CN111242567B

CN111242567B - Authority control method of workflow node

Info

Publication number: CN111242567B
Application number: CN201911425990.2A
Authority: CN
Inventors: 周群辉; 刘远荣
Original assignee: Shenzhen Idreamsky Technology Co ltd
Current assignee: Shenzhen Idreamsky Technology Co ltd
Priority date: 2019-12-31
Filing date: 2019-12-31
Publication date: 2024-03-01
Anticipated expiration: 2039-12-31
Also published as: CN111242567A

Abstract

The application provides a method for controlling authority of a workflow node, which comprises the following steps: receiving task items; the task item corresponds to a plurality of nodes; receiving login information sent by a terminal, and determining a first node corresponding to the login information from the plurality of nodes; acquiring a data field of the first node and a permission rule table of the first node or a permission rule group table of the first node; determining a display field corresponding to the first node from the data field according to the authority rule table of the first node or the authority rule group table of the first node; and sending the display field corresponding to the first node to the terminal. The method can flexibly configure the data authority of each node in the workflow according to the user demands, improves the flow processing efficiency and improves the safety of the flow data.

Description

Authority control method of workflow node

Technical Field

The present application relates to the field of information processing technologies, and in particular, to a method for controlling authority of a workflow node.

Background

Office automation systems are a system used to manage daily office transactions, such as daily various process approval tasks. The function of the system is to improve the overall management operation level by means of software.

The node data authority in the process approval work is specified by a system, and two setting modes are generally available, wherein one setting mode is that a processor can only see the current processing node and can not see the data of other nodes; another arrangement is that all node data in the flow is visible to the handler.

When a processor only can see the setting mode of the current processing node, the current processor cannot see the data of other nodes, so that the normal examination and approval flow cannot be completed; when all node data in the flow are visible to a processor, the information propagation range is enlarged, and information leakage is easy to cause.

Disclosure of Invention

In order to overcome the defects of the prior art, the invention aims to provide the authority control method of the workflow node, which can flexibly configure the data authority of each node in the workflow according to the user demands, thereby improving the flow processing efficiency and the security of the flow data.

In a first aspect, the present application provides a method for controlling authority of a workflow node, including:

receiving task items; the task item corresponds to a plurality of nodes;

receiving login information sent by a terminal, and determining a first node corresponding to the login information from the plurality of nodes;

acquiring a data field of the first node and a permission rule table of the first node or a permission rule group table of the first node;

determining a display field corresponding to the first node from the data field according to the authority rule table of the first node or the authority rule group table of the first node;

transmitting a display field corresponding to the first node to the terminal

In one possible implementation, before the receiving the task event, the method further includes:

receiving a first operation of a user;

and responding to a first operation of a user, and setting authority rules of a plurality of nodes in the task items.

In one possible implementation, the authority rule table of the first node includes at least one authority rule;

the determining, according to the permission rule table of the first node, a display field corresponding to the first node from the data fields specifically includes:

and sequentially judging whether the at least one authority rule is established or not, and determining the display field according to the authority rule established in the first one of the at least one authority rule.

In one possible implementation, the authority group table of the first node includes at least one authority rule group, and the authority rule group includes at least one authority rule;

the determining, according to the permission rule set table of the first node, a display field corresponding to the first node from the data fields specifically includes:

sequentially judging whether the at least one authority rule set is established or not, and determining the display field according to the authority rule set established by the first one of the at least one authority rule set; and when all the authority rules in the authority rule group are established, establishing the authority rule group.

In one possible implementation manner, the determining the display field according to the authority rule established by the first one of the at least one authority rule specifically includes:

determining a control field from the data field according to the authority rule established according to the first one of the at least one authority rule; wherein the control field is not visible to the first node;

and determining the display field according to the data field and the control field.

In one possible implementation manner, the determining the display field according to the authority rule set established by the first one of the at least one authority rule set specifically includes:

determining a control field from the data field according to the authority rule set established by the first one of the at least one authority rule set; wherein the control field is not visible to the first node;

In a second aspect, the present application provides an authority control device of a workflow node, including:

a receiving unit for receiving task items; the task item corresponds to a plurality of nodes;

the first determining unit is used for receiving login information sent by the terminal and determining a first node corresponding to the login information from the plurality of nodes;

a first obtaining unit, configured to obtain a data field of the first node and a permission rule table of the first node or a permission rule group table of the first node;

and the second determining unit is used for determining a display field corresponding to the first node from the data fields according to the authority rule table of the first node or the authority rule group table of the first node.

