graph TD
    A[用户请求] --> B{策略决策点 PDP}
    B --> C[RBAC 基线角色]
    B --> D[ABAC 动态属性]
    B --> E[会话上下文 Context]
    C --> F[策略执行点 PEP]
    D --> F
    E --> F
    F --> G[允许/拒绝/受限]

// 权限原子定义（按业务域分段，预留扩展位）
enum PermissionBit {
  // 音视频域 (0-15)
  AUDIO_SELF_MUTE      = 0;   // 自我静音
  AUDIO_OTHERS_MUTE    = 1;   // 静音他人
  VIDEO_SELF_START     = 2;   // 开启摄像头
  VIDEO_LAYOUT_CONTROL = 3;   // 控制布局
  
  // 协作域 (16-31)
  SCREEN_SHARE         = 16;  // 屏幕共享
  WHITEBOARD_EDIT      = 17;  // 白板编辑
  FILE_UPLOAD          = 18;  // 文件上传
  CHAT_PUBLIC          = 19;  // 公开聊天
  CHAT_PRIVATE         = 20;  // 私聊
  
  // 管控域 (32-47)
  RECORD_START         = 32;  // 发起录制
  RECORD_DOWNLOAD      = 33;  // 下载录制
  KICK_PARTICIPANT     = 34;  // 移除参会者
  LOCK_MEETING         = 35;  // 锁定会议
  ASSIGN_CO_HOST       = 36;  // 指定联席主持
  
  // 数据域 (48-63)
  TRANSCRIPT_VIEW      = 48;  // 查看实时字幕
  TRANSCRIPT_EXPORT    = 49;  // 导出字幕
  AI_SUMMARY_ACCESS    = 50;  // 访问 AI 纪要
}

// 角色-权限位图映射（示例）
message RolePermissionBitmap {
  string role_id = 1;           // 角色标识
  uint64 permission_bitmap = 2; // 64位权限位图
  map<string, uint64> context_overrides = 3; // 上下文覆盖规则
}

# 策略 DSL 示例（基于 CEL - Common Expression Language）
policies = [
    # 规则：外部用户在保密会议中仅可观看，不可发言/共享
    {
        "effect": "DENY",
        "actions": ["AUDIO_SELF_START", "SCREEN_SHARE", "CHAT_PUBLIC"],
        "condition": """
            request.user.type == 'EXTERNAL' 
            && meeting.confidentiality == 'HIGH'
            && !request.user.has_tag('TRUSTED_PARTNER')
        """
    },
    # 规则：录制期间禁止新增参会者（防窃听）
    {
        "effect": "DENY",
        "actions": ["JOIN_MEETING"],
        "condition": "meeting.recording_status == 'ACTIVE'"
    },
    # 规则：议程切换至"财务报告"时，非财务部成员自动静音且屏蔽共享
    {
        "effect": "RESTRICT",
        "permissions": {"AUDIO_SELF_START": false, "SCREEN_SHARE": false},
        "condition": """
            meeting.current_agenda.topic == 'FINANCE_REPORT'
            && 'FINANCE_DEPT' not in request.user.departments
        """
    }
]

stateDiagram-v2
    [*] --> PRE_CHECK: 用户点击加入
    PRE_CHECK --> IDENTITY_VERIFY: 基础校验通过
    PRE_CHECK --> REJECT: 黑名单/设备禁用
    
    IDENTITY_VERIFY --> RISK_ASSESS: 实名/企业认证通过
    IDENTITY_VERIFY --> MANUAL_REVIEW: 高风险特征
    
    RISK_ASSESS --> AUTO_APPROVE: 风险分 < 30
    RISK_ASSESS --> MANUAL_REVIEW: 30 ≤ 风险分 < 70
    RISK_ASSESS --> REJECT: 风险分 ≥ 70
    
    MANUAL_REVIEW --> APPROVED: 主持人/联席通过
    MANUAL_REVIEW --> REJECTED: 主持人拒绝
    MANUAL_REVIEW --> TIMEOUT: 120s 无响应 → 拒绝
    
