RevokeRole 撤销用户角色
(userID, roleID string)
| 481 | |
| 482 | // RevokeRole 撤销用户角色 |
| 483 | func (ac *AccessController) RevokeRole(userID, roleID string) error { |
| 484 | ac.mu.Lock() |
| 485 | defer ac.mu.Unlock() |
| 486 | |
| 487 | user, exists := ac.users[userID] |
| 488 | if !exists { |
| 489 | return fmt.Errorf("user %s not found", userID) |
| 490 | } |
| 491 | |
| 492 | // 从用户的角色列表中移除 |
| 493 | user.Roles = removeString(user.Roles, roleID) |
| 494 | user.UpdatedAt = time.Now() |
| 495 | |
| 496 | // 更新用户角色索引 |
| 497 | if userRoles, exists := ac.userRoles[userID]; exists { |
| 498 | ac.userRoles[userID] = removeString(userRoles, roleID) |
| 499 | } |
| 500 | |
| 501 | // 清除用户权限缓存 |
| 502 | delete(ac.userPermissions, userID) |
| 503 | |
| 504 | // 记录审计日志 |
| 505 | if ac.config.EnableAudit && ac.auditLog != nil { |
| 506 | _ = ac.auditLog.LogEvent(AuditEvent{ |
| 507 | Type: AuditTypeRoleRevoked, |
| 508 | UserID: userID, |
| 509 | Timestamp: time.Now(), |
| 510 | Message: fmt.Sprintf("Role %s revoked from user %s", roleID, user.Username), |
| 511 | Metadata: map[string]any{ |
| 512 | "role_id": roleID, |
| 513 | }, |
| 514 | }) |
| 515 | } |
| 516 | |
| 517 | return nil |
| 518 | } |
| 519 | |
| 520 | // CheckPermission 检查用户权限 |
| 521 | func (ac *AccessController) CheckPermission(userID, resource, action string, context map[string]any) (*AccessDecision, error) { |