And the sending unit is used for sending the display field corresponding to the first node to the terminal.

In one possible implementation, the apparatus further includes:

a receiving unit configured to receive a first operation of a user;

and the processing unit is used for responding to the first operation of the user and setting authority rules of a plurality of nodes in the task items.

In a third aspect, the present application provides a rights control apparatus, including: one or more processors, one or more memories, a transceiver; the one or more memories are coupled to the one or more processors, the one or more memories are configured to store computer program code, the computer program code comprising computer instructions that, when executed by the one or more processors, perform a method of controlling the authority of a workflow node as in any of the possible implementations of the aspect.

In a fourth aspect, the present application provides a computer storage medium comprising computer instructions which, when executed, perform a method according to any one of the possible implementations of the any one of the aspects.

The method can flexibly configure the data authority of each node in the workflow according to the user demands, improves the flow processing efficiency and improves the safety of the flow data.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below.

Wherein:

fig. 1 is a network architecture schematic diagram of a method for controlling authority of a workflow node according to an embodiment of the present application;

FIG. 2 is a flowchart of a method for controlling authority of a workflow node according to an embodiment of the present application;

FIG. 3 is a sales contract signing flow provided by an embodiment of the present application;

FIG. 4 is a rights setting operation interface provided in an embodiment of the present application;

FIGS. 5-6 are diagrams illustrating an interface for rights control settings according to embodiments of the present application;

FIG. 7 is a diagram of a device for controlling authority of a workflow node according to an embodiment of the present application;

Detailed Description

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

It should be further understood that the term "and/or" as used in this specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations.

The invention provides a workflow node data authority control method, which comprises the steps of setting the data authority of each node in a workflow; receiving task items; acquiring a designated node according to login information; the login information comprises a login user name and a login password; acquiring the designated node data field and the designated node authority rule table or the node authority rule group list; and acquiring a display field in the designated node data field according to the designated node data field and the designated node permission rule table or the node permission rule group list.

The method can flexibly configure the data authority of each node in the workflow according to the user demands, improves the flow processing efficiency and ensures the information security.

First, a network architecture schematic diagram of a method for controlling authority of a workflow node provided in an embodiment of the present application is introduced. As shown in fig. 1, the network architecture 100 includes a terminal 101 and a server 102. Wherein:

the terminal 101 may be implemented as a smart phone, a computer, a personal digital assistant (Personal Digital Assistant, PDA) or the like.

Here, the terminal is installed with a client. Through this client, the user may view and/or process node tasks in the workflow.

The workflow is a workflow, and the main problem solved by the workflow is that in order to complete a transaction or task, a group of related subtasks, namely node tasks, need to be completed according to a certain procedure, each node is distributed with at least one processor, and the processor can view and/or process the node tasks through a client in a terminal.

Specifically, the client may include: locally running applications, functions running on a Web browser (also known as Web App), applets embedded in email, applets embedded in client software for instant messaging (e.g., weChat), and functions embedded in other applications (e.g., weChat) (e.g., weChat public numbers), etc. For clients, the server 102 needs to run a corresponding server-side program to provide corresponding services, such as database services, data computation, decision execution, and so forth.

The server provides computing or application services to other devices in the network.

The present application provides a flow chart of a method for controlling authority of a workflow node, as shown in fig. 2, the method may include:

s201, setting data authority of each node in the workflow.

In each node of the workflow, there is a fixed handler, each node can accept user operations to set the authority of the node, that is, set the authority of the data fields of the node, determine which data fields of each node are visible, which data fields are invisible, which data fields are editable, and set certain data fields as necessary entries, such as not filling in non-submittable items.

Wherein the data field is the input information attribute in the form. The form is an information table which needs to be processed by a node processor.

By way of example, the form may be as shown in Table 1 below:

TABLE 1

Product name

Review product

Review reason

The data fields in table 1 include "product name", "review product", "review reason".

Setting the data authority of each node in the workflow comprises the following steps:

1. and designing a workflow template.

The workflow templates comprise an approval process, a reimbursement process, a leave application process, an article application process, a sales contract signing process and the like. Each workflow is composed of at least one node, each node including at least one handler.

For example, in a sales contract signing process, five nodes are included in total, each with a fixed handler.

Referring to fig. 3, for the sales contract signing process, form data fields of the order contract include customer name, product model number, quantity, unit price, technical requirements, delivery date and delivery location.

