┌─────────────────────────────────────────────────────────────┐
│                    智能视频会议 ZTNA 安全平面                  │
├─────────────────────────────────────────────────────────────┤
│  接入层：ZTNA Client / 浏览器插件 / 移动端 SDK                │
├─────────────────────────────────────────────────────────────┤
│  策略决策层：PDP (Policy Decision Point)                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐           │
│  │ 姿态评估引擎 │  │ 风险计算引擎 │  │ 策略编排引擎 │           │
│  └─────────────┘  └─────────────┘  └─────────────┘           │
├─────────────────────────────────────────────────────────────┤
│  数据平面：PEP (Policy Enforcement Point)                     │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐           │
│  │ 会议网关    │  │ 媒体转发节点 │  │ 录制/存储代理│           │
│  └─────────────┘  └─────────────┘  └─────────────┘           │
├─────────────────────────────────────────────────────────────┤
│  观测与反馈：遥测采集 → 流式计算 → 模型训练 → 策略热更新        │
└─────────────────────────────────────────────────────────────┘

{
  "device_id": "sha256:hardware_fingerprint",
  "platform": "windows|macos|linux|ios|android",
  "os_version": "10.0.19045",
  "patch_level": "2024-01-09",
  "security_controls": {
    "edr_running": true,
    "edr_version": "7.2.1",
    "disk_encryption": "bitlocker|filevault|luks",
    "screen_lock": true,
    "biometric_enrolled": true,
    "firewall_enabled": true
  },
  "compliance": {
    "mdm_managed": true,
    "jailbreak_root": false,
    "debug_mode": false,
    "developer_mode": false,
    "unknown_sources": false
  },
  "vulnerability": {
    "critical_count": 0,
    "high_count": 2,
    "last_scan": "2024-01-15T08:30:00Z"
  },
  "network": {
    "interface_type": "wifi|ethernet|cellular",
    "dns_sec": true,
    "vpn_active": false,
    "public_ip_reputation": "clean"
  },
  "behavioral": {
    "process_anomaly_score": 0.12,
    "network_anomaly_score": 0.05,
    "credential_access_alerts": 0
  },
  "timestamp": "2024-01-15T10:22:13Z",
  "signature": "ed25519:..."
}

stateDiagram-v2
    [*] --> 初始接入评估
    初始接入评估 --> 会话中持续评估
    会话中持续评估 --> 定期重评估: 300s 定时器
    会话中持续评估 --> 事件驱动重评估: 姿态变更事件
    会话中持续评估 --> 会话结束
    事件驱动重评估 --> 会话中持续评估
    定期重评估 --> 会话中持续评估

message MeetingCapability {
  // 媒体流权限
  enum MediaPermission { FULL_DUPLEX = 0; AUDIO_ONLY = 1; VIEW_ONLY = 2; DENY = 3; }
  MediaPermission audio = 1;
  MediaPermission video = 2;
  MediaPermission screen_share = 3;
  
  // 交互权限
  bool can_chat = 4;
  bool can_annotate = 5;
  bool can_remote_control = 6;
  bool can_raise_hand = 7;
  
  // 数据权限
  enum RecordingPermission { NONE = 0; VIEW = 1; DOWNLOAD = 2; MANAGE = 3; }
  RecordingPermission recording = 8;
  bool can_export_attendee_list = 9;
  bool can_access_meeting_ai_summary = 10;
  
  // 管理权限
  bool can_mute_others = 11;
  bool can_remove_attendee = 12;
  bool can_lock_meeting = 13;
  bool can_change_presenter = 14;
  
  // 网络/传输约束
  enum QualityTier { HIGH = 0; BALANCED = 1; LOW_BANDWIDTH = 2; AUDIO_FALLBACK = 3; }
  QualityTier max_quality = 15;
  bool force_relay = 16;  // 强制走 TURN/中继，禁用 P2P
  bool encrypt_media_keys = 17; // 端到端加密密钥是否下发
}

package meeting.authz

# 默认拒绝
default allow = false
default capabilities = {}

# 可信设备 + 企业内网 + 主持人/联席主持人
allow {
    input.device.trust_level == "TRUSTED"
    input.network.zone == "CORPORATE"
    input.user.role in ["HOST", "CO_HOST"]
    capabilities = trusted_host_caps
}

