Method AssignRole

pkg/security/access_control.go:434–480

AssignRole 为用户分配角色

(userID, roleID string)

// AssignRole 为用户分配角色
func (ac *AccessController) AssignRole(userID, roleID string) error {
	ac.mu.Lock()
	defer ac.mu.Unlock()

	user, exists := ac.users[userID]
	if !exists {
		return fmt.Errorf("user %s not found", userID)
	}

	role, exists := ac.roles[roleID]
	if !exists {
		return fmt.Errorf("role %s not found", roleID)
	}

	// 添加到用户的角色列表
	if !contains(user.Roles, roleID) {
		user.Roles = append(user.Roles, roleID)
		user.UpdatedAt = time.Now()
	}

	// 更新用户角色索引
	if _, exists := ac.userRoles[userID]; !exists {
		ac.userRoles[userID] = []string{}
	}
	if !contains(ac.userRoles[userID], roleID) {
		ac.userRoles[userID] = append(ac.userRoles[userID], roleID)
	}

	// 清除用户权限缓存
	delete(ac.userPermissions, userID)

	// 记录审计日志
	if ac.config.EnableAudit && ac.auditLog != nil {
		_ = ac.auditLog.LogEvent(AuditEvent{
			Type:      AuditTypeRoleAssigned,
			UserID:    userID,
			Timestamp: time.Now(),
			Message:   fmt.Sprintf("Role %s assigned to user %s", role.Name, user.Username),
			Metadata: map[string]any{
				"role_id":   roleID,
				"role_name": role.Name,
			},
		})
	}

	return nil
}

// RevokeRole 撤销用户角色
func (ac *AccessController) RevokeRole(userID, roleID string) error {