The processing of the node 1 is made to sales personnel, after the server detects that the sales personnel submits an order contract, the server control flow goes to the node 2, the processing of the node 2 is made to sales executive, the sales executive checks whether the order contract has a problem, after the server detects that the sales executive checks to pass, the server control flow goes to the node 3, the processor of the node 3 is financial personnel, the financial personnel checks financial related information, after the server detects that the financial personnel checks to pass, the server control flow goes to the node 4, the processor of the node 4 is a technician, the technician confirms the technical related information, after the server detects that the technician checks to pass, the server control flow goes to the node 5, the processor of the node 5 is a total manager, the total manager carries out comprehensive checking on the order contract, and after the server detects that the total manager checks to pass, the flow ends.

2. And setting node data authority.

And setting the authority for the node data, namely setting the authority for the node data field. Rights may be visible, invisible, editable, non-editable, mandatory items, etc.

Here, the authority may be set for each node in the workflow, and the authority may be set for a certain data field or a plurality of data fields in the node.

For example, there is a workflow a including node X, node Y, and node Z, the form data field of the workflow a includes fields a/B/C/D/E/F// H/I, the authority is set for node Z, and fig. 4 is an operation interface for authority setting of node Z.

Referring to fig. 4, the data field 401 is a form data field of the workflow a, and includes a field a/B/C/D/E/F/H/I, and a selection box control 404 is located before the field a/B/C/D/E/F/H/I, where the selection box control 404 may receive a click operation, and an odd number of clicks may be performed to select the selection box, when the selection box 404 is selected, the control is indicated for the field, and this field is referred to as a control field. Wherein the control fields may be set to visible, invisible, editable, non-editable, and mandatory terms, and so forth. As shown in fig. 4, i.e., controlling the field B/E/I.

Wherein, the rights control 402 may include at least one rights control rule, each rule having four variables: reference objects, reference attributes, control behavior, and observation targets.

Wherein the reference object is typically a node in the workflow.

The reference attribute is an attribute of a reference object and can be classified into a user class and a state class. The user class is the current login user, namely the current node processor; the state class may refer to before, during, or after processing.

Control actions include visible and invisible.

The observation targets are determined with reference to the attributes.

As in fig. 4, the nodes are set with permissions by permission control 402, wherein:

the first selection control 405 may receive a click operation to select a node, e.g., may select node X or node Y or node Z.

The second selection control 406 may receive a click operation selection handler.

The third selection control 407 may receive a click operation selection control action, may select visible or invisible or editable or uneditable or mandatory items, etc.

The fourth selection control 408 may receive a click operation to select a node, e.g., may select node X or node Y or node Z

The fifth selection control 409 may receive a click operation selection state, e.g., may select pre-process, in-process, post-process.

The sixth selection control 410 may receive a click operation selection control action, may select visible or invisible or editable or uneditable or mandatory items, and the like.

The add control 403 may receive a click operation add permission rule.

In one possible implementation, a permission rule may be set for a node.

Fig. 4 lists two entitlement rules for node Z. Wherein,

the first bar, field B/E/I is invisible to the processor of node Z, if the current login user is the processor of node Z, i.e. the processor of node Z does not see field B/E/I, other fields A/C/D/F/G/H can be seen. The entitlement rules for the handler are referred to herein as first type rules.

Second, when the state of node Y is in process, field B/E/I is not visible to the processor of node Z.

The entitlement rules for the state class are referred to herein as second type rules.

It should be noted that in this implementation, there may be multiple rules of the first type and multiple rules of the second type.

Illustratively, if the first entitlement rule is true, not continuing to execute the second entitlement rule; if the first authority rule is not established, executing a second authority rule; if the second authority rule is not satisfied, the node Z does not set the data authority.

For the embodiment with a plurality of authority rules, if the first authority rule is established, the second authority rule is not continuously executed; if the first authority rule is not established, executing a second authority rule; if the second authority rule is not established, and so on, traversing the rule in turn, if one authority rule is established, executing corresponding control operation according to the control behavior and jumping out of the traversal, and if the established authority rule is not found, indicating that the designated node is not provided with data authority.

The new control 403 may receive an add permission rule according to actual requirements from a user operation.

The above embodiment is only one implementation of the present application, and should not be construed as limiting.

For a better understanding of the above embodiments, the present application will be explained in connection with specific embodiments.

In the sales contract signing process, the node 3 is a financial staff, and the financial staff only needs to check financial information and does not need to display other client information to the financial staff, so that the authority of the node 3 can be set as the client name, the technical requirement, the delivery date and the delivery place are invisible; the product model, the number and the unit price are visible.

