Hierarchical permissions model for case management
Case management systems and techniques are disclosed. In various embodiments, a case model definition defining a case model is received. The case model comprises a hierarchical permissions model comprising a plurality of hierarchical permission nodes, the plurality of hierarchical permission nodes including a first hierarchical permission node associated with a parent case node and having an associated first case role and a first permission for the first role, and a second hierarchical permission node associated with a child case node. At run time, the first permission with respect to a case instance instantiated using the case model definition is enforced. Enforcing the first permission comprises applying the first permission to a request to perform a first action on an instance of the child case node based on the first case role and first permission.
1. A computer program product comprising a non-transitory computer readable medium embodying thereon computer executable code, the computer executable code comprising instructions for:
accessing a case model definition, the case model definition defining a case model comprising:
a hierarchical data model comprising a plurality of case nodes, the plurality of case nodes comprising a parent case node and a child case node that is a child of the parent case node; and
a hierarchical permissions model, the hierarchical permissions model comprising a plurality of hierarchical permission nodes, the plurality of hierarchical permission nodes including:
a first hierarchical permission node associated with the parent case node and having:
an associated first case role; and
a first permission for the first case role; and
a second hierarchical permission node associated with the child case node; and
at run time, enforcing the first permission with respect to a case instance instantiated using the case model definition, enforcing the first permission comprising applying the first permission to a request to perform a first action on an instance of the child case node based on the first case role.
2. The computer program product of claim 1 , wherein the computer executable code comprises instructions for:
determining if the second hierarchical permission node includes a second permission for the first case role; and
overriding the first permission for the first case role with the second permission based on a determination that the second hierarchical permission node includes the second permission for the first case role.
3. The computer program product of claim 1 , wherein the computer executable code comprises instructions for:
determining that the second hierarchical permission node does not include an overriding permission for the first case role prior to applying the first permission to the request.
4. The computer program product of claim 1 , wherein:
the first hierarchical permission node associated with the parent case node comprises:
a second case role; and
a second permission, the second permission associated with the second case role;
the second hierarchical permission node associated with the child case node comprises:
the second case role; and
a third permission, the third permission associated with the second case role; and
the computer executable code comprises instructions for:
determining that the third permission overrides the second permission for the second case role; and
based on a determination that the third permission overrides the second permission for the second case role, applying, at run time, the third permission to a request to perform a second action on the instance of the child case node.
5. The computer program product of claim 1 :
wherein the case model definition comprises a state machine definition for a state machine for the child case node, the state machine definition defining:
a plurality of state machine phases; and
transitions between state machine phases from the plurality of state machine phases;
wherein the second hierarchical permission node comprises:
a second case role; and
a second permission associated with the second case role and a first phase from the plurality of state machine phases; and
wherein the computer executable code comprises instructions for:
instantiating the state machine with respect to the instance of the child case node;
determining that the state machine is at the first phase; and
at run time, applying the second permission to a request to perform a second action on the instance of the child case node based on the second case role and a determination that the state machine is at the first phase.
6. The computer program product of claim 5 :
wherein the second hierarchical permission node comprises a third permission associated with the second case role and a second phase from the plurality of state machine phases and wherein the computer executable code comprises instructions for:
determining that the state machine is at the second phase; and
applying, at run time, the third permission to a request to perform a third action on the instance of the child case node based on the second case role and a determination that the state machine is at the second phase.
7. The computer program product of claim 1 :
wherein the case model definition comprises a state machine definition for a state machine for the parent case node, the state machine definition defining:
a plurality of state machine phases; and
transitions between state machine phases from the plurality of state machine phases;
wherein the second hierarchical permission node comprises:
a second case role; and
a second permission associated with the second case role and a first phase from the plurality of state machine phases; and
wherein the computer executable code comprises instructions for:
instantiating the state machine with respect to the instance of the parent case node;
determining that the state machine is at the first phase; and
applying, at run time, the second permission to a request to perform a second action on the instance of the child case node based on the second case role and a determination that the state machine is at the first phase.
8. The computer program product of claim 5 , wherein the case model definition is accessed from a structured data file.
9. The computer program product of claim 8 , wherein the structured data file is an extensible markup language file.
10. A computer-implemented case management method, comprising:
accessing, by a processor, a case model definition, the case model definition defining a case model comprising:
a hierarchical data model comprising a plurality of case nodes, the plurality of case nodes comprising a parent case node and a child case node that is a child of the parent case node; and
a hierarchical permissions model, the hierarchical permissions model comprising a plurality of hierarchical permission nodes, the plurality of hierarchical permission nodes including:
a first hierarchical permission node associated with the parent case node and having:
an associated first case role; and
a first permission for the first case role; and
a second hierarchical permission node associated with the child case node; and
enforcing, by the processor at run time, the first permission with respect to a case instance instantiated using the case model definition, enforcing the first permission comprising applying the first permission to a request to perform a first action on an instance of the child case node based on the first case role.