    AUTO_APPROVE --> IN_MEETING: 入会成功
    APPROVED --> IN_MEETING: 入会成功
    
    REJECT --> [*]
    REJECTED --> [*]
    TIMEOUT --> [*]
    IN_MEETING --> [*]: 会议结束/被移除

// 等候室实体
type WaitingRoomEntry struct {
    EntryID        string                 `json:"entry_id"`
    MeetingID      string                 `json:"meeting_id"`
    UserID         string                 `json:"user_id"`
    DeviceFingerprint string              `json:"device_fp"`
    IPAddress      string                 `json:"ip"`
    GeoLocation    GeoInfo                `json:"geo"`
    
    State          WaitingRoomState       `json:"state"` // 枚举：PRE_CHECK/IDENTITY_VERIFY/...
    RiskScore      int                    `json:"risk_score"` // 0-100
    RiskTags       []string               `json:"risk_tags"`  // ["VPN", "NEW_DEVICE", "ANONYMOUS"]
    
    RequestedAt    time.Time              `json:"requested_at"`
    StateChangedAt time.Time              `json:"state_changed_at"`
    ExpiresAt      time.Time              `json:"expires_at"` // 状态超时时间
    
    // 审批相关
    ReviewerID     string                 `json:"reviewer_id,omitempty"`
    ReviewReason   string                 `json:"review_reason,omitempty"`
    
    // 入会凭证（通过后颁发）
    JoinToken      string                 `json:"join_token,omitempty"`
    TokenExpiresAt time.Time              `json:"token_expires_at,omitempty"`
}

def calculate_risk_score(features: FeatureVector) -> int:
    # 基础加权分
    base_score = sum(w * normalize(f) for f, w in zip(features.values, WEIGHTS))
    
    # 非线性校准：高风险特征叠加放大
    if features.vpn and features.new_device:
        base_score *= 1.5
    if features.geo_anomaly and features.high_freq:
        base_score *= 1.3
    
    # 映射到 0-100
    return min(100, int(sigmoid(base_score) * 100))

func (w *WaitingRoomService) routeToReviewer(entry *WaitingRoomEntry) (string, error) {
    meeting := w.meetingRepo.Get(entry.MeetingID)
    
    // 优先级：联席主持 > 主持人 > 指定审批人 > 部门负责人 > 系统默认
    candidates := []string{}
    
    // 1. 在线联席主持
    candidates = append(candidates, meeting.GetOnlineCoHosts()...)
    
    // 2. 在线主持人
    if meeting.HostOnline {
        candidates = append(candidates, meeting.HostID)
    }
    
    // 3. 会议预设审批人
    candidates = append(candidates, meeting.Approvers...)
    
    // 4. 申请人直属领导（组织架构查询）
    if manager := w.orgClient.GetManager(entry.UserID); manager != "" {
        candidates = append(candidates, manager)
    }
    
    // 选择首个在线且未忙碌的审批人
    for _, uid := range candidates {
        if w.presenceClient.IsAvailable(uid) {
            return uid, nil
        }
    }
    
    // 兜底：系统机器人审批（按策略自动决策）
    return "SYSTEM_AUTO_REVIEWER", nil
}

// 权限版本向量
type PermissionVersionVector struct {
    MeetingID     string            `json:"meeting_id"`
    GlobalVersion uint64            `json:"global_version"` // 全局单调递增
    UserVersions  map[string]uint64 `json:"user_versions"`  // 各用户权限版本
    UpdatedAt     int64             `json:"updated_at"`
}

// 变更流程
func (s *PermissionService) RevokePermission(meetingID, userID string, perm PermissionBit) error {
    // 1. 本地计算新位图
    newBitmap := s.computeUserBitmap(meetingID, userID, perm, false)
    
    // 2. 生成新版本号（Snowflake ID 或 Hybrid Logical Clock）
    newVersion := s.clock.Next()
    