Specifically, see the rights control setup interface of fig. 5. The rights control setting interface is to set rights for the node 3.

Specifically, the first authority rule is that if the current logged-in user is the handler of node 3, then the data fields of the client name, technical requirement, date of delivery, and location of delivery are not visible to the handler of node 3.

The second entitlement rule is that if the status of node 2 is that the processor of node 2 is in process, then the data fields of customer name, technical requirements, date of delivery, and location of delivery are not visible to the processor of node 3.

In another alternative implementation, two or more control actions may be set for a node.

The application provides another authority setting interface of the node Z.

The present embodiment is different from the above embodiment in that the present embodiment adds a concept of a group, and the authority rules include N sets of authority rules, each set of authority rules further includes m authority rules, and only one or no sets of authority rules of the N sets of authority rules are established.

The embodiment can realize the setting of a plurality of authorities for a certain node.

Illustratively, as shown in FIG. 6, the entitlement control includes two sets of entitlement rules.

Wherein the first group:

the first bar, field B/E/I is invisible to the processor of node Z, if the current login user is the processor of node Z, i.e. the processor of node Z does not see field B/E/I, other fields A/C/D/F/G/H can be seen.

Second group:

Second, when the state of node X is in process, field B/E/I is not visible to the processor of node Z.

It should be noted that only each authority rule in each group is satisfied, the authority rule in the group is satisfied, and if one authority rule is not satisfied, the authority rule in the group is not satisfied.

In this implementation, if the first set of entitlement rules is true, then the second set of entitlement rules is not continued to be executed; if the first set of authority rules is not established, executing the second set of authority rules; if the second set of permission rules is not satisfied, the node X does not set the data permission.

The new permission set control can receive the permission rule set added by user operation according to actual requirements.

According to the two authority rule setting methods, the data authorities of all nodes in the workflow can be flexibly configured according to requirements, the flow processing efficiency is improved, and the information safety is ensured.

S202, receiving task items.

S203, node tasks and node authority rules are distributed.

The task item triggers the server to start the flow operation, and the server determines the specific workflow according to the flow starting node and distributes the workflow node task and the node data authority.

And each node task in the workflow is provided with a fixed processor, and the server sends each node task to the terminal to prompt the user that a new node task needs to be processed.

S204, the terminal receives login operation of the user and acquires login information of the user.

S205, the terminal sends login information of the user to the server.

The client of the terminal receives the login operation of the user and login information of the user, wherein the login information can comprise a login user name and a login password of the user.

And the terminal sends the login information of the user to the server.

S206, acquiring the designated node according to the login information of the user.

The server receives the login information of the user sent by the terminal, and confirms which specific workflow node task processor is based on the login information of the user, so as to determine the designated node.

S207, acquiring a designated node data field and a designated node authority rule of the designated node.

First, the server obtains all the data fields of the specified node, while the server obtains the entitlement rules of the specified node, i.e. which data fields are visible and which data fields are invisible.

In an alternative embodiment, a rule list of the designated node is obtained according to the authority rule of the designated node, and the rule list includes the authority rule.

It should be noted that, in this implementation manner, if the first authority rule is established, the second authority rule is not continuously executed; if the first authority rule is not established, executing a second authority rule; if the second authority rule is not established, and so on, traversing the rule in turn, if one authority rule is established, executing corresponding control operation according to the control behavior and jumping out of the traversal, and if the established authority rule is not found, indicating that the designated node is not provided with data authority.

Illustratively, in the sales contract making flow, it is assumed that the server acquires the data fields and rule list of the node 4.

As shown in table 2, a list of data fields for node 4:

TABLE 2

Customer name
	Technical requirements
Delivery date
	Delivery site
Product model
	Quantity of
Monovalent unit price

As shown in table 3, table 3 is a rule list for node 4:

TABLE 3 Table 3

Table 3 shows that the rule list of node 4 includes two entitlement rules.

Wherein, the first authority rule is that if the current login user is the processor of the node 4, the data fields of the client name, the technical requirement, the delivery date, the delivery place, the product model number, the quantity and the unit price are invisible to the processor of the node 4; the second entitlement rule is that if the current logged-in user is the handler of node 4, the data fields of customer name, technical requirements, date of delivery, place of delivery, product model number, quantity and unit price are not visible to the handler of node 4 after the processing of node 3 is completed.

