Defining user access in highly-configurable systems
View Patent ↗A highly-configurable process control system that uses process records in a database system to track a process. The database system relates process records, users, and projects. User permissions to view the process records include permissions for all process records related to a project to which the user is related, all such records that the user has created, all such records that a group the user belongs to have created, all such records that have been assigned to the user, and all such records that belong to an entity to which the user is related. The process records further include user-configurable fields. User permissions for the fields are provided according to group types which are related to groups to which the users belong. Included are permissions for inserting and deleting values in the user-configurable fields which are separate from the permission to edit the values.
1. A process control system that includes a processor and a data storage device accessible to the processor, the processor executing a relational database system that has tables stored in the storage device and the process control system comprising:
tables in the relational database system that
relate a set of process-related records that are used to control processes to a set of users of the process control system, a particular user having one or more relationships to a particular process-related record, a relationship of the relationships being specified by a value in the particular process-related record, and that
relate users of the set of users to one or more permissions, each permission permitting a user who has a particular relationship to a particular process-related record to view the particular process related record;
the process control system permitting the particular user to view the particular process-related record only if there is a combination of the permissions related to the particular user and the relationships which the particular user has with the particular process-related record such that the particular user is permitted to view the particular process-related record,
the one or more particular relationships by which a particular user is relatable to a particular process-related record including
being a member of a project to which the particular process-related record is related,
being a creator of the particular process related record,
being a member of a group of users which includes the creator of the particular process-related record,
being a user to whom the particular process-related record has been assigned, or
being a user who belongs to an entity that is related to the particular process-related record; and
the one or more permissions including
a project permission that indicates that a user is permitted to view process-related records that are related to a project to which the user belongs,
a group created permission that indicates that a user is permitted to view process-related records that were created by a user group to which the user belongs,
a created permission that indicates that a user is permitted to view process-related records that were created by the user,
an assigned permission that indicates that a user is permitted to view process-related record that are assigned to the user, or
an entity permission for a user who belongs to an entity that is related to the process-related record.
2. The process control system set forth in claim 1 further comprising:
a graphical user interface whereby an administrator of the process control system specifies the one or more permissions with which a particular user is related.
3. A configurable system that includes a processor and a data storage device accessible to the processor, the processor executing a relational database system that has tables stored in the storage device and the configurable system comprising:
a relational database system having tables that relate
a plurality of users of the configurable system to a group belonging to one of a plurality of group categories and
relate the group category to a user-configurable field of a plurality of kinds of user-configurable fields and to a set of permissions, the set of permissions specifying independently whether a user who belongs to the group that belongs to the group category can
insert a value into the user-configurable field or
delete a value from the user-configurable field
or edit the value in the user-configurable field,
the configurable system permitting a user belonging to a group that belongs to a particular group category to insert a value into or delete a value from a particular user-configurable field that is related to the particular group category or edit the value of the particular user-configurable field as determined by the permission for the particular group category and particular user-configurable field and the plurality of kinds of user configurable fields including a kind in which
the user-configurable field is permitted to have a single value,
prior to insertion of the single value, the user-configurable field has a null value, and
after deletion of the single value, the user-configurable field has a null value.
4. The configurable system set forth in claim 3 wherein the plurality of kinds of user-configurable fields further includes a kind in which:
the value is an identifier that identifies an editable file; and
the permissions do not permit the user to edit the file identified by the identifier.
5. The configurable system set forth in claim 4 wherein:
the edit permission permits the user to edit the file identified by the identifier.
6. The configurable system set forth in claim 3 wherein:
the plurality of kinds of user-configurable fields further includes a kind in which:
the user-configurable field is permitted to have zero or more values;
inserting a value adds a value to the user-configurable field; and
deleting a value deletes a value from the user-configurable field.
7. The configurable system set forth in claim 3 further comprising:
a graphical user interface whereby an administrator of the process control system sets one or more of the permissions for a group category and a user-configured field related to the group category.