    // 3. 写入分布式缓存（Redis Cluster + Lua 原子脚本）
    luaScript := `
        local vv = cjson.decode(redis.call('GET', KEYS[1]))
        vv.global_version = tonumber(ARGV[1])
        vv.user_versions[ARGV[2]] = tonumber(ARGV[1])
        redis.call('SET', KEYS[1], cjson.encode(vv))
        redis.call('HSET', KEYS[2], ARGV[2], ARGV[3]) -- user_bitmap
        return vv.global_version
    `
    s.redis.Eval(luaScript, []string{vvKey, bitmapKey}, newVersion, userID, newBitmap)
    
    // 4. 发布增量变更事件（Kafka/NATS）
    s.eventBus.Publish(PermissionChangedEvent{
        MeetingID: meetingID,
        UserID:    userID,
        Version:   newVersion,
        Bitmap:    newBitmap,
        Op:        "REVOKE",
        Perm:      perm,
    })
    
    return nil
}

-- Redis Lua 脚本：原子化入队 + 幂等校验
local meeting_key = "waiting_room:" .. ARGV[1] -- meeting_id
local user_key = "waiting_room_user:" .. ARGV[1] .. ":" .. ARGV[2] -- meeting_id:user_id

-- 幂等检查
if redis.call('EXISTS', user_key) == 1 then
    return {0, "DUPLICATE", redis.call('GET', user_key)}
end

-- 容量检查
local max_wait = tonumber(ARGV[3]) -- 最大等候人数
local current = redis.call('XLEN', meeting_key)
if current >= max_wait then
    return {-1, "FULL", ""}
end

-- 生成入队票据
local entry_id = redis.call('INCR', "waiting_room_seq:" .. ARGV[1])
local ticket = cjson.encode({
    entry_id = entry_id,
    user_id = ARGV[2],
    priority = tonumber(ARGV[4]), -- 优先级：VIP/内部/外部
    ts = redis.call('TIME')[1]
})

-- 写入有序流（按优先级+时间排序）
redis.call('XADD', meeting_key, '*', 'data', ticket)
redis.call('SET', user_key, entry_id, 'EX', 3600) -- 1h 过期

-- 返回排队位置
local rank = redis.call('XRANK', meeting_key, entry_id)
return {1, "QUEUED", entry_id, rank + 1}

{
  "log_id": "audit_01H8X9K2M4N7P3Q6R9S2T5V8W1",
  "timestamp": "2024-01-15T14:32:18.123Z",
  "event_type": "PERMISSION_CHANGE",
  "actor": {
    "user_id": "u_12345",
    "role": "HOST",
    "ip": "203.0.113.45",
    "device_fp": "fp_abc123"
  },
  "target": {
    "user_id": "u_67890",
    "meeting_id": "m_98765"
  },
  "action": "REVOKE",
  "permission": "SCREEN_SHARE",
  "reason": "MEETING_POLICY: agenda switched to confidential",
  "before": {"bitmap": "0xFFFF0000FFFF0000", "version": 1024},
  "after":  {"bitmap": "0xFFFF0000FFFE0000", "version": 1025},
  "result": "SUCCESS",
  "risk_level": "LOW"
}

type DecisionExplanation struct {
    Decision   string            `json:"decision"` // APPROVE/REJECT/REVIEW
    Score      int               `json:"score"`
    Factors    []FactorDetail    `json:"factors"`
    PolicyHits []string          `json:"policy_hits"` // 命中的策略 ID
    Timestamp  time.Time         `json:"timestamp"`
}

type FactorDetail struct {
    Dimension   string  `json:"dimension"`   // identity/device/network/behavior/meeting
    Feature     string  `json:"feature"`     // 具体特征名
    Value       string  `json:"value"`       // 特征取值
    Weight      float64 `json:"weight"`      // 权重
    Contribution float64 `json:"contribution"` // 对最终分数贡献度
    Description string  `json:"description"` // 自然语言解释
}

// 权限指令装饰器（Vue 3 / React 通用设计思路）
interface PermissionBinding {
  // 所需权限位（支持组合：单个、数组、位图）
  perm: PermissionBit | PermissionBit[] | bigint;
  // 不满足时行为：hide(隐藏) | disable(置灰) | skeleton(骨架屏) | redirect(跳转)
  fallback?: 'hide' | 'disable' | 'skeleton' | 'redirect';
  // 自定义降级渲染函数
  renderFallback?: () => VNode;
  // 是否强制服务端二次校验（高危操作）
  strict?: boolean;
}