Specifically, the designated node acquired by the server is node 4, and the server first determines whether a first authority rule is established, where if the current login user is the handler of node 4, the data fields such as the client name, the technical requirement, the delivery date, the delivery location, the product model number, the number and the unit price are invisible to the handler of node 2. And if the first authority rule is established, the second authority rule is not seen.

The control field of node 4 is obtained according to the first entitlement rule, as shown in table 4:

TABLE 4 Table 4

Customer name
	Delivery date
Delivery site
	Product model
Quantity of
	Monovalent unit price

The control fields include customer name, technical requirements, date of delivery, location of delivery, product model number, quantity, and unit price.

The server removes the control fields from all the data fields of node 4, resulting in a display field, as shown in table 5:

TABLE 5

Technical requirements

As shown in table 5, the display field includes a technical requirements field.

In another alternative embodiment, a rule set list of the designated nodes is obtained from the authority rules of the nodes, the rule set list including the rule authorities.

In this implementation, if the first set of entitlement rules is true, then the second set of entitlement rules is not continued to be executed; if the first set of authority rules is not established, executing the second set of authority rules; similarly, if none of the rule sets is not established, the designated node does not set the data authority.

Illustratively, in the sales contract making flow, it is assumed that the server acquires the data field and rule group list of the node 4.

The data field list of the node 4 is the same as that of table 2, and will not be described in detail here.

As shown in table 6, table 6 is a rule set list for node 4:

TABLE 6

Table 6 shows that the rule set list of node 4 includes two sets of authority rule sets.

Wherein group 1 includes two entitlement rules, as shown in table 7:

TABLE 7

Group 2 includes a rule of rights as shown in table 8:

TABLE 8

Control field	id	The node	Reference node	Reference attributes	Controlling behavior
						Product model	1	Node 4	Node 1	After treatment	Visible in the light

The first authority rule is that if the current login user is the processor of the node 4, the product model field is visible to the processor of the node 4 after the processing of the node 1 is completed.

Since the designated node acquired by the server is node 4, the current login user is the processor of node 4, and it is assumed that the processing state of node 3 acquired by node 4 is in process.

For the first entitlement rule for group 1, the specific rule is that if the current logged-in user is the processor of node 4, then the data fields of customer name, technical requirements, date of delivery, location of delivery, product model number, quantity, and unit price are not visible to the processor of node 4. The first entitlement rule holds.

For the second entitlement rule for group 1, the specific rule is that if the node status of node 3 is post-processing, then the data fields of customer name, technical requirements, date of delivery, location of delivery, product model number, quantity, and unit price are not visible to the processor of node 4. The second entitlement rule holds.

The first authority rule and the second authority rule of the group 1 are both established, and then the rule group of the group 1 is established, and the server executes the authority setting of the group 1 and no longer checks the authority setting of the group 2.

The rights settings for group 1 are such that the data fields controlling customer name, technical requirements, date of delivery, location of delivery, product model number, quantity and unit price are not visible to the processor of node 4, resulting in the control fields for node 4.

The control field of the node 4 is identical to the control field table of the above table 4, and will not be described here again.

All the data fields of the node 4 are removed from the control fields to obtain display fields, wherein the display fields of the display field table are identical to those of the display fields of the table 5, and the details are not repeated here.

And S208, the server sends the display data field to the terminal.

The server sends the display field to the terminal, which displays the display field to the processor of node 4.

In the sales contract signing process, the server obtains the display field of the node 4, and the display field table is shown in table 5, so that the server only sends the technical requirement field to the terminal, and the form displayed by the terminal to the node 4 processor only comprises the technical requirement field.

The form displayed by the terminal can receive the approval operation of the processor of the node 4, and if the server detects that the processor of the node 4 submits the approval operation, the server control flow goes to the node 5, and so on until the workflow is finished.

Fig. 7 is a schematic diagram of a rights control apparatus of a workflow node according to an embodiment of the present application, including:

a receiving unit 701 for receiving task items; the task item corresponds to a plurality of nodes;

a first determining unit 702, configured to receive login information sent by a terminal, and determine a first node corresponding to the login information from the plurality of nodes;

a first obtaining unit 703, configured to obtain a data field of the first node and a permission rule table of the first node or a permission rule group table of the first node;

and a second determining unit 704, configured to determine, according to the authority rule table of the first node or the authority rule group table of the first node, a display field corresponding to the first node from the data fields.

A transmitting unit 705, configured to transmit a display field corresponding to the first node to the terminal

In one possible implementation, the apparatus further includes:

a receiving unit configured to receive a first operation of a user;

In one possible implementation, the apparatus further includes:

the authority rule table of the first node comprises at least one authority rule;

the second determining unit specifically includes:

and the third determining unit is used for sequentially judging whether the at least one authority rule is met or not, and determining the display field according to the authority rule met by the first one of the at least one authority rule.

