Hierarchical permissions model for case management
Case management systems and techniques are disclosed. In various embodiments, a hierarchical permission model is received, comprising for each of at least a subset of case nodes comprising a hierarchical data model associated with a case model a corresponding set of case roles to be afforded permissions with respect to that case node and for each such case role a set of permissions to be associated with that case role with respect to that case node. The hierarchical permission model is used to enforce with respect to one or more case instances associated with the case model the permissions defined in the hierarchical permission model.
1. A method of managing permissions, comprising:
accessing from a storage device by a processor, a hierarchical permission model corresponding to a hierarchical data model associated with a case model, the hierarchical data model comprising a plurality of case nodes and the hierarchical permission model comprising a hierarchical permission model node corresponding to a corresponding case node of the hierarchical data model, wherein the hierarchical permission model node defines a case role at the corresponding case node and a set of permissions to be associated with that case role with respect to the corresponding case node, at least a permission in the set of permissions conditioned on corresponding case node specific data; and
the processor enforcing permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on the case role.
2. The method of claim 1 , further comprising receiving, from a case model developer system, a case model definition associated with the case model, wherein the case model definition includes a definition of the hierarchical data model.
3. The method of claim 2 , further comprising the processor parsing the case model definition to instantiate the one or more case instances using the case model.
4. The method of claim 1 , wherein enforcing permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing the requested action to be performed comprises:
receiving a request to perform the requested action with respect to a first case node of a first case instance;
determining that a requesting user associated with the request is assigned the case role with respect to the first case instance;
determining that the case role is granted in the hierarchical permission model a permission required to perform the requested action with respect to the first case node; and
allowing the requested action to be performed based at least in part on the determination that the requesting user is associated with the case role and the determination that the case role is granted the permission required to perform the requested action with respect to the first case node.
5. The method of claim 1 , wherein enforcing permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing the requested action to be performed comprises blocking a request to perform the requested action with respect to a first case node of a first case instance based at least in part on a determination that a requesting user with which the request is associated is not assigned any case role to which a permission required to perform the requested action is granted with respect to the first case node of the first case instance.
6. The method of claim 1 , wherein the case model associates a case node state machine comprising a plurality of case node states with the corresponding case node and the hierarchical permission model defines with respect to the corresponding case node one or more permissions conditioned at least in part based on a current state of the case node state machine.
7. The method of claim 6 , wherein the hierarchical permission model indicates with respect to a first state of the case node state machine for the corresponding case node that the case role is granted a state transition permission to cause a transition from the first state of the case node state machine to a second state of the case node state machine.
8. The method of claim 1 , wherein the set of permissions includes a case role assignment permission to allow a first user assign other users to a specified case role.
9. The method of claim 1 , wherein the hierarchical permission model comprises descendant nodes below the hierarchical permission model node in the hierarchical permission model, wherein the set of permissions extends to the descendent nodes.
10. The method of claim 1 , wherein said hierarchical permission model includes a first associates with a first subtree of the hierarchical data model the case role that is defined to have the set of permissions, wherein the set of permissions do not extend beyond said first subtree to other portions of said hierarchical data model.
11. The method of claim 1 , further comprising the processor instantiating the one or more case instances using the case model, the instantiating the one or more case instances including creating an in-memory data structure defined by the case model.
12. A computer program product comprising a non-transitory computer readable medium embodying thereon computer executable code comprising instructions for:
accessing from a storage device, a hierarchical permission model corresponding to a hierarchical data model associated with a case model, the hierarchical data model comprising a plurality of case nodes and the hierarchical permission model comprising a hierarchical permission model node corresponding to a corresponding case node of the hierarchical data model, wherein the hierarchical permission model node defines a case role at the corresponding case node and a set of permissions to be associated with that case role with respect to the corresponding case node, at least a permission in the set of permissions conditioned on corresponding case node specific data; and
enforcing permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on the case role.
13. The computer program product of claim 12 , further comprising instructions for receiving, from a case model developer system, a case model definition associated with the case model, wherein the case model definition includes a definition of the hierarchical data model.
14. The computer program product of claim 13 , further comprising instructions for parsing the case model definition to instantiate the one or more case instances using the case model.
15. The computer program product of claim 12 , wherein enforcing permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing the requested action to be performed comprises:
receiving a request to perform the requested action with respect to a first case node of a first case instance;
determining that a requesting user associated with the request is assigned the case role with respect to the first case instance;
determining that the case role is granted in the hierarchical permission model a permission required to perform the requested action with respect to the first case node; and
allowing the requested action to be performed based at least in part on the determination that the requesting user is associated with the case role and the determination that the case role is granted the permission required to perform the requested action with respect to the first case node.
16. The computer program product of claim 12 , wherein enforcing permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing the requested action to be performed comprises blocking a request to perform the requested action with respect to a first case node of a first case instance based at least in part on a determination that a requesting user with which the request is associated is not assigned any case role to which a permission required to perform the requested action is granted with respect to the first case node of the first case instance.
17. The computer program product of claim 12 , wherein the case model associates a case node state machine comprising a plurality of case node states with the corresponding case node and the hierarchical permission model defines with respect to the corresponding case node one or more permissions conditioned at least in part based on a current state of the case node state machine.
18. The computer program product of claim 17 , wherein the hierarchical permission model indicates with respect to a first state of the case node state machine for the corresponding case node that the case role is granted a state transition permission to cause a transition from the first state of the case node state machine to a second state of the case node state machine.
19. The computer program product of claim 12 , wherein the set of permissions includes a case role assignment permission to allow a first user assign other users to a specified case role.
20. The computer program product of claim 12 , wherein the hierarchical permission model comprises descendant nodes below the hierarchical permission model node in the hierarchical permission model, wherein the set of permissions extends to the descendent nodes.
21. The computer program product of claim 12 , wherein said hierarchical permission model includes a first associates with a first subtree of the hierarchical data model the case role that is defined to have the set of permissions, wherein the set of permissions do not extend beyond said first subtree to other portions of said hierarchical data model.
22. The computer program product of claim 12 , further comprising instructions for instantiating the one or more case instances using the case model, the instantiating the one or more case instances including creating an in-memory data structure defined by the case model.