WO2019006998A1 - Node.js权限控制方法、存储介质、电子设备及系统 - Google Patents

Node.js权限控制方法、存储介质、电子设备及系统 Download PDF

Info

Publication number
WO2019006998A1
WO2019006998A1 PCT/CN2017/117367 CN2017117367W WO2019006998A1 WO 2019006998 A1 WO2019006998 A1 WO 2019006998A1 CN 2017117367 W CN2017117367 W CN 2017117367W WO 2019006998 A1 WO2019006998 A1 WO 2019006998A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
authority
function
operation item
priority
Prior art date
Application number
PCT/CN2017/117367
Other languages
English (en)
French (fr)
Inventor
胡瑞
陈少杰
张文明
Original Assignee
武汉斗鱼网络科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 武汉斗鱼网络科技有限公司 filed Critical 武汉斗鱼网络科技有限公司
Publication of WO2019006998A1 publication Critical patent/WO2019006998A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2455—Query execution
    • G06F16/24552—Database cache management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/48—Program initiating; Program switching, e.g. by interrupt
    • G06F9/4806—Task transfer initiation or dispatching
    • G06F9/4812—Task transfer initiation or dispatching by interrupt, e.g. masked

Definitions

  • the present invention relates to the field of computers, and in particular, to a Node.js authority control method, a storage medium, an electronic device, and a system.
  • Node.js is a Javascript (literally translated scripting language) runtime environment.
  • a user operates in a server built using node.js, there are many permissions related issues. For example, if the user needs to perform an operation, the server internally queries the database and uses a large number of logical operations to determine whether the current user is Have this operation permission.
  • the main disadvantages are as follows: 1. Excessive consumption of server resources, when the user's operation request is received, the operation of penetrating the server database is required, and each interface of the server needs to perform a large number of Permission operation, consumption of server resources, even a very small operation of the user, the server resource consumed by the operation verification of the operation request is greater than the server resource consumed by the service processing corresponding to the operation; 2. The process of verifying the authority The service verification code corresponding to the operation verification code and the operation are mutually polluted, forming a strong coupling, causing subsequent business processing code to run incorrectly.
  • the object of the present invention is to provide a Node.js authority control method, a storage medium, an electronic device and a system, which effectively reduce the occupation of server resources during operation authority verification, and at the same time ensure the authority verification and service execution. The independence of the two runs.
  • the technical solution adopted by the present invention includes:
  • S1 prioritizing an execution function in a user operation request, where the execution function includes a rights verification function and a service execution function, wherein a priority of the rights verification function is configured to be greater than a priority of the service execution function;
  • S2 Cache the user right data saved in the server database to the server memory, where the user authority data is the allowed operation item information corresponding to the user and the user;
  • S3 Execute a permission verification function to obtain an operation item to be performed by the current user
  • S4 determining, according to the obtained operation item of the current user, whether the user right data of the current user cached in the memory corresponds to an operation item to be performed by the current user, and if yes, executing a service execution function to perform an operation item of the current user. Corresponding corresponding operation, if no, it ends.
  • an execution function including a plurality of service execution functions in the operation request, wherein the priority of the authority verification function is greater than the priority of any business execution function, and the priority of the business execution function is performed according to the execution order. Decremental configuration of priority.
  • the allowed operation item corresponding to the user changes, the latest allowed operation item data of the user is cached into the user authority data of the memory, and the original user corresponding to the cache in the memory is deleted.
  • the allowed action item data is cached into the user authority data of the memory, and the original user corresponding to the cache in the memory is deleted.
  • the permission verification function further includes user ID information
  • S401 Matching the execution authority verification function to obtain the user ID information and the user information in the user authority data, and obtain all the allowed operation items of the current user saved in the user authority data;
  • S402 Determine whether the allowed operation items of the current user include the operation item to be performed by the current user, and if yes, execute the service execution function to perform the corresponding operation corresponding to the operation item of the current user, and if not, the process ends.
  • the present invention also provides a storage medium having stored thereon a computer program that implements the Node.js authority control method when executed by a processor.
  • the present invention also provides an electronic device comprising a memory and a processor, the memory storing a computer program running on the processor, the processor implementing the Node.js authority control method when the computer program is executed.
  • the invention also provides a Node.js authority control system, comprising:
  • a configuration module configured to prioritize an execution function in a user operation request, and configure a priority of the authority verification function in the operation request to be greater than a priority of the service execution function
  • a cache module configured to cache user rights data saved in the server database to the server memory, where the user rights data is the allowed operation item information corresponding to the user and the user;
  • the execution judgment module is configured to execute the permission verification function, obtain an operation item to be performed by the current user, and determine, according to the obtained operation item of the current user, whether the user authority data of the current user cached in the memory corresponds to the current user.
  • the operation item that is performed if yes, continues to execute the business execution function to perform the corresponding operation corresponding to the operation item currently performed by the user, and if not, ends.
