RBAC权限设计
最近开发了一个新的管理系统,整理下其中的权限设计,尤其是开发过程中慢慢发现的问题提出来,方便下次改进。 需求: 开发一个管理系统,该系统可以支持多渠道商查看,并且每个渠道商只能查看自己的相应数据。 分析: 1、渠道商属于合作公司,所以他们应当有
最近开发了一个新的管理系统,整理下其中的权限设计,尤其是开发过程中慢慢发现的问题提出来,方便下次改进。
需求:
开发一个管理系统,该系统可以支持多渠道商查看,并且每个渠道商只能查看自己的相应数据。
分析:
1、渠道商属于合作公司,所以他们应当有创建用户,分配权限的功能,并且分配的这些权限不能超过渠道超级管理员所拥有的最大权限。
2、基于前面这一点,渠道之间应该是互不影响的权限分配,并且尽可能简单为好。
3、数据权限该怎么控制?数据权限的控制会使操作变得复杂。需要给各渠道分配数据权限,各渠道之间再分配权限也可能涉及到数据权限的控制。本着让自己简单点,也让使用者简单点的原则,数据上只根据渠道做了控制,控制的方式则写在了对应的程序里,渠道通过控制资源的访问来限制权限,期待大神指点。
设计:
设计的思想还是围绕这RBAC的方式来进行,基本的5个表是需要的:管理员、角色、资源、管理员与角色关系表、角色与资源对应关系表。
用户表:记录下用户的基本信息,该用户属于哪个渠道,该管理员是普通管理员还是超级管理员。所以增加了渠道字段source_id,以及管理员字段is_admin。管理员分为三种,普通管理员、超级管理员、系统管理员。系统管理员可以理解为开发者,用来创建超级管理员并给超级管理员分配权限,超级管理员则是对应渠道的最大权限管理员。
角色表:用户通过角色与资源相关联。这里需要增加渠道字段,每个渠道创建的角色归本渠道所有。
用户角色关系表:维护用户与角色的关系,用户与角色之间是多对多的关系。可能设计的时候会考虑有没有必要?是否可以在用户表中增加一个字段来维护和角色的关系。如果确定一个用户只可拥有一个角色,放在这里也是可行。但如果以后要扩展多个角色就不方便扩展了,得增加字段或者说用逗号分隔的方式来记录:1,2,3。而逗号分隔的维护性不好,查询、分配可能问题不大,但如果删除角色时去更新拥有这些角色的用户就比较麻烦了。
资源表:这里的理解就是一个个的系统菜单。
角色资源关系表:维护角色与资源的关系。
在这个基础上要实现渠道分配权限的功能还需要有一个渠道和资源的关系,这里定义为渠道最大权限表。渠道超管的权限直接通过该表获取,不用再给渠道超管分配角色,渠道管理员给普通管理员分配权限也受限于这里所拥有的权限。表的维护由系统管理员来管理。
最后E-R图:
开发过程中的思考
1、角色增加了渠道字段,资源需不需要增加渠道字段?
增加渠道后知道这个资源属于那个渠道拥有,这里面也就有一个对应关系了。 这个对应关系就是这里说的渠道最大权限表。
2、渠道和用户组的概念?
这里渠道可以看成一个用户组,组与用户的关系,组与权限的关系,最开始思维局限在渠道这块了。
3、系统中菜单访问没有权限可以推荐到同级别的菜单访问。
权限的设计可以弄的很麻烦,这里本着尽可能简单的方式,有一些非菜单访问的页面就直接忽略掉控制(permission_type),只是在入口页面控制权限分配,减少管理员的操作。当然敏感的操作还是要控制。
原文地址:RBAC权限设计, 感谢原作者分享。

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

It allows users to perform more in-depth operations and customization of the system. Root permission is an administrator permission in the Android system. Obtaining root privileges usually requires a series of tedious steps, which may not be very friendly to ordinary users, however. By enabling root permissions with one click, this article will introduce a simple and effective method to help users easily obtain system permissions. Understand the importance and risks of root permissions and have greater freedom. Root permissions allow users to fully control the mobile phone system. Strengthen security controls, customize themes, and users can delete pre-installed applications. For example, accidentally deleting system files causing system crashes, excessive use of root privileges, and inadvertent installation of malware are also risky, however. Before using root privileges

