Combining visibility scope pattern with Path prefix matching algorithm. Technical effect achieved: Achieving data visibility under administrative semantics, rather than general role permissions.

[0097] The technical solution of this invention automatically recalculates the visibility of all associated tenants with a single path change. When T_D moves from / T_A / T_B / T_C / T_D / to / T_A / T_B / T_D / , T_C requires no operation; its prefix matching for / T_A / T_B / T_C / automatically no longer includes T_D. T_B only needs to adjust visible_targets to gain visibility to T_D. All intermediate steps are completed automatically, without cascading updates. This effect relies on path prefix matching and visibility calculation being independent of hierarchical position; neither feature alone can achieve this.

[0098] The core innovation of the technical solution of this invention does not lie in "using Path" or "adding fields", but in designing "hierarchical position" and "data visibility range" as two orthogonal and independently configurable dimensions for the first time in a multi-tenant administrative hierarchy scenario. This is an architectural paradigm shift from "hierarchy determines permissions" to "hierarchy-independent permissions".

[0099] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0100] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0101] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0102] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0103] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0104] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0105] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0106] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0107] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0108] This invention employs a control method, system, device, processor, and computer-readable storage medium for separating administrative hierarchy and data visibility in a multi-tenant system. By storing the complete cross-tenant administrative link in the form of a string path and configuring visibility parameters independently for each tenant, it enables differentiated data visibility range control for tenants at different levels or within the same administrative link, eliminating the limitation of the mandatory binding of administrative hierarchy and data visibility in traditional solutions. This method physically separates the administrative hierarchy relationship between tenants from the internal organizational tree of the tenants and introduces a two-layer secondment authorization mechanism to ensure that organizational restructuring does not affect the administrative hierarchy positioning and that cross-tenant personnel and departmental collaboration does not disrupt the original organizational affiliation. Thus, while improving the flexibility and granularity of cross-tenant data visibility configuration, it ensures the compliance of administrative logic and the clarity of data affiliation, reduces administrative link storage redundancy and organizational transfer complexity, improves query and change efficiency, and enhances the overall reliability of the multi-tenant system and its ability to adapt to complex administrative collaboration scenarios.

[0109] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A control method for separating administrative hierarchy and data visibility in a multi-tenant system, characterized in that, The method includes the following steps: (1) Establish an administrative link record, wherein the administrative link record stores the hierarchical relationship of all tenants on a complete administrative link in the form of a string Path. The string Path uses a first separator to represent the superior-subordinate relationship and a second separator to represent the peer relationship, and the first separator is added to both the beginning and the end of the string Path. (2) Configure visibility parameters independently for each tenant in the tenant configuration. The visibility parameters include visibility range mode, or include visibility range mode and visible target list. (3) When the first tenant initiates a data query request, the set of visible tenants that the first tenant is authorized to access is calculated by performing prefix matching on the string Path in the administrative link record based on the visibility parameter of the first tenant; (4) Within the set of visible tenants, query and return data resources that meet the preset visibility level; The visibility parameters are independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link are configured with different visibility parameters.

2. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 1, characterized in that, The first separator is a forward slash, and the second separator is a vertical line. The forward slash is used to separate tenant identifiers with a hierarchical relationship, and the vertical line is used to connect tenant identifiers with a peer relationship.

3. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 2, characterized in that, The method also includes a step of querying the parent tenant based on the string Path, specifically including the following processing steps: After removing the first and last forward slashes from the string Path, split it by forward slashes to obtain multiple tenant identifier elements. Take all elements except the last one, re-concatenate them by forward slashes, and add forward slashes at the beginning and end to obtain the path of the parent tenant.

4. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 2, characterized in that, The method also includes a step of querying sub-tenants based on the string Path, specifically including the following processing steps: Using the current tenant's string Path as a prefix, perform prefix matching in the administrative link record, and identify tenants whose string Path is prefixed with the current tenant's string Path and whose string Path is not equal to the current tenant's string Path as subordinate tenants.

5. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 1, characterized in that, The visibility range modes include a first mode, a second mode, a third mode, and a fourth mode. The first mode only shows the data of the current tenant; the second mode shows the data of the current tenant and all administrative subordinate tenants; the third mode shows the data of the current tenant and specified subordinate tenants; and the fourth mode shows the data of all tenants.

6. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 5, characterized in that, Step (3) specifically includes the following steps: (3.1) When the visibility range mode is the first mode, the set of visible tenants is determined to be the current tenant itself; (3.2) When the visibility range mode is the second mode, obtain all paths in the administrative link record, and take the tenants whose paths are prefixed with the current tenant's string Path and are not equal to the current tenant's string Path, together with the current tenant itself, as the visible tenant set; (3.3) When the visibility range mode is the third mode, the path with the current tenant's string Path as the prefix is ​​selected from the visible target list, and the tenants corresponding to the selected paths and the current tenant itself are used together as the visible tenant set; (3.4) When the visibility range mode is the fourth mode, all tenants are taken as the visible tenant set.

7. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 5, characterized in that, In the third mode, the path of the visible sub-tenant is specified through the visible target list, and an exact match query is performed based on the path in the visible target list.

8. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 1, characterized in that, The query in step (4) satisfies the preset visibility level of data resources, including first-level filtering and second-level filtering. The first-level filtering calculates the set of visible tenants based on the visibility parameters. The second-level filtering filters the set of visible tenants based on the visibility level of the data resources. The data resources include a tenant identifier field that identifies the tenant to which the data belongs and a visibility level field that identifies the visible range of the data.

9. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 1, characterized in that, The administrative link record is physically separated from the organizational tree record within each tenant. The organizational tree record is limited to a single tenant and isolated by the tenant identifier. The administrative link record manages the administrative hierarchy relationship across tenants through the string Path. The administrative link record and the organizational tree record are associated through the tenant identifier and each maintains an independent tree structure.

10. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 1, characterized in that, The method also includes a step of cross-tenant borrowing authorization, specifically including the following processing steps: Personnel secondment involves adding personnel secondment information to the extended fields of the organization member record. The personnel secondment information includes the target tenant identifier, target organization identifier, role, and validity period. Departmental secondment: Add departmental secondment information to the extended fields of the organization record. The departmental secondment information includes the target tenant identifier, default role, and validity period. The departmental secondment information is automatically inherited to all members under the organization, including newly joined members. The personnel secondment and the departmental secondment do not change the original organizational relationship, and the role of the seconded person is configured independently within the target tenant.

11. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 10, characterized in that, If the same member has both a personal role configured for personnel secondment and a departmental default role configured for departmental secondment, then the member's final role within the target tenant is the union of the personal role and the departmental default role, and the personal role has a higher priority than the departmental default role.

12. The control method for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 1, characterized in that, Step (3) further includes the following steps: Subordinate tenants cannot prevent superior tenants from viewing their data. Whether a superior tenant can view a subordinate tenant's data depends solely on the superior tenant's own visibility mode. Subordinate tenants hide private data by setting the visibility level of data resources to the private level.

13. A control system for separating administrative hierarchy from data visibility in a multi-tenant system, characterized in that, The system includes: The administrative link management module is used to store and manage administrative link records in the form of a string Path. The string Path uses a first separator to represent the hierarchical relationship and a second separator to represent the peer relationship, and the first separator is added at both the beginning and the end. The tenant visibility configuration module, connected to the administrative link management module, is used to independently configure visibility parameters for each tenant. The visibility parameters include a visibility range mode, or a visibility range mode and a list of visible targets. The visibility calculation module, connected to the tenant visibility configuration module, is used to receive the data query request of the first tenant, calculate and output the set of visible tenants that the first tenant has the right to access based on the visibility parameters of the first tenant and by performing prefix matching on the string Path in the administrative link record. The data query module, connected to the visibility calculation module, is used to query data resources that meet the preset visibility level within the set of visible tenants and output the query results. The visibility parameters are independent of the hierarchical relationship in the administrative link record, and different tenants in the same administrative link are configured with different visibility parameters.

14. The control system for separating administrative hierarchy and data visibility in a multi-tenant system according to claim 13, characterized in that, The system also includes an organization tree management module and a secondment authorization module. The organization tree management module is used to manage organization tree records that are limited to a single tenant and isolated by tenant identifiers. The organization tree records are physically separated from the administrative link records. The secondment authorization module is used to add personnel secondment information to the extended fields of the organization member records and add department secondment information to the extended fields of the organization records. The personnel secondment information includes the target tenant identifier, target organization identifier, role, and validity period. The department secondment information includes the target tenant identifier, default role, and validity period.

15. A control device for separating administrative hierarchy and data visibility in a multi-tenant system, characterized in that, The device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the control method for separating administrative hierarchy and data visibility in a multi-tenant system as described in any one of claims 1 to 12.

16. A control processor for separating administrative hierarchy and data visibility in a multi-tenant system, characterized in that, The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the steps of the control method for separating administrative hierarchy and data visibility in a multi-tenant system as described in any one of claims 1 to 12.

17. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the control method for separating administrative hierarchy and data visibility in a multi-tenant system as described in any one of claims 1 to 12.

Images