# 可信设备 + 参会者
allow {
    input.device.trust_level == "TRUSTED"
    input.user.role == "ATTENDEE"
    capabilities = trusted_attendee_caps
}

# 低风险设备：降级媒体质量、禁用录制下载
allow {
    input.device.trust_level == "LOW_RISK"
    capabilities = low_risk_caps
}

# 中风险：仅音频、屏幕共享只读、禁用标注/远控
allow {
    input.device.trust_level == "MEDIUM_RISK"
    capabilities = medium_risk_caps
}

# 高风险：仅观看模式
allow {
    input.device.trust_level == "HIGH_RISK"
    capabilities = high_risk_caps
}

# 拒绝设备
allow = false {
    input.device.trust_level == "DENY"
}

# 能力集定义
trusted_host_caps = {
    "audio": "FULL_DUPLEX", "video": "FULL_DUPLEX", "screen_share": "FULL_DUPLEX",
    "can_chat": true, "can_annotate": true, "can_remote_control": true,
    "recording": "MANAGE", "can_export_attendee_list": true,
    "max_quality": "HIGH", "force_relay": false, "encrypt_media_keys": true
}

low_risk_caps = trusted_host_caps with {
    "recording": "VIEW"
    "max_quality": "BALANCED"
}

medium_risk_caps = {
    "audio": "FULL_DUPLEX", "video": "VIEW_ONLY", "screen_share": "VIEW_ONLY",
    "can_chat": true, "can_annotate": false, "can_remote_control": false,
    "recording": "NONE", "max_quality": "LOW_BANDWIDTH", "force_relay": true
}

high_risk_caps = {
    "audio": "VIEW_ONLY", "video": "VIEW_ONLY", "screen_share": "VIEW_ONLY",
    "can_chat": false, "recording": "NONE", "max_quality": "AUDIO_FALLBACK",
    "force_relay": true, "encrypt_media_keys": false
}

用户加入会议请求
       │
       ▼
┌──────────────────┐
│  PEP (会议网关)   │──► 缓存命中？ ──是──► 返回缓存能力集
└──────────────────┘      │
       │ 否              │
       ▼                 │
┌──────────────────┐     │
│  PDP 决策请求     │     │
│  (gRPC, <50ms)   │     │
└────────┬─────────┘     │
         │               │
         ▼               │
┌──────────────────┐     │
│  姿态评估引擎     │     │
│  (实时获取最新)   │     │
└────────┬─────────┘     │
         │               │
         ▼               │
┌──────────────────┐     │
│  风险计算 + 策略  │     │
│  匹配 → 能力集    │     │
└────────┬─────────┘     │
         │               │
         ▼               │
┌──────────────────┐     │
│  下发决策 + TTL   │─────┘ (缓存 60s)
│  (含降级/升级指令)│
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│  PEP 强制执行    │
│  - SDP 重写      │
│  - TURN 强制中继 │
│  - 信令层权限校验│
│  - 录制代理拦截  │
└──────────────────┘

{
  "event_id": "uuid-v7",
  "timestamp": "2024-01-15T10:22:13.123Z",
  "event_type": "AUTHZ_DECISION",
  "meeting_id": "m_abc123",
  "user_id": "u_456",
  "device_id": "d_sha256...",
  "request": { "action": "JOIN_MEETING", "requested_caps": [...] },
  "decision": { "allow": true, "capabilities": {...}, "trust_level": "LOW_RISK", "risk_score": 42 },
  "policy_version": "v2024.01.15-rc3",
  "posture_snapshot": { ... },
  "enforcement_points": ["gateway-east-1", "media-node-3", "recording-proxy-2"],
  "latency_ms": { "posture_fetch": 3, "policy_eval": 1.2, "total": 18 }
}