  • the configuration module is further configured to configure the priority of the permission verification function to be greater than the priority of any service execution function, and the service execution function The priority is decremented by priority in the order of execution.
  • the execution determining module is further configured to: when the allowed operation item corresponding to the user changes, cache the latest allowed operation item data of the user into the user authority data of the memory, and delete the memory.
  • the allowed operation item data corresponding to the original user cached in the cache is further configured to: when the allowed operation item corresponding to the user changes, cache the latest allowed operation item data of the user into the user authority data of the memory, and delete the memory.
  • FIG. 1 is a flowchart of a method for controlling a Node.js authority according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
  • an embodiment of the present invention provides a Node.js authority control method, which is used to verify and control a user's operation authority when a user operates a server built based on Node.js, and the Node of the present invention.
  • the js permission control method specifically includes:
  • the execution function Prioritizing the execution function in the operation request of the user, the execution function includes a rights verification function and a service execution function, wherein the priority of the authority verification function is configured to be greater than the priority of the service execution function.
  • router class For servers built on Node.js, there is a router class in express. Express is an application framework based on the Node.js platform. The main purpose of the router class is to manage routes. The router class is a collection of key-value pairs. The health is usually the route name, and the value is the corresponding interface function, so an interface can be defined by the router.get(key, callback) function. In the embodiment of the present invention, the verification of the user operation authority is performed on an interface of the server.
  • the interaction between the server and the server is performed in the form of an execution function, and the authority verification function in the execution function is sent to the server, and the server executes the permission verification function to verify the specific operation item authority to be performed by the user, and execute the function.
  • the business execution function corresponding to the user is a specific item to be operated, the server executes the business execution function, and then performs the specific work of the user to be operated. If the user wants to perform the closing operation of an interface, the authority verification function is responsible for the user. Turn off the verification of the authority of the interface operation, and the business execution function is responsible for the specific interface shutdown operation.
  • the priority of the permission verification function is configured to be greater than the priority of the business execution function, thereby ensuring the priority execution of the permission verification function, that is, first verifying whether the user has the authority to operate the item, and executing the business execution function after the verification is passed. Execute the execution of the content of the specific work item, avoiding executing the business execution function first. When the subsequent execution of the authority verification function, the user is not authorized to operate the function, the execution of the business execution function is terminated, resulting in waste of server resources.
  • the execution function includes a plurality of service execution functions in the operation request, wherein the priority of the authority verification function is greater than the priority of any of the business execution functions, and the priority of the business execution function is prioritized according to the execution order.
  • the degressive configuration of the level that is, an operation item may correspond to multiple operation steps, and each operation step corresponds to a business execution function, so the business execution function performs priority ordering according to the specific operation steps of the operation item, and the first executed service
  • the priority of the execution function is greater than the priority of the business execution function executed later, but the priority of the authorization verification function is greater than the priority of any business execution function, and the priority execution of the authorization verification function is ensured, that is, the verification of the user operation authority is prioritized.
  • the user right data saved in the cache server database is sent to the server memory, and the user right data is the permitted operation item information corresponding to the user and the user.
  • the user has a corresponding relationship with the operation item allowed by the user.
  • the user permission data is cached in the memory.
  • the user When the user is allowed to perform the lookup and verification of the operation item data, it only needs to be read in the memory, so that each time the user authority is verified, it needs to be searched in the database of the server, avoiding more Repeatedly penetrate the database to perform large-scale data search, effectively improving the verification time of user operation authority. That is, using the singleton design pattern, use the sequelize.query() function to perform related operations, and cache the user permission data in the database into the memory through the memory-cache.set() function.
  • the user permission data needs to be read, Just use the memory-cache.get() function to read in memory.
  • the permission verification function includes user ID information, that is, identity information of the current user.
  • user ID information that is, identity information of the current user.
  • the permission verification function is executed, and the user ID information and the current user can be obtained.
  • the action item to be performed is executed.
  • the user ID information of the user is generally through a session (time domain) or a token (token).
  • a session time domain
  • a token token
  • S4 determining, according to the obtained operation item of the current user, whether the user right data of the current user cached in the memory corresponds to an operation item to be performed by the current user, and if yes, executing a service execution function to perform an operation item of the current user. Corresponding corresponding operation, if no, it ends.
