Method CheckPermission

pkg/security/access_control.go:521–615

CheckPermission 检查用户权限

(userID, resource, action string, context map[string]any)

// CheckPermission 检查用户权限
func (ac *AccessController) CheckPermission(userID, resource, action string, context map[string]any) (*AccessDecision, error) {
	start := time.Now()

	// 检查缓存
	cacheKey := ac.generateCacheKey(userID, resource, action, context)
	if ac.cache != nil {
		if entry := ac.cache.get(cacheKey); entry != nil {
			decision := entry.decision
			decision.CacheHit = true
			decision.DecisionTime = time.Since(start)
			return decision, nil
		}
	}

	ac.mu.RLock()
	defer ac.mu.RUnlock()

	user, exists := ac.users[userID]
	if !exists {
		return &AccessDecision{
			Allowed:      false,
			Effect:       PolicyEffectDeny,
			Reason:       "User not found",
			DecisionTime: time.Since(start),
			EvaluatedAt:  time.Now(),
			Context:      context,
		}, nil
	}

	if !user.Enabled || user.Status != UserStatusActive {
		return &AccessDecision{
			Allowed:      false,
			Effect:       PolicyEffectDeny,
			Reason:       "User is disabled or inactive",
			DecisionTime: time.Since(start),
			EvaluatedAt:  time.Now(),
			Context:      context,
		}, nil
	}

	decision := &AccessDecision{
		Allowed:      false,
		Effect:       PolicyEffectDeny,
		Reason:       "Access denied",
		Roles:        user.Roles,
		DecisionTime: time.Since(start),
		EvaluatedAt:  time.Now(),
		Context:      context,
	}

	// 1. 检查显式策略
	policyDecision := ac.evaluatePolicies(userID, resource, action, context)
	if policyDecision != nil {
		decision.Allowed = policyDecision.Allowed
		decision.Effect = policyDecision.Effect
		decision.Reason = policyDecision.Reason
		decision.Policies = policyDecision.Policies
	} else {