Hierarchical permissions model within a document
Case management systems and techniques are disclosed. In various embodiments, a hierarchical document permission model is received, the model describing a document hierarchy comprising a plurality of hierarchically related document nodes and defining for each of at least a subset of said document nodes one or more document roles and for each such role one or more document permissions with respect to that document node. The hierarchical document permission model is used to determine and enforce permissions with respect to case management instances to which the hierarchical document permission model applies.
1. A case management system, comprising:
a storage device configured to store:
a document model definition defining a document hierarchy and a document permission model associated with the document hierarchy, the document hierarchy comprising document nodes corresponding to respective document portions and the document permission model comprising a hierarchy of document permission nodes defining document level hierarchical permissions for roles with respect to the respective document portions, each document permission node associated with a corresponding document node and defining, with respect to a respective document portion corresponding to the document node with which that permission node is associated, a corresponding document level permission for a role;
a case model definition defining a case model comprising a hierarchy of case nodes and associating the document model definition with a case node in the hierarchy of case nodes;
a processor coupled to the storage device and configured to:
instantiate a case instance based on the case model;
associate a document with the case instance, the document including the respective document portions;
based on the document model definition, set the document level hierarchical permissions on the respective document portions of the document;
receive a request from a requesting user to perform an action with respect to a portion of the document;
determine whether the action to be performed is permitted based on the corresponding document level permission set with respect to the portion of the document and a role of the requesting user;
allow the action to be performed based on a determination that the action is permitted; and
block the action from being performed based on a determination that the action is not permitted.
2. The case management system of claim 1 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining a second set of permissions for the first role with respect to a second respective document portion.
3. The case management system of claim 1 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining the first set of permissions for the first role with respect to a second respective document portion.
4. The case management system of claim 1 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining a second set of permissions for a second role with respect to a second respective document portion.
5. The case management system of claim 1 , wherein the document level hierarchical permissions include at least one of a create permission, a read permission, an update permission or a delete permission.
6. The case management system of claim 1 wherein the processor is configured to dynamically determine the corresponding document level permission set with respect to the portion of the document based on a state machine.
7. A computer program product embodied on a non-transitory computer readable storage medium and comprising instructions executable by a processor to:
receive a document model definition defining a document hierarchy and a document permission model associated with the document hierarchy, the document hierarchy comprising document nodes corresponding to respective document portions and the document permission model comprising a hierarchy of document permission nodes defining document level hierarchical permissions for roles with respect to the respective document portions, each document permission node associated with a corresponding document node and defining, with respect to a respective document portion corresponding to the document node with which that permission node is associated, a corresponding document level permission for a role;
receive a case model definition defining a case model comprising a hierarchy of case nodes and associating the document model definition with a case node in the hierarchy of case nodes;
instantiate a case instance based on the case model;
associate a document with the case instance, the document including the respective document portions;
based on the document model definition, set the document level hierarchical permissions on the respective document portions of the document;
receive a request from a requesting user to perform an action with respect to a portion of the document;
determine whether the action to be performed is permitted based on the corresponding document level permission set with respect to the portion of the document and a role of the requesting user;
allow the action to be performed based on a determination that the action is permitted; and
block the action from being performed based on a determination that the action is not permitted.
8. The computer program product of claim 7 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining a second set of permissions for the first role with respect to a second respective document portion.
9. The computer program product of claim 7 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining the first set of permissions for the first role with respect to a second respective document portion.
10. The computer program product of claim 7 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining a second set of permissions for a second role with respect to a second respective document portion.
11. The computer program product of claim 7 , wherein the document level hierarchical permissions include at least one of a create permission, a read permission, an update permission or a delete permission.
12. The computer program product of claim 7 , comprising instructions executable to dynamically determine the corresponding document level permission set with respect to the portion of the document based on a state of a state machine.
13. A method comprising:
receiving, by a processor, a document model definition defining a document hierarchy and a document permission model associated with the document hierarchy, the document hierarchy comprising document nodes corresponding to respective document portions and the document permission model comprising a hierarchy of document permission nodes defining document level hierarchical permissions for roles with respect to the respective document portions, each document permission node associated with a corresponding document node and defining, with respect to a respective document portion corresponding to the document node with which that permission node is associated, a corresponding document level permission for a role;
receiving, by the processor, a case model definition defining a case model comprising a hierarchy of case nodes and associating the document model definition with a case node in the hierarchy of case nodes;
instantiating, by the processor, a case instance based on the case model;
associating, by the processor, a document with the case instance, the document including the respective document portions;
based on the document model definition, setting, by the processor, the document level hierarchical permissions on the respective document portions of the document;
receiving, by the processor, a request from a requesting user to perform an action with respect to a portion of the document;
determining, by the processor, whether the action to be performed is permitted based on the corresponding document level permission set with respect to the portion of the document and a role of the requesting user; and
allowing, by the processor, the action to be performed based on a determination that the action is permitted.
14. The method of claim 13 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining a second set of permissions for the first role with respect to a second respective document portion.
15. The method of claim 13 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining the first set of permissions for the first role with respect to a second respective document portion.
16. The method of claim 13 , wherein the hierarchy of document permission nodes comprises:
a first document permission node defining a first set of permissions for a first role with respect to a first respective document portion; and
a second document permission node defining a second set of permissions for a second role with respect to a second respective document portion.
17. The method of claim 13 , wherein the document level hierarchical permissions include at least one of a create permission, a read permission, an update permission or a delete permission.
18. The method of claim 13 , comprising dynamically determining, by the processor, the corresponding document level permission set with respect to the portion of the document based on a state of a state machine.