  • whether the user right data of the current user cached in the memory corresponds to the specific judgment process of the operation item to be performed by the current user is:
  • S401 Matching the execution authority verification function to obtain the user ID information and the user information in the user authority data, and obtain all the allowed operation items of the current user saved in the user authority data;
  • S402 Determine whether the allowed operation items of the current user include the operation item to be performed by the current user, and if yes, execute the service execution function to perform the corresponding operation corresponding to the operation item of the current user, and if not, the process ends.
  • the operation item corresponding to the authority verification function in the operation request sent by the user to the server is to create a user, and the user ID information is used as a key through the cacheUtils.
  • the .ensureCache('roles', id) function searches the user permission data for the operation item allowed by the user, and then returns a return value.
  • the string.indexOf() function determines whether the return value string contains "create user". ", if included, the current user has permission to create user operations on the interface, so you can use the next() function to execute the business execution function to create the user's operation, if not included.
  • the result is returned by the res.sendStatus(403) function, and the user receives the 403 error code to know that he does not have the operation permission of the item.
  • the allowed operation item corresponding to the user in the database changes, the latest allowed operation item data of the user is cached into the user authority data of the memory, and the allowed operation item data corresponding to the original user cached in the memory is deleted.
  • the deleted operation can be implemented by calling the cacheUtils.invalidCache() function.
  • the principle of the Node.js authority control method of the present invention is to first configure the priority of the authority verification function and the service execution function in the user operation request to ensure the priority execution of the authority verification function, that is, the user operation authority is first performed. Operation, and then execute the work content code of the specific operation item, to avoid knowing that the user has no operation authority after executing the business execution function first, thereby stopping the execution of the business execution function to generate useless code, doing useless work, wasting server resources, and simultaneously, user authority data Cache into the memory, in the search and verification of the user allowed operation item data, only need to read the corresponding data in the memory, to avoid each time the user authority verification needs to be found in the server database, to avoid repeated wear Through the database, large-scale data search, effectively improve the verification time of user operation rights.
  • the present invention further provides a storage medium, where the computer program is stored on the storage medium, and when the computer program is executed by the processor, the Node.js authority control method described in each embodiment is implemented. step.
  • the storage medium includes a U disk, a mobile hard disk, a ROM (Read-Only Memory), a RAM (Random Access Memory), a disk or an optical disk, and the like. The medium of the code.
  • the present invention further provides an electronic device, including a memory and a processor, where the computer program stored on the processor is stored, and the processor implements the computer program.
  • the invention also provides a Node.js authority control system for the above Node.js authority control method, which comprises a configuration module, a cache module and an execution judgment module.
  • the configuration module is configured to prioritize the execution function in the operation request of the user, and configure the priority of the authority verification function in the operation request to be greater than the priority of the service execution function;
  • the cache module is used to cache the user saved in the server database. Privilege data to the server memory, the user privilege data is the allowed operation item information corresponding to the user and the user;
  • the execution judging module is configured to execute the privilege verification function, obtain the operation item to be performed by the current user, and according to the obtained current user
  • the operation item determines whether the user right data of the current user cached in the memory corresponds to an operation item to be performed by the current user, and if so, continues to execute the service execution function to perform a corresponding operation corresponding to the operation item of the current user, and if not, Then it ends.
  • the configuration module is further configured to configure the priority of the permission verification function to be greater than the priority of any business execution function, and the priority of the business execution function is decremented according to the execution order.
  • the execution determining module is further configured to: when the allowed operation item corresponding to the user changes, cache the latest allowed operation item data of the user into the user authority data of the memory, and delete the original user corresponding to the cached in the memory. Allow action item data.
  • the principle of the Node.js privilege control system of the present invention is that the configuration module configures the priority of the privilege verification function and the business execution function in the user operation request, and ensures the priority execution of the privilege verification function, that is, the user operation authority operation is performed first. Then, the work content code of the specific operation item is executed, and the user execution function is not executed first to know that the user has no operation authority, thereby stopping the execution of the business execution function to generate useless code, doing useless work, wasting server resources, and at the same time, the cache module will have user rights.
  • the data is cached in the memory, and the execution judgment module only needs to read the corresponding data in the memory when performing the search and verification of the user allowed operation item data, so that each time the user authority verification needs to be searched in the database of the server, avoiding Repeatedly penetrate the database multiple times to perform large-scale data search, effectively improve the verification time of user operation authority, and reduce the additional consumption of server resources.

