Method evaluatePolicies

pkg/security/access_control.go:618–652

evaluatePolicies 评估策略

(userID, resource, action string, context map[string]any)

// evaluatePolicies 评估策略
func (ac *AccessController) evaluatePolicies(userID, resource, action string, context map[string]any) *AccessDecision {
	var applicablePolicies []*AccessPolicy

	// 收集适用的策略
	for _, policy := range ac.policies {
		if !policy.Enabled {
			continue
		}

		if ac.policyApplies(policy, userID, resource, action, context) {
			applicablePolicies = append(applicablePolicies, policy)
		}
	}

	if len(applicablePolicies) == 0 {
		return nil
	}

	// 按优先级排序
	sortedPolicies := ac.sortPoliciesByPriority(applicablePolicies)

	// 应用策略
	for _, policy := range sortedPolicies {
		if ac.evaluatePolicyConditions(policy.Conditions, userID, resource, action, context) {
			return &AccessDecision{
				Allowed:  policy.Effect == PolicyEffectAllow,
				Effect:   policy.Effect,
				Reason:   fmt.Sprintf("Policy %s (%s) applies", policy.ID, policy.Name),
				Policies: []string{policy.ID},
			}
		}
	}

	return nil
}

// policyApplies 检查策略是否适用
func (ac *AccessController) policyApplies(policy *AccessPolicy, userID, resource, action string, context map[string]any) bool {