Method QueryEvents

pkg/security/audit.go:493–542

QueryEvents 查询事件

(ctx context.Context, query *AuditQuery)

// QueryEvents 查询事件
func (al *InMemoryAuditLog) QueryEvents(ctx context.Context, query *AuditQuery) (*AuditResult, error) {
	start := time.Now()

	al.mu.RLock()
	defer al.mu.RUnlock()

	var filteredEvents []*AuditEvent
	for i := range al.events {
		event := &al.events[i]
		if al.matchesQuery(event, query) {
			filteredEvents = append(filteredEvents, event)
		}
	}

	// 应用排序
	if query.OrderBy != "" {
		al.sortEvents(filteredEvents, query.OrderBy, query.OrderDesc)
	}

	// 应用分页
	total := int64(len(filteredEvents))
	offset := query.Offset
	if offset < 0 {
		offset = 0
	}
	limit := query.Limit
	if limit <= 0 {
		limit = 100
	}

	var events []*AuditEvent
	if offset < len(filteredEvents) {
		end := offset + limit
		if end > len(filteredEvents) {
			end = len(filteredEvents)
		}
		events = filteredEvents[offset:end]
	} else {
		events = []*AuditEvent{}
	}

	return &AuditResult{
		Events:    events,
		Total:     total,
		Offset:    offset,
		Limit:     limit,
		HasMore:   int64(offset+limit) < total,
		QueryTime: time.Since(start),
	}, nil
}

// matchesQuery 检查事件是否匹配查询条件
func (al *InMemoryAuditLog) matchesQuery(event *AuditEvent, query *AuditQuery) bool {