System and method for implementing domain based access control on queries of a self-describing data system
A method for implementing access controls for items of data belonging to a self-describing data structure including obtaining a query definition specifying a requested item of data in the self-describing data structure, determining domains associated with the requested item, the domains including a set of items within the self-describing data structure on an execution path of a query executed according to the query definition. For each respective domain associated with the requested item, the method includes determining subdomains associated with the requested item, determining a role of the user for the respective domain, the role is associated with a set of access permissions to items of data within the domain, and generating an output corresponding to whether access to the requested item is granted based on a policy for each of the subdomains associated with the requested item and the role of the user for the domain.
1. A method for performing recursive searching of items of a data structure having a data model, the method comprising:
creating an instance of a query definition, the instance of the query definition comprising a unique identifier and having an item type in the data model;
specifying one or more elements of the query definition, wherein each of the one or more elements are a respective instance having the item type in the data model, and each of the one or more elements are included within a respective relationship container tag in the data model and each respective relationship container tag comprises one or more properties indicating whether a respective element is a parent item, a child item, or both;
providing the query definition as an input to a query engine;
determining, by the query engine, query execution instructions based on the query definition, the query instructions specifying a recursive level-by-level search until a terminal node of the data structure is reached;
obtaining results of a query executed based on the query execution instructions; and
outputting query results.
2. The method of claim 1 , wherein outputting the query results comprises at least one of outputting the query results as a flat output, displaying the results in a tree grid view or displaying the results as a graph visualization.
3. The method of claim 1 , wherein an element of the query definition is specified by a security rule.
4. The method of claim 1 , wherein the data model of the data structure is at least one of a hierarchical data model, a dynamic data model or a self-describing data model.
5. The method of claim 1 , wherein specifying the one or more elements of the query definition comprises at least one of specifying a query item, a query item selection property, a query item sort property, a query item available property, a query condition or a query reference.
6. The method of claim 1 , further comprising storing the query definition in the data structure.
7. The method of claim 1 , wherein the query execution instructions specify at least one of traversing the data structure upwards or traversing the data structure downwards.
8. A query engine, comprising:
a processor;
a memory containing instructions, which when executed by the processor, cause the query engine to:
create an instance of a query definition, the instance of the query definition comprising a unique identifier and having an item type in the data model;
specify one or more elements of the query definition, wherein each of the one or more elements are a respective instance having the item type in the data model, and each of the one or more elements are included within a respective relationship container tag in the data model and each respective relationship container tag comprises one or more properties indicating whether a respective element is a parent item, a child item, or both;
provide the query definition as an input to the query engine;
determine query execution instructions based on the query definition, the query execution instructions specifying a recursive level-by-level search until a terminal node of the data structure is reached;
obtain results of a query executed based on the query execution instructions; and
output the query results.
9. The query engine of claim 8 , wherein the memory contains instructions, which when executed by the processor, cause the query engine to output the query results as at least one of outputting the query results as a flat output, displaying the results in a tree grid view or displaying the results as a graph visualization.
10. The query engine of claim 8 , wherein an element of the query definition is specified by a security rule.
11. The query engine of claim 8 , wherein the data model of the data structure is at least one of a hierarchical data model, a dynamic data model or a self-describing data model.
12. The query engine of claim 8 , wherein the one or more elements of the query definition comprise at least one of a query item, a query item selection property, a query item sort property, a query item available property, a query condition or a query reference.
13. The query engine of claim 8 , wherein the memory contains instructions, which when executed by the processor, cause the query engine to store the query definition in the data structure.
14. The query engine of claim 8 , wherein the query execution instructions specify at least one of traversing the data structure upwards or traversing the data structure downwards.
15. A non-transitory computer-readable medium containing program code, which when executed by a processor, cause a query engine to:
create an instance of a query definition, the instance of the query definition comprising a unique identifier and having an item type in the data model;
specify one or more elements of the query definition, wherein each of the one or more elements are a respective instance having the item type in the data model, and each of the one or more elements are included within a respective relationship container tag in the data model and each respective relationship container tag comprises one or more properties indicating whether a respective element is a parent item, a child item, or both;
provide the query definition as an input to the query engine;
determine query execution instructions based on the query definition, the query execution instructions specifying a recursive level-by-level search until a terminal node of the data structure is reached;
obtain results of a query executed based on the query execution instructions; and
output the query results.
16. The non-transitory computer-readable medium of claim 15 , comprising program code, which when executed by the processor, cause the query engine to output the query results as at least one of outputting the query results as a flat output, displaying the results in a tree grid view or displaying the results as a graph visualization.
17. The non-transitory computer-readable medium of claim 15 , wherein an element of the query definition is specified by a security rule.
18. The non-transitory computer-readable medium of claim 15 , wherein the data model of the data structure is at least one of a hierarchical data model, a dynamic data model or a self-describing data model.
19. The non-transitory computer-readable medium of claim 15 , the elements of the query definition comprise at least one of a query item, a query item selection property, a query item sort property, a query item available property, a query condition or a query reference.
20. The non-transitory computer-readable medium of claim 15 , comprising program code, which when executed by the processor, causes the query engine to store the query definition in the data structure.