// 使用示例：屏幕共享按钮
<ScreenShareButton 
  v-permission="{ 
    perm: PermissionBit.SCREEN_SHARE, 
    fallback: 'disable', 
    strict: true,
    renderFallback: () => <Tooltip content="当前议程禁止共享"><LockIcon /></Tooltip>
  }" 
/>

sequenceDiagram
    participant Client as 客户端运行时
    participant WS as WebSocket 长连接
    participant Cache as 本地权限缓存
    participant UI as 组件树

    WS->>Client: 接收 PermissionDeltaEvent (v1025)
    Client->>Cache: 原子更新本地位图 (CAS 保证顺序)
    Client->>Client: 计算受影响组件集合 (依赖收集)
    Client->>UI: 批量触发响应式更新 (nextTick 合并)
    UI-->>User: 200ms 内完成控件置灰/隐藏

// 乐观执行 + 服务端兜底模式
async function handleStartRecording() {
  const localPerm = permissionStore.getBitmap();
  const required = PermissionBit.RECORD_START;
  
  // 1. 本地乐观检查（零延迟响应）
  if (!hasPermission(localPerm, required)) {
    return showToast('无录制权限');
  }
  
  // 2. 发起请求携带客户端已知版本号
  try {
    const resp = await api.startRecording({
      meetingId: currentMeeting.id,
      clientKnownVersion: permissionStore.globalVersion // 乐观锁版本
    });
    // 成功：更新本地版本，进入录制态
    permissionStore.updateVersion(resp.serverVersion);
    recordingStore.setActive(true);
  } catch (err) {
    if (err.code === 'VERSION_CONFLICT' || err.code === 'PERMISSION_DENIED') {
      // 3. 冲突：强制拉取最新权限，回滚 UI
      await permissionStore.forceSync();
      showToast(err.message || '权限已变更，操作失败');
    } else {
      throw err; // 网络错误等上抛
    }
  }
}

graph LR
    subgraph Tenant_A [租户 A - 发起方]
        Host[主持人] -->|邀请链接| InviteSvc[邀请服务]
    end
    
    subgraph IdP_B [租户 B / 外部 IdP - 身份源]
        ExtUser[外部用户] -->|SSO 登录| IdP_B
    end
    
    subgraph Meeting_Plane [会议控制平面 - 中立域]
        InviteSvc -->|颁发受限凭证| TokenSvc[联邦令牌服务]
        IdP_B -->|SAML/OIDC 断言| TokenSvc
        TokenSvc -->|映射为虚拟身份| VirtualUser[(虚拟用户池)]
        VirtualUser --> PDB[(策略决策点 PDP)]
    end

{
  "federated_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "claims": {
    "sub": "ext_user_12345@partner-b.com",      // 原始身份标识
    "federated_identity": {
      "source_tenant": "tenant_b",
      "source_idp": "okta",
      "assurance_level": "LOA3"                // 认证保障等级
    },
    "virtual_meeting_id": "vm_u_98765",        // 会议域内虚拟 ID
    "granted_roles": ["GUEST_SPEAKER"],        // 会议侧映射角色
    "constraints": {                           // 硬性约束（不可覆盖）
      "max_duration_min": 60,
      "allowed_agendas": ["AGENDA_3", "AGENDA_5"],
      "data_egress": "NONE",                   // 禁止导出/下载/录屏
      "watermark_policy": "FULL_SCREEN_DYNAMIC"
    },
    "exp": 1705324800,
    "nbf": 1705321200
  }
}

// 会议平面 PDP 向外部租户 PDP 发起子查询
message PolicyQueryRequest {
  string principal_id = 1;          // 虚拟用户 ID
  string resource_id = 2;           // 会议资源 ID
  repeated string actions = 3;      // 待校验动作列表
  map<string, string> context = 4;  // 环境上下文
  uint32 timeout_ms = 5;            // 严格超时控制 (建议 50ms)
}

message PolicyQueryResponse {
  enum Decision { PERMIT = 0; DENY = 1; INDETERMINATE = 2; }
  Decision decision = 1;
  map<string, string> obligations = 2; // 附加义务 (如: 强制水印、审计日志标记)
  string policy_version = 3;           // 外部策略版本，用于缓存失效
  string advice = 4;                   // 给用户的建议文案
}

