Method matchesQuery

pkg/security/audit.go:545–586

matchesQuery 检查事件是否匹配查询条件

(event *AuditEvent, query *AuditQuery)

// matchesQuery 检查事件是否匹配查询条件
func (al *InMemoryAuditLog) matchesQuery(event *AuditEvent, query *AuditQuery) bool {
	// 时间范围过滤
	if query.TimeRange != nil {
		if event.Timestamp.Before(query.TimeRange.Start) || event.Timestamp.After(query.TimeRange.End) {
			return false
		}
	}

	// 类型过滤
	if len(query.Types) > 0 && !containsAuditType(query.Types, event.Type) {
		return false
	}

	// 严重级别过滤
	if len(query.Severities) > 0 && !containsAuditSeverity(query.Severities, event.Severity) {
		return false
	}

	// 用户过滤
	if len(query.Users) > 0 && !containsString(query.Users, event.UserID) {
		return false
	}

	// 资源过滤
	if len(query.Resources) > 0 && !containsString(query.Resources, event.Resource) {
		return false
	}

	// 操作过滤
	if len(query.Actions) > 0 && !containsString(query.Actions, event.Action) {
		return false
	}

	// 文本搜索
	if query.SearchText != "" {
		if !containsSearchText(event, query.SearchText) {
			return false
		}
	}

	return true
}

// sortEvents 排序事件
func (al *InMemoryAuditLog) sortEvents(events []*AuditEvent, orderBy string, desc bool) {