Method CreateSession

pkg/security/access_control.go:856–922

CreateSession 创建会话

(userID, ipAddress, userAgent string)

// CreateSession 创建会话
func (ac *AccessController) CreateSession(userID, ipAddress, userAgent string) (*Session, error) {
	ac.mu.Lock()
	defer ac.mu.Unlock()

	user, exists := ac.users[userID]
	if !exists {
		return nil, fmt.Errorf("user %s not found", userID)
	}

	if !user.Enabled || user.Status != UserStatusActive {
		return nil, fmt.Errorf("user %s is not active", userID)
	}

	// 检查会话数量限制
	if ac.config.MaxSessionsPerUser > 0 {
		activeSessions := 0
		for _, session := range ac.sessions {
			if session.UserID == userID && session.Status == SessionStatusActive {
				activeSessions++
			}
		}
		if activeSessions >= ac.config.MaxSessionsPerUser {
			return nil, fmt.Errorf("user %s has reached maximum sessions limit", userID)
		}
	}

	sessionID := ac.generateSessionID(userID, ipAddress, userAgent)
	expiresAt := time.Now().Add(ac.config.SessionTimeout)

	session := &Session{
		ID:           sessionID,
		UserID:       userID,
		Username:     user.Username,
		Roles:        user.Roles,
		Permissions:  ac.getUserPermissions(userID),
		IPAddress:    ipAddress,
		UserAgent:    userAgent,
		Status:       SessionStatusActive,
		CreatedAt:    time.Now(),
		LastActivity: time.Now(),
		ExpiresAt:    expiresAt,
	}

	ac.sessions[sessionID] = session

	// 更新用户最后登录时间
	now := time.Now()
	user.LastLogin = &now
	user.UpdatedAt = now

	// 记录审计日志
	if ac.config.EnableAudit && ac.auditLog != nil {
		_ = ac.auditLog.LogEvent(AuditEvent{
			Type:      AuditTypeSessionCreated,
			UserID:    userID,
			Timestamp: time.Now(),
			Message:   fmt.Sprintf("Session %s created for user %s", sessionID, user.Username),
			Metadata: map[string]any{