Abstract

一种Node.js权限控制方法、存储介质、电子设备及系统，所述方法包括：对用户的操作请求中执行函数的权限验证函数和业务执行函数进行优先级的划分（S1），将权限验证函数的优先级配置成大于业务执行函数的优先级；缓存服务器数据库中保存的用户权限数据至服务器内存（S2）；执行权限验证函数，获取当前用户所要进行的操作项（S3）；根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项，若是，则执行业务执行函数，若否，则结束（S4）。所述方法能够有效减少操作权限验证时服务器资源的占用。

Description

Node.js权限控制方法、存储介质、电子设备及系统 技术领域
本发明涉及计算机领域，具体涉及一种Node.js权限控制方法、存储介质、电子设备及系统。
背景技术
Node.js是一个Javascript(直译式脚本语言)运行环境。当用户在使用node.js搭建的服务器中进行操作时会涉及到众多的权限相关问题，如用户需要进行某一项操作，则服务器内部会通过查询数据库并使用大量的逻辑运算来判断当前用户是否具备该项操作权限。
对于上述的事件处理方式，主要存在的缺点为：1、过多消耗服务器资源，当接收的用户的操作请求时，需进行穿透服务器数据库的操作，且服务器的每个接口均需要进行大量的权限运算，进行服务器资源的消耗，甚至用户一个极小的操作，操作请求的权限验证所消耗的服务器资源便大于该操作所对应的业务处理所消耗的服务器资源；2、在进权限验证的过程中，权限验证代码与操作对应的业务处理代码相互污染，形成强耦合，造成后续的业务处理代码运行错误。
发明内容
针对现有技术中存在的缺陷，本发明的目的在于提供一种Node.js权限控制方法、存储介质、电子设备及系统，有效减少操作权限验证时服务器资源的占用，同时保证权限验证和业务执行两者运行的独立性。
为达到以上目的，本发明采取的技术方案是，包括：
S1：对用户的操作请求中的执行函数进行优先级划分，所述执行函数包括权限验证函数和业务执行函数，其中，将权限验证函数的优先级配置成大于业务执行函数的优先级；
S2：缓存服务器数据库中保存的用户权限数据至服务器内存，所述用户权限数据为用户及用户对应的所允许操作项信息；
S3：执行权限验证函数，获取当前用户所要进行的操作项；
S4：根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项，若是，则执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
在上述技术方案的基础上，对于操作请求中包括多个业务执行函数的执行函数，其中，权限验证函数的优先级大于任一业务执行函数的优先级，业务执行函数的优先级按照执行顺序进行优先级的递减配置。
在上述技术方案的基础上，当用户对应的所允许操作项发生改变时，则将用户的最新所允许操作项数据缓存至内存的用户权限数据中，并删除内存中缓存的原有的用户对应的所允许操作项数据。
在上述技术方案的基础上，
所述权限验证函数中还包括用户ID信息；
执行权限验证函数，得到用户ID信息和当前用户所要进行的操作项。
在上述技术方案的基础上，内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项的具体判断过程为：
S401：将执行权限验证函数得到用户ID信息与用户权限数据中用户信息进行匹配，得到用户权限数据中保存的当前用户的所有允许 操作项；
S402：判断得到的当前用户的所有允许操作项中是否含有当前用户所要进行的操作项，若是，则执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
本发明还提供一种存储介质，该存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现所述Node.js权限控制方法。
本发明还提供一种电子设备，包括存储器和处理器，存储器上储存有在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现所述Node.js权限控制方法。
本发明还提供一种Node.js权限控制系统，包括：
配置模块，其用于对用户的操作请求中的执行函数进行优先级划分，将操作请求中的权限验证函数的优先级配置成大于业务执行函数的优先级；
缓存模块，其用于缓存服务器数据库中保存的用户权限数据至服务器内存，所述用户权限数据为用户及用户对应的所允许操作项信息；
执行判断模块，其用于执行权限验证函数，获取当前用户所要进行的操作项，并根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项，若是，则继续执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
在上述技术方案的基础上，对于操作请求中包括多个业务执行函数的执行函数，所述配置模块还用于配置权限验证函数的优先级大于任一业务执行函数的优先级，业务执行函数的优先级按照执行顺序进行优先级的递减配置。