11. The computer-implemented case management method of claim 10 , further comprising:
determining that the second hierarchical permission node does not include an overriding permission for the first case role prior to applying the first permission to the request.
12. The computer-implemented case management method of claim 10 :
wherein the first hierarchical permission node associated with the parent case node comprises:
a second case role; and
a second permission, the second permission associated with the second case role;
wherein the second hierarchical permission node associated with the child case node comprises:
the second case role; and
a third permission, the third permission associated with the second case role; and
wherein the computer-implemented case management method further comprises:
the processor determining that the third permission overrides the second permission for the second case role; and
based on the second case role and a determination that the third permission overrides the second permission for the second case role, applying, by the processor at run time, the third permission to a request to perform a second action on the instance of the child case node.
13. The computer-implemented case management method of claim 10 :
wherein the case model definition comprises a state machine definition for a state machine for the child case node, the state machine definition defining:
a plurality of state machine phases; and
transitions between state machine phases from the plurality of state machine phases;
wherein the second hierarchical permission node comprises:
a second case role; and
a second permission associated with the second case role and a first phase from the plurality of state machine phases; and
wherein computer-implemented method further comprises:
instantiating the state machine with respect to the instance of the child case node;
determining that the state machine is at the first phase; and
applying, by the processor at run time, the second permission to a request to perform a second action on the instance of the child case node based on the second case role, and a determination that the state machine is at the first phase.
14. The computer-implemented case management method of claim 13 , wherein the second hierarchical permission node comprises a third permission associated with the second case role and a second phase from the plurality of state machine phases and wherein the computer-implemented case management method further comprises:
determining, by the processor, that the state machine is at the second phase; and
applying, by the processor at run time, the third permission to a request to perform a third action on the instance of the child case node based on the second case role and a determination that the state machine is at the second phase.
15. The computer-implemented case management method of claim 10 :
wherein the case model definition comprises a state machine definition for a state machine for the parent case node, the state machine definition defining:
a plurality of state machine phases; and
transitions between state machine phases from the plurality of state machine phases;
wherein the second hierarchical permission node comprises:
a second case role;
a second permission associated with the second case role and a first phase from the plurality of state machine phases; and
wherein the computer-implemented case management method further comprises:
instantiating the state machine with respect to the instance of the parent case node;
determining that the state machine is at the first phase; and
applying, by the processor at run time, the second permission to a request to perform a second action on the instance of the child case node based on the second case role and a determination that the state machine is at the first phase.
16. A computer-implemented case management method, comprising:
accessing, by a processor, a case model definition, the case model definition defining a case model comprising:
a hierarchical data model comprising a plurality of case nodes, the plurality of case nodes comprising a parent case node and a child case node that is a child of the parent case node; and
a hierarchical permissions model, the hierarchical permissions model comprising a plurality of hierarchical permission nodes, the plurality of hierarchical permission nodes including:
a first hierarchical permission node associated with the parent case node and having:
an associated first case role; and
a first permission for the first case role; and
a second hierarchical permission node associated with the child case node and having a second permission for the first case role; and
determining, by the processor, that the second permission overrides the first permission for the first case role for the child case node; and
enforcing, by the processor at run time, the second permission with respect to a case instance instantiated using the case model definition, enforcing the second permission comprising applying the second permission to a request to perform a first action on an instance of the child case node based on the first case role and the first action.
17. The computer-implemented case management method of claim 16 :
wherein the case model definition comprises a state machine definition for a state machine for the child case node, the state machine definition defining:
a plurality of state machine phases; and
transitions between state machine phases from the plurality of state machine phases
wherein the second hierarchical permission node comprises:
a second case role; and
a third permission associated with the second case role and a first phase from the plurality of state machine phases; and
wherein computer-implemented method further comprises:
instantiating the state machine with respect to the instance of the child case node;
determining that the state machine is at the first phase; and
applying, by the processor at run time, the third permission to a request to perform a second action on the instance of the child case node based on second action, the second case role, and a determination that the state machine is at the first phase.
18. The computer-implemented case management method of claim 17 , wherein the second hierarchical permission node comprises a fourth permission associated with the second case role and a second phase from the plurality of state machine phases and wherein the computer-implemented case management method further comprises:
determining, by the processor, that the state machine is at the second phase; and
applying, by the processor at run time, the third permission to a request to perform a third action on the instance of the child case node based on the second case role and a determination that the state machine is at the second phase.
19. The computer-implemented case management method of claim 16 :
wherein the case model definition comprises a state machine definition for a state machine for the parent case node, the state machine definition defining:
a plurality of state machine phases; and
transitions between state machine phases from the plurality of state machine phases;
wherein the second hierarchical permission node comprises:
a second case role;
a second permission associated with the second case role and a first phase from the plurality of state machine phases; and
wherein the computer-implemented case management method further comprises:
instantiating the state machine with respect to the instance of the parent case node;
determining that the state machine is at the first phase; and
applying, by the processor at run time, the second permission to a request to perform a second action on the instance of the child case node based on the second case role and a determination that the state machine is at the first phase.