# NL2Policy Pipeline
class NL2PolicyConverter:
    def __init__(self, llm_client, policy_validator):
        self.llm = llm_client
        self.validator = policy_validator
    
    def convert(self, natural_language: str, meeting_context: MeetingContext) -> PolicyDraft:
        prompt = f"""
        角色：视频会议安全策略工程师
        上下文：当前会议 {meeting_context.id}，议程 {meeting_context.agenda_tree}，参会人员部门分布 {meeting_context.dept_dist}
        任务：将以下自然语言转换为结构化 CEL 策略，输出 JSON，包含 effect, actions, condition, obligations。
        约束：1. 仅使用白名单内的属性和函数 2. 条件表达式必须可静态分析 3. 禁止生成循环/递归逻辑
        输入：{natural_language}
        """
        raw_output = self.llm.generate(prompt, temperature=0.1)
        draft = PolicyDraft.parse_raw(raw_output)
        
        # 静态分析校验：语法、类型、属性存在性、复杂度
        validation_result = self.validator.validate(draft, meeting_context.schema)
        if not validation_result.passed:
            raise PolicyCompilationError(validation_result.errors)
        
        return draft

{
  "id": "ai_gen_20240115_001",
  "name": "财务汇报环节管控",
  "trigger": { "type": "AGENDA_START", "agenda_id": "AGENDA_FINANCE_Q4" },
  "rules": [
    {
      "effect": "PERMIT",
      "actions": ["AUDIO_SELF_START", "VIDEO_SELF_START", "SCREEN_SHARE_VIEW"],
      "condition": "principal.dept == 'FINANCE' || principal.role == 'EXECUTIVE'"
    },
    {
      "effect": "DENY",
      "actions": ["AUDIO_SELF_START", "SCREEN_SHARE_START"],
      "condition": "principal.dept != 'FINANCE' && principal.role != 'EXECUTIVE'"
    },
    {
      "effect": "OBLIGATE",
      "obligations": ["WATERMARK_DYNAMIC:{text:'{principal.employee_id}'}"],
      "condition": "true"
    }
  ],
  "rollback_trigger": { "type": "AGENDA_END", "agenda_id": "AGENDA_FINANCE_Q4" }
}

-- Flink SQL 定义会中行为流特征窗口
CREATE TABLE meeting_behavior_stream (
    meeting_id STRING,
    user_id STRING,
    action_type STRING,      -- JOIN, SPEAK_START, SHARE_START, CHAT, REQUEST_CONTROL
    action_ts TIMESTAMP(3),
    metadata MAP<STRING, STRING>,
    WATERMARK FOR action_ts AS action_ts - INTERVAL '5' SECOND
);

-- 滑动窗口聚合特征 (1分钟窗口，10秒滑动)
CREATE VIEW user_behavior_features AS
SELECT 
    meeting_id,
    user_id,
    TUMBLE_START(action_ts, INTERVAL '1' MINUTE) AS window_start,
    COUNT(*) AS action_freq,
    COUNT(DISTINCT action_type) AS action_diversity,
    SUM(CASE WHEN action_type = 'REQUEST_CONTROL' THEN 1 ELSE 0 END) AS control_attempts,
    MAX(CASE WHEN metadata['target_user'] IS NOT NULL THEN 1 ELSE 0 END) AS has_targeted_action,
    -- 设备/网络漂移特征
    COUNT(DISTINCT metadata['device_fp']) AS device_changes,
    COUNT(DISTINCT metadata['ip']) AS ip_changes
FROM meeting_behavior_stream
GROUP BY meeting_id, user_id, TUMBLE(action_ts, INTERVAL '1' MINUTE);

def recommend_least_privilege_role(user_id: str, meeting_type: str) -> RoleRecommendation:
    # 1. 获取用户近 90 天同类会议的实际使用权限
    used_perms = audit_log.query_used_permissions(user_id, meeting_type, days=90)
    