在上述技术方案的基础上，所述执行判断模块还用于当用户对应的所允许操作项发生改变时，则将用户的最新所允许操作项数据缓存至内存的用户权限数据中，并删除内存中缓存的原有的用户对应的所允许操作项数据。
与现有技术相比，本发明的优点在于：
(1)将用户权限数据缓存到内存中，在进行用户允许操作项数据的查找验证时，仅需在内存中读取相应数据即可，避免每次用户权限的验证均需要在服务器的数据库中查找，避免多次重复穿透数据库，进行大规模的数据查找时对服务器资源的占用和浪费，有效提高用户操作权限的验证时间。
(2)对用户操作请求中的权限验证函数和业务执行函数的优先级进行配置，保证权限验证函数的优先执行，避免先执行业务执行函数后得知用户无操作权限，从而停止业务执行函数的执行产生无用代码，浪费服务器资源，保证权限验证和业务执行的独立性。
附图说明
图1为本发明实施例中一种Node.js权限控制方法的流程图；
图2为本发明实施例中一种电子设备的结构示意图。
具体实施方式
以下结合附图及实施例对本发明作进一步详细说明。
参见图1所示，本发明实施例提供一种Node.js权限控制方法，用于当用户对基于Node.js搭建的服务器进行操作时，对用户的操作权限进行验证控制，本发明的Node.js权限控制方法具体包括：
S1：对用户的操作请求中的执行函数进行优先级划分，执行函数包括权限验证函数和业务执行函数，其中，将权限验证函数的优先级 配置成大于业务执行函数的优先级。
对于基于Node.js搭建的服务器，在express中有一个router(路由器)类，express是基于Node.js平台的一个应用框架，router类的主要用途是管理路由，router类为一个键值对集合，健通常为路由名称，值是对应的接口函数，因而通过router.get(key,callback)函数便可定义一个接口。本发明实施例中，具体为对服务器的某个接口进行用户操作权限的验证。
对于用户的操作请求，具体是以执行函数的形式与服务器间进行交互，执行函数中的权限验证函数发送给服务器，服务器执行权限验证函数，对用户待进行的具体操作项权限进行验证，执行函数中的业务执行函数对应的为用户具体的待操作项目，服务器执行业务执行函数，进而进行用户待操作项的具体工作进行，如用户要进行某个接口的关闭操作，则权限验证函数负责对用户关闭接口操作的权限的验证，业务执行函数负责具体的接口关闭操作。
将权限验证函数的优先级配置成大于业务执行函数的优先级，进而保证权限验证函数的优先执行，即先对用户是否有操作该项目的权限进行验证，待验证通过后，在执行业务执行函数，进行具体工作项目内容的执行，避免先执行业务执行函数，后续执行权限验证函数时，验证得到用户没有该项目的操作权限，则还得终止业务执行函数的执行，造成服务器资源的浪费。
在一种实施方式中，对于操作请求中包括多个业务执行函数的执行函数，其中，权限验证函数的优先级大于任一业务执行函数的优先级，业务执行函数的优先级按照执行顺序进行优先级的递减配置，即某一操作项可能对应多个操作步骤，每个操作步骤对应一个业务执行函数，因此业务执行函数按照该操作项的具体操作步骤顺序进行优先 级的排序，先执行的业务执行函数的优先级大于后执行的业务执行函数的优先级，但权限验证函数的优先级大于任一业务执行函数的优先级，保证权限验证函数的优先执行，即优先进行用户操作权限的验证。
S2：缓存服务器数据库中保存的用户权限数据至服务器内存，用户权限数据为用户及用户对应的所允许操作项信息。用户与该用户允许的操作项是对应的关系。
将用户权限数据缓存到内存中，后续在进行用户允许操作项数据的查找验证时，仅需在内存中读取即可，避免每次用户权限的验证均需要在服务器的数据库中查找，避免多次重复穿透数据库，进行大规模的数据查找，有效提高用户操作权限的验证时间。即使用单例设计模式，使用sequelize.query()函数执行相关的操作，将数据库中的用户权限数据通过memory-cache.set()函数缓存到内存中，需要进行用户权限数据的读取时，直接使用memory-cache.get()函数在内存中读取即可。
S3：执行权限验证函数，获取当前用户所要进行的操作项。权限验证函数中包括用户ID信息，即当前用户的身份信息，用户权限数据中，用户的身份和该用户所允许操作项目是对应的；因此，执行权限验证函数，能够得到用户ID信息和当前用户所要进行的操作项。
用户的用户ID信息一般是通过session(时域)或token(令牌)的方式，例如用户需要对服务器的某个接口进行某项操作时，服务器执行权限验证函数时，对应的用户信息即会传到接口中，此时通过req.user.uid函数即可得到用户ID，同时还能得到详细的用户信息。
S4：根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项，若是，则执行业务执行函数以进行当前用户所要进行操作项对应的相应 操作，若否，则结束。