This AI-assisted programming tool has unearthed a large number of useful AI-assisted programming tools in this stage of rapid AI development. AI-assisted programming tools can improve development efficiency, improve code quality, and reduce bug rates. They are important assistants in the modern software development process. Today Dayao will share with you 4 AI-assisted programming tools (and all support C# language). I hope it will be helpful to everyone. https://github.com/YSGStudyHards/DotNetGuide1.GitHubCopilotGitHubCopilot is an AI coding assistant that helps you write code faster and with less effort, so you can focus more on problem solving and collaboration. Git

According to news on April 26, ZTE’s 5G portable Wi-Fi U50S is now officially on sale, starting at 899 yuan. In terms of appearance design, ZTE U50S Portable Wi-Fi is simple and stylish, easy to hold and pack. Its size is 159/73/18mm and is easy to carry, allowing you to enjoy 5G high-speed network anytime and anywhere, achieving an unimpeded mobile office and entertainment experience. ZTE 5G portable Wi-Fi U50S supports the advanced Wi-Fi 6 protocol with a peak rate of up to 1800Mbps. It relies on the Snapdragon X55 high-performance 5G platform to provide users with an extremely fast network experience. Not only does it support the 5G dual-mode SA+NSA network environment and Sub-6GHz frequency band, the measured network speed can even reach an astonishing 500Mbps, which is easily satisfactory.

According to news on April 17, HMD teamed up with the well-known beer brand Heineken and the creative company Bodega to launch a unique flip phone - The Boring Phone. This phone is not only full of innovation in design, but also returns to nature in terms of functionality, aiming to lead people back to real interpersonal interactions and enjoy the pure time of drinking with friends. Boring mobile phone adopts a unique transparent flip design, showing a simple yet elegant aesthetic. It is equipped with a 2.8-inch QVGA display inside and a 1.77-inch display outside, providing users with a basic visual interaction experience. In terms of photography, although it is only equipped with a 30-megapixel camera, it is enough to handle simple daily tasks.

According to news on July 12, the Honor Magic V3 series was officially released today, equipped with the new Honor Vision Soothing Oasis eye protection screen. While the screen itself has high specifications and high quality, it also pioneered the introduction of AI active eye protection technology. It is reported that the traditional way to alleviate myopia is "myopia glasses". The power of myopia glasses is evenly distributed to ensure that the central area of sight is imaged on the retina, but the peripheral area is imaged behind the retina. The retina senses that the image is behind, promoting the eye axis direction. grow later, thereby deepening the degree. At present, one of the main ways to alleviate the development of myopia is the "defocus lens". The central area has a normal power, and the peripheral area is adjusted through optical design partitions, so that the image in the peripheral area falls in front of the retina.

On March 3, 2022, less than a month after the birth of the world's first AI programmer Devin, the NLP team of Princeton University developed an open source AI programmer SWE-agent. It leverages the GPT-4 model to automatically resolve issues in GitHub repositories. SWE-agent's performance on the SWE-bench test set is similar to Devin, taking an average of 93 seconds and solving 12.29% of the problems. By interacting with a dedicated terminal, SWE-agent can open and search file contents, use automatic syntax checking, edit specific lines, and write and execute tests. (Note: The above content is a slight adjustment of the original content, but the key information in the original text is retained and does not exceed the specified word limit.) SWE-A

Go language development mobile application tutorial As the mobile application market continues to boom, more and more developers are beginning to explore how to use Go language to develop mobile applications. As a simple and efficient programming language, Go language has also shown strong potential in mobile application development. This article will introduce in detail how to use Go language to develop mobile applications, and attach specific code examples to help readers get started quickly and start developing their own mobile applications. 1. Preparation Before starting, we need to prepare the development environment and tools. head

According to news on April 3, Taipower’s upcoming M50 Mini tablet computer is a device with rich functions and powerful performance. This new 8-inch small tablet is equipped with an 8.7-inch IPS screen, providing users with an excellent visual experience. Its metal body design is not only beautiful but also enhances the durability of the device. In terms of performance, the M50Mini is equipped with the Unisoc T606 eight-core processor, which has two A75 cores and six A55 cores, ensuring a smooth and efficient running experience. At the same time, the tablet is also equipped with a 6GB+128GB storage solution and supports 8GB memory expansion, which meets users’ needs for storage and multi-tasking. In terms of battery life, M50Mini is equipped with a 5000mAh battery and supports Ty