    # 2. 计算权限必要性得分
    necessity_scores = {}
    for perm in ALL_PERMISSIONS:
        freq = used_perms.get(perm, 0) / max(1, total_meetings)
        # 结合同岗位人群使用情况
        peer_freq = peer_group_stats[user_role].get(perm, 0)
        necessity_scores[perm] = 0.7 * freq + 0.3 * peer_freq
    
    # 3. 匹配现有角色库，寻找覆盖必要权限且冗余最小的角色
    best_role = min(
        ROLE_LIBRARY.values(),
        key=lambda r: calculate_redundancy(r.bitmap, necessity_scores, threshold=0.6)
    )
    
    # 4. 生成差异报告
    current_role = get_current_role(user_id)
    diff = bitmap_diff(current_role.bitmap, best_role.bitmap)
    
    return RoleRecommendation(
        recommended_role=best_role.id,
        reason=f"可移除 {len(diff.redundant)} 项冗余权限，补充 {len(diff.missing)} 项高频权限",
        risk_reduction_score=calculate_risk_reduction(diff.redundant),
        auto_apply_eligible=len(diff.missing) == 0  # 仅收权可自动化，增权需审批
    )

# 批量探测存活会议
for i in {100000000..999999999}; do
  curl -s "https://api.meet.com/v1/meetings/$i/join" -H "Authorization: Bearer $GUEST_TOKEN" | grep -q '"status":"OK"' && echo "FOUND: $i"
done

// 客户端状态机
type PermissionSyncState struct {
    LocalVersion   uint64
    ExpectedVersion uint64 // 期望下一个版本
    PendingDeltas  []PermissionDelta // 乱序缓冲区
    mu sync.Mutex
}

func (s *PermissionSyncState) ApplyDelta(delta PermissionDelta) error {
    s.mu.Lock()
    defer s.mu.Unlock()
    
    if delta.Version == s.ExpectedVersion {
        // 理想路径：按序应用
        s.applyAndUpdate(delta)
        s.drainPending() // 处理缓冲区后续连续版本
        return nil
    } else if delta.Version > s.ExpectedVersion {
        // 乱序/丢包：缓存，触发全量补偿
        s.PendingDeltas = insertSorted(s.PendingDeltas, delta)
        go s.requestFullSync(s.LocalVersion) // 异步请求全量快照
        return ErrVersionGap
    } else {
        // 旧版本重复包，丢弃
        return ErrStaleVersion
    }
}

// 服务端增量广播带前序版本号，客户端可验证链完整性
type PermissionDelta struct {
    PrevVersion uint64 `json:"prev_ver"` // 必须等于客户端当前版本
    Version     uint64 `json:"ver"`
    Bitmap      uint64 `json:"bmp"`
    Signature   string `json:"sig"`      // Ed25519 签名，防篡改
}

// 审批通过时，颁发短时效、单次使用、绑定设备的 Join Ticket
func (s *WaitingRoomService) Approve(entryID, reviewerID string) (string, error) {
    entry := s.repo.Get(entryID)
    if entry.State != STATE_MANUAL_REVIEW {
        return "", ErrInvalidState
    }
    
    // 生成 JWT Ticket，载荷包含会议权限基线版本
    ticket := jwt.NewWithClaims(jwt.SigningMethodES256, JoinTicketClaims{
        StandardClaims: jwt.StandardClaims{
            ExpiresAt: time.Now().Add(30 * time.Second).Unix(), // 30s 有效期
            Id:        uuid.NewString(),                          // JTI 防重放
        },
        MeetingID:     entry.MeetingID,
        UserID:        entry.UserID,
        DeviceFP:      entry.DeviceFingerprint, // 绑定设备
        PermissionVer: entry.MeetingPermissionVersion, // 绑定权限版本
        Role:          entry.AssignedRole,    // 审批时指定的角色
    })
    
    signedTicket, _ := ticket.SignedString(s.privateKey)
    