在一种实施方式中，内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项的具体判断过程为：
S401：将执行权限验证函数得到用户ID信息与用户权限数据中用户信息进行匹配，得到用户权限数据中保存的当前用户的所有允许操作项；
S402：判断得到的当前用户的所有允许操作项中是否含有当前用户所要进行的操作项，若是，则执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
在一种实时方式中，需要对某个接口进行创建用户的操作，则在用户发送给服务器的操作请求中的权限验证函数所对应的操作项即为创建用户，将用户ID信息作为key通过cacheUtils.ensureCache('roles',id)函数在用户权限数据中进行该用户所允许操作项的查找，然后返回一返回值，通过string.indexOf()函数判断返回值的字符串中是否包含“创建用户”，若包含，则说明当前用户拥有在该接口进行创建用户操作的权限，因而便可使用next()函数执行业务执行函数，进行创建用户的操作，若不包含。则通过res.sendStatus(403)函数进行结果的返回，用户接收到403错误码即可得知自身没有该项目的操作权限。
当数据库中用户对应的所允许操作项发生改变时，则将用户的最新所允许操作项数据缓存至内存的用户权限数据中，并删除内存中缓存的原有的用户对应的所允许操作项数据，删除的操作可以通过调用cacheUtils.invalidCache()函数实现。
本发明的一种Node.js权限控制方法的原理在于，首先对用户操作请求中的权限验证函数和业务执行函数的优先级进行配置，保证权 限验证函数的优先执行，即先进行用户操作权限的操作，再执行具体操作项的工作内容代码，避免先执行业务执行函数后得知用户无操作权限，从而停止业务执行函数的执行产生无用代码，做无用功，浪费服务器资源，同时，将用户权限数据缓存到内存中，在进行用户允许操作项数据的查找验证时，仅需在内存中读取相应数据即可，避免每次用户权限的验证均需要在服务器的数据库中查找，避免多次重复穿透数据库，进行大规模的数据查找，有效提高用户操作权限的验证时间。
另外，对应上述Node.js权限控制方法，本发明还提供一种存储介质，存储介质上存储有计算机程序，计算机程序被处理器执行时实现上述各实施例所述的Node.js权限控制方法的步骤。需要说明的是，所述存储介质包括U盘、移动硬盘、ROM(Read-Only Memory，只读存储器)、RAM(Random Access Memory，随机存取存储器)、磁碟或者光盘等各种可以存储程序代码的介质。
参见图2所示，对应上述Node.js权限控制方法，本发明还提供一种电子设备，包括存储器和处理器，存储器上储存有在处理器上运行的计算机程序，处理器执行计算机程序时实现上述各实施例的Node.js权限控制方法的步骤。
本发明还提供一种针对上述Node.js权限控制方法的Node.js权限控制系统，包括配置模块、缓存模块和执行判断模块。
配置模块用于对用户的操作请求中的执行函数进行优先级划分，将操作请求中的权限验证函数的优先级配置成大于业务执行函数的优先级；缓存模块用于缓存服务器数据库中保存的用户权限数据至服务器内存，所述用户权限数据为用户及用户对应的所允许操作项信息；执行判断模块用于执行权限验证函数，获取当前用户所要进行的 操作项，并根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项，若是，则继续执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
对于操作请求中包括多个业务执行函数的执行函数，配置模块还用于配置权限验证函数的优先级大于任一业务执行函数的优先级，业务执行函数的优先级按照执行顺序进行优先级的递减配置。执行判断模块还用于当用户对应的所允许操作项发生改变时，则将用户的最新所允许操作项数据缓存至内存的用户权限数据中，并删除内存中缓存的原有的用户对应的所允许操作项数据。
本发明的Node.js权限控制系统的原理在于，配置模块对用户操作请求中的权限验证函数和业务执行函数的优先级进行配置，保证权限验证函数的优先执行，即先进行用户操作权限的操作，再执行具体操作项的工作内容代码，避免先执行业务执行函数后得知用户无操作权限，从而停止业务执行函数的执行产生无用代码，做无用功，浪费服务器资源，同时，缓存模块将用户权限数据缓存到内存中，执行判断模块在进行用户允许操作项数据的查找验证时，仅需在内存中读取相应数据即可，避免每次用户权限的验证均需要在服务器的数据库中查找，避免多次重复穿透数据库，进行大规模的数据查找，有效提高用户操作权限的验证时间，较少服务器资源的额外消耗。
本发明不局限于上述实施方式，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也视为本发明的保护范围之内。本说明书中未作详细描述的内容属于本领域专业技术人员公知的现有技术。