In one possible implementation, the apparatus further includes:

the authority group table of the first node comprises at least one authority rule group, and the authority rule group comprises at least one authority rule;

the second determining unit specifically includes:

a fourth determining unit, configured to sequentially determine whether the at least one authority rule set is satisfied, and determine the display field according to a first authority rule set that is satisfied in the at least one authority rule set; and when all the authority rules in the authority rule group are established, establishing the authority rule group.

In one possible implementation manner, the third determining unit specifically includes:

In one possible implementation manner, the fourth determining unit specifically includes:

Those skilled in the art will appreciate that implementing all or part of the above-described methods in accordance with the embodiments may be accomplished by way of a computer program stored on a computer readable storage medium, which when executed may comprise the steps of the embodiments of the methods described above. The storage medium may be a usb disk, a magnetic disk, an optical disk, a Read-only memory (ROM), a random access memory (Random Access Memory, RAM), or the like.

The present application may be a system, method, and/or computer program product. The computer program product may include a computer readable storage medium having computer readable program instructions embodied thereon for causing a processor to implement aspects of the present application.

The computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium would include the following: portable computer disks, hard disks, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static Random Access Memory (SRAM), portable compact disk read-only memory (CD-ROM), digital Versatile Disks (DVD), memory sticks, floppy disks, mechanical coding devices, punch cards or in-groove structures such as punch cards or grooves having instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media, as used herein, are not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., optical pulses through fiber optic cables), or electrical signals transmitted through wires.

The computer readable program instructions described herein may be downloaded from a computer readable storage medium to the respective computing/processing device or to an external computer or external storage device via a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, gateway computers and/or edge servers. The network interface card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium in the respective computing/processing device.

Computer program instructions for performing the operations of the present application may be assembly instructions, instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, c++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, aspects of the present application are implemented by personalizing electronic circuitry, such as programmable logic circuitry, field Programmable Gate Arrays (FPGAs), or Programmable Logic Arrays (PLAs), with state information for computer readable program instructions, which may execute the computer readable program instructions.

Various aspects of the present application are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer-readable program instructions.

These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable medium having the instructions stored therein includes an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The description of the present embodiments has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for the only preferred embodiments disclosed herein.

Claims

1. A method for controlling authority of a workflow node, comprising:

receiving task items; the task item corresponds to a plurality of nodes;

transmitting a display field corresponding to the first node to the terminal;

wherein the permission rule table or the permission rule group table comprises at least one permission control rule, and each control rule comprises the following variables: reference objects, reference attributes, control behaviors, and observation targets;

when the reference attribute is a current node processing person, the reference object is the first node, the control behavior comprises visible or invisible, and the observation target is the first node;

when the reference attribute is the processing state of other nodes, the reference object is a second node in the task item, the processing state of other nodes comprises before processing or during processing or after processing, the control behavior comprises visible or invisible, and the observation target is the first node.

2. The method of claim 1, wherein prior to the receiving a task event, the method further comprises:

receiving a first operation of a user;

3. The method of claim 1, wherein the authority rule table of the first node includes at least one authority rule;

4. The method of claim 1, wherein the first node's permission set table includes at least one permission rule set including at least one permission rule;

5. A method according to claim 3, wherein said determining said display field according to a first established one of said at least one entitlement rule, comprises:

determining a control field from the data field according to a first established authority rule in the at least one authority rule; wherein the control field is not visible to the first node;

6. The method according to claim 4, wherein determining the display field according to the set of authority rules established by the first one of the at least one set of authority rules specifically comprises:

7. A rights control apparatus for a workflow node, the apparatus comprising:

the second determining unit is used for determining a display field corresponding to the first node from the data fields according to the authority rule table of the first node or the authority rule group table of the first node;

a sending unit, configured to send a display field corresponding to the first node to the terminal;

8. The apparatus of claim 7, wherein the apparatus further comprises:

a receiving unit configured to receive a first operation of a user;

9. A rights control apparatus, characterized by comprising: one or more processors, one or more memories, a transceiver; the one or more memories coupled to the one or more processors, the one or more memories for storing computer program code comprising computer instructions that, when executed by the one or more processors, perform the method of any of claims 1-6.

10. A computer storage medium comprising computer instructions which, when executed, perform the method of any of claims 1-6.