    // 原子更新状态 + 存储 JTI 防重放
    s.repo.AtomicApprove(entryID, signedTicket)
    
    // 推送给客户端（WebSocket / 长轮询）
    s.pushClient.Send(entry.UserID, WaitingRoomResult{
        Status: "APPROVED",
        JoinTicket: signedTicket,
    })
    return signedTicket, nil
}

// 入会接口强制校验 Ticket
func (s *MeetingService) Join(meetingID, ticket string) error {
    claims, err := s.validateJoinTicket(ticket)
    if err != nil { return ErrInvalidTicket }
    
    // 校验设备指纹一致性
    if claims.DeviceFP != getCurrentDeviceFP() {
        return ErrDeviceMismatch
    }
    
    // 校验权限版本未过期（防止审批后权限被收回仍能入会）
    if claims.PermissionVer < s.getCurrentPermissionVersion(meetingID) {
        return ErrPermissionStale
    }
    
    // 标记 JTI 已使用（Redis SETNX EX 30s）
    if !s.redis.SetNX("used_ticket:"+claims.Id, "1", 30*time.Second).Val() {
        return ErrTicketReused
    }
    
    return s.grantAccess(claims)
}

// SFU 媒体节点入口：强制校验权限 Token
func (s *SFUServer) HandleOffer(session *Session, offer *sdp.SessionDescription) error {
    // 1. 解析 SDP 中的媒体类型与方向
    mediaTracks := parseMediaTracks(offer)
    
    for _, track := range mediaTracks {
        if track.Kind == "video" && track.ContentHint == "screen" {
            // 2. 校验当前会话权限上下文（从 Redis 实时读取）
            permBitmap := s.permCache.Get(session.MeetingID, session.UserID)
            if !hasPermission(permBitmap, PermissionBit.SCREEN_SHARE) {
                log.Warn("Screen share denied by PDP", "user", session.UserID)
                return ErrPermissionDenied // 直接拒绝 Offer
            }
            
            // 3. 记录审计：屏幕共享启动
            s.auditLog.ScreenShareStart(session.MeetingID, session.UserID, track.Mid)
        }
    }
    
    // 4. 正常转发给其他参会者
    return s.forwardOffer(session, offer)
}

// 客户端发起共享前，必须先通过 HTTP API 申请“共享租约”
func (c *Client) RequestScreenShareLease() (string, error) {
    resp, err := c.http.Post("/api/v1/meetings/"+c.meetingID+"/screen-share/lease", nil)
    // 服务端校验权限、并发限制（同一会议仅允许 N 路共享）、返回签名租约
    return resp.LeaseToken, err
}

# 录制文件访问网关
class RecordingAccessGateway:
    def generate_download_url(self, user_id: str, recording_id: str, ttl: int = 300) -> str:
        # 1. 校验权限：是否参会、是否有 RECORD_DOWNLOAD 权限、会议保密等级
        if not self.pdp.check(user_id, recording_id, PermissionBit.RECORD_DOWNLOAD):
            raise PermissionDenied()
        
        # 2. 生成一次性、短时效、绑定上下文的签名 URL
        policy = {
            "Statement": [{
                "Resource": f"arn:oss:::recordings/{recording_id}/*",
                "Action": "oss:GetObject",
                "Effect": "Allow",
                "Condition": {
                    "IpAddress": {"oss:SourceIp": get_client_ip()},      # 绑定 IP
                    "StringEquals": {"oss:UserAgent": get_ua_hash()},    # 绑定 UA 指纹
                    "NumericLessThan": {"oss:CurrentTime": now() + ttl}  # 绝对过期时间
                }
            }]
        }
        
        # 3. 记录审计：谁在何时申请了下载
        self.audit.log(DataAccessEvent{
            UserID: user_id,
            Resource: recording_id,
            Action: "GENERATE_DOWNLOAD_URL",
            Policy: policy,
        })
        
        return self.oss.sign_url(policy, ttl)
    
    # 对象存储侧配置 Bucket Policy：拒绝所有非网关签名的请求
    # 仅允许网关服务角色 (RAM Role) 执行 PutObject / SignPolicy