Claims (10)

  1. 一种Node.js权限控制方法，用于基于Node.js搭建的服务器中用户权限的验证控制，其特征在于，包括：
    S1：对用户的操作请求中的执行函数进行优先级划分，所述执行函数包括权限验证函数和业务执行函数，其中，将权限验证函数的优先级配置成大于业务执行函数的优先级；
    S2：缓存服务器数据库中保存的用户权限数据至服务器内存，所述用户权限数据为用户及用户对应的所允许操作项信息；
    S3：执行权限验证函数，获取当前用户所要进行的操作项；
    S4：根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项，若是，则执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
  2. 如权利要求1所述的一种Node.js权限控制方法，其特征在于：对于操作请求中包括多个业务执行函数的执行函数，其中，权限验证函数的优先级大于任一业务执行函数的优先级，业务执行函数的优先级按照执行顺序进行优先级的递减配置。
  3. 如权利要求1所述的一种Node.js权限控制方法，其特征在于：当用户对应的所允许操作项发生改变时，则将用户的最新所允许操作项数据缓存至内存的用户权限数据中，并删除内存中缓存的原有的用户对应的所允许操作项数据。
  4. 如权利要求1所述的一种Node.js权限控制方法，其特征在于：
    所述权限验证函数中还包括用户ID信息；
    执行权限验证函数，得到用户ID信息和当前用户所要进行的操作项。
  5. 如权利要求4所述的一种Node.js权限控制方法，其特征在于：内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操作项的具体判断过程为：
    S401：将执行权限验证函数得到用户ID信息与用户权限数据中用户信息进行匹配，得到用户权限数据中保存的当前用户的所有允许操作项；
    S402：判断得到的当前用户的所有允许操作项中是否含有当前用户所要进行的操作项，若是，则执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
  6. 一种存储介质，该存储介质上存储有计算机程序，其特征在于：所述计算机程序被处理器执行时实现权利要求1至5任一项所述的方法。
  7. 一种电子设备，包括存储器和处理器，存储器上储存有在处理器上运行的计算机程序，其特征在于：所述处理器执行所述计算机程序时实现权利要求1至5任一项所述的方法。
  8. 一种Node.js权限控制系统，其特征在于，包括：
    配置模块，其用于对用户的操作请求中的执行函数进行优先级划分，将操作请求中的权限验证函数的优先级配置成大于业务执行函数的优先级；
    缓存模块，其用于缓存服务器数据库中保存的用户权限数据至服务器内存，所述用户权限数据为用户及用户对应的所允许操作项信息；
    执行判断模块，其用于执行权限验证函数，获取当前用户所要进行的操作项，并根据获取的当前用户所要进行的操作项，判断内存中缓存的当前用户的用户权限数据是否对应有当前用户所要进行的操 作项，若是，则继续执行业务执行函数以进行当前用户所要进行操作项对应的相应操作，若否，则结束。
  9. 如权利要求8所述的一种Node.js权限控制系统，其特征在于：对于操作请求中包括多个业务执行函数的执行函数，所述配置模块还用于配置权限验证函数的优先级大于任一业务执行函数的优先级，业务执行函数的优先级按照执行顺序进行优先级的递减配置。
  10. 如权利要求8所述的一种Node.js权限控制系统，其特征在于：所述执行判断模块还用于当用户对应的所允许操作项发生改变时，则将用户的最新所允许操作项数据缓存至内存的用户权限数据中，并删除内存中缓存的原有的用户对应的所允许操作项数据。
PCT/CN2017/117367 2017-07-01 2017-12-20 Node.js权限控制方法、存储介质、电子设备及系统 WO2019006998A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710528358.5 2017-07-01
CN201710528358.5A CN107436920A (zh) 2017-07-01 2017-07-01 Node.js权限控制方法、存储介质、电子设备及系统

Publications (1)

Publication Number Publication Date
WO2019006998A1 true WO2019006998A1 (zh) 2019-01-10

Family

ID=60459676

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/117367 WO2019006998A1 (zh) 2017-07-01 2017-12-20 Node.js权限控制方法、存储介质、电子设备及系统

Country Status (2)

Country Link
CN (1) CN107436920A (zh)
WO (1) WO2019006998A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107436920A (zh) * 2017-07-01 2017-12-05 武汉斗鱼网络科技有限公司 Node.js权限控制方法、存储介质、电子设备及系统
CN109657485B (zh) * 2018-12-13 2021-10-22 广州虎牙信息科技有限公司 权限处理方法、装置、终端设备和存储介质
CN111310145B (zh) * 2020-03-06 2023-02-21 抖音视界有限公司 用户权限验证方法、装置以及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101034990A (zh) * 2007-02-14 2007-09-12 华为技术有限公司 权限管理方法及装置
CN104202373A (zh) * 2014-08-21 2014-12-10 清华大学深圳研究生院 移动云计算迁移方法及系统
CN105573744A (zh) * 2015-12-09 2016-05-11 小米科技有限责任公司 应用列表排序方法、装置和终端设备
WO2017000803A1 (zh) * 2015-06-29 2017-01-05 华为技术有限公司 一种实现应用的方法及业务控制器
CN107436920A (zh) * 2017-07-01 2017-12-05 武汉斗鱼网络科技有限公司 Node.js权限控制方法、存储介质、电子设备及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101282330B (zh) * 2007-04-04 2013-08-28 华为技术有限公司 网络存储访问权限管理方法及装置、网络存储访问控制方法
CN102104607B (zh) * 2011-03-10 2013-11-06 易程（苏州）软件股份有限公司 访问业务的安全控制方法、装置及系统
CN103023656B (zh) * 2012-12-17 2018-06-01 北京普泽创智数据技术有限公司 一种分布式顺序表权限控制方法及其系统
CN105450581B (zh) * 2014-06-20 2019-12-03 北京新媒传信科技有限公司 权限控制的方法和装置
CN105100051B (zh) * 2015-05-29 2019-04-26 上海京东到家元信信息技术有限公司 实现数据资源访问权限控制的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101034990A (zh) * 2007-02-14 2007-09-12 华为技术有限公司 权限管理方法及装置
CN104202373A (zh) * 2014-08-21 2014-12-10 清华大学深圳研究生院 移动云计算迁移方法及系统
WO2017000803A1 (zh) * 2015-06-29 2017-01-05 华为技术有限公司 一种实现应用的方法及业务控制器
CN105573744A (zh) * 2015-12-09 2016-05-11 小米科技有限责任公司 应用列表排序方法、装置和终端设备
CN107436920A (zh) * 2017-07-01 2017-12-05 武汉斗鱼网络科技有限公司 Node.js权限控制方法、存储介质、电子设备及系统

Also Published As

Publication number Publication date
CN107436920A (zh) 2017-12-05

Similar Documents

Publication Publication Date Title
US10410010B2 (en) Language-localized policy statements
US20200067936A1 (en) Dynamically generating sharing boundaries
US8590003B2 (en) Controlling access to resources by hosted entities
KR20220130255A (ko) 데이터 웨어하우스로부터 외부 함수를 호출하는 것
US20080104393A1 (en) Cloud-based access control list
Carniani et al. Usage control on cloud systems
US10410304B2 (en) Provisioning in digital asset management
AU2019441820B2 (en) Systems and methods for using namespaces to access computing resources
US20180262510A1 (en) Categorized authorization models for graphical datasets
US20050132054A1 (en) Fine-grained authorization by traversing generational relationships
US11249995B2 (en) Techniques and architectures for providing and operating an application-aware database environment with predictive execution of queries and query flows
US11567943B1 (en) Restricted queries in a database clean room
EP3471010B1 (en) Generic runtime protection for transactional data
WO2019006998A1 (zh) Node.js权限控制方法、存储介质、电子设备及系统
US11477179B2 (en) Searching content associated with multiple applications
US11645413B2 (en) Secure document sharing using a data exchange listing
WO2016026320A1 (zh) 访问控制方法及装置
EP3497586A1 (en) Discovery of calling application for control of file hydration behavior
US9537893B2 (en) Abstract evaluation of access control policies for efficient evaluation of constraints
US7849055B2 (en) Method and system for limiting instances of a client-server program within a restricted distributed network
WO2016140992A1 (en) Ongoing management for pre-planned handling of digital presence
US20230409968A1 (en) Multi-party machine learning using a database cleanroom
US20230086068A1 (en) Enabling an action based on a permission identifier for real-time identity resolution in a distributed system
Ali et al. A provenance-aware policy language (cprovl) and a data traceability model (cprov) for the cloud
WO2017181775A1 (zh) 分布式授权管理方法及装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17916556

Country of ref document: EP

Kind code of ref document: A1