// 内部 SDK 伪代码：SDP 重写核心逻辑
func (g *MediaGateway) RewriteSDP(ctx context.Context, rawSDP string, caps *CapabilitySet) (string, error) {
    session, err := sdp.ParseString(rawSDP)
    if err != nil { return "", err }

    // 1. 方向控制：根据 caps 重写 a=sendrecv/sendonly/recvonly/inactive
    for _, m := range session.MediaDescriptions {
        dir := mediaDirectionFromCaps(m.MediaName.Media, caps)
        m.Attributes = upsertAttribute(m.Attributes, "sendrecv", dir)
    }

    // 2. 编码器降级：移除不被允许的高清/高帧率 codec (H.264 High Profile -> Baseline, VP9 -> VP8)
    for _, m := range session.MediaDescriptions {
        m.MediaName.Formats = filterCodecsByQualityTier(m.MediaName.Formats, caps.MaxQuality)
    }

    // 3. 强制中继：若 caps.ForceRelay=true，剥离所有 candidate，仅保留 TURN 服务器地址
    if caps.ForceRelay {
        for _, m := range session.MediaDescriptions {
            m.Attributes = filterAttributes(m.Attributes, func(a sdp.Attribute) bool {
                return a.Key != "candidate" && a.Key != "rtcp" // 保留 TURN relay candidate 由网关注入
            })
        }
        // 注入网关侧 TURN 分配的 Relay Candidate
        injectRelayCandidates(session, g.turnAllocator.Allocate(ctx))
    }

    // 4. 扩展属性注入：携带授权版本号，供对端 PEP 校验
    session.Attributes = append(session.Attributes, sdp.Attribute{
        Key: "x-ztna-authz-ver", Value: caps.Version,
    })

    return session.String(), nil
}

sequenceDiagram
    participant Presenter as 共享端 (高信任)
    participant Gateway as 会议网关 (PEP)
    participant Viewer as 观看端 (中风险)
    participant RecProxy as 录制代理

    Presenter->>Gateway: SFrame 加密帧 (KeyID=K1, CTR=1)
    Note right of Presenter: 密钥 K1 仅分发给允许下载的设备
    Gateway->>Viewer: 转发密文 (不解密)
    Gateway->>RecProxy: 转发密文 + 元数据 (KeyID=K1)
    Viewer->>Viewer: 无 K1 -> 解密失败 -> 仅渲染占位图/模糊流
    RecProxy->>Storage: 存储密文
    Note right of RecProxy: 事后审批通过 -> KMS 释放 K1 -> 解密归档

graph TD
    A[Platform Global Policy<br/>平台基线: TLS 1.3, 禁用弱加密] --> B[Tenant Policy<br/>租户自定义: 合规标准, 数据驻留]
    B --> C[Meeting Template Policy<br/>会议模板: 董事会/全员会/外部协作]
    C --> D[Runtime Instance Policy<br/>运行时实例: 动态风险调整]
    
    style A fill:#f9f,stroke:#333
    style B fill:#bbf,stroke:#333
    style C fill:#bfb,stroke:#333
    style D fill:#ff9,stroke:#333

sequenceDiagram
    autonumber
    participant UserA as 企业A用户 (Host)
    participant GW_A as 企业A网关 (PEP)
    participant PDP_A as 企业A PDP
    participant FedBroker as 联邦策略代理
    participant PDP_B as 企业B PDP
    participant UserB as 企业B用户 (Guest)

    UserA->>GW_A: 创建会议 (Template: External_Collab)
    GW_A->>PDP_A: Evaluate(Host_Context)
    PDP_A-->>GW_A: Allow + Template_Caps

    UserB->>GW_A: Join Meeting (OIDC Token from Okta)
    GW_A->>FedBroker: Resolve_Federated_Policy(UserB_Token, Meeting_Policy)
    
    par 并行评估
        FedBroker->>PDP_A: Evaluate_Guest(Device_Posture_A_View, Tenant_A_Policy)
        FedBroker->>PDP_B: Request_Posture_Attestation(UserB_Sub, Device_ID)
        PDP_B-->>FedBroker: Posture_Attestation_JWT (Signed by B's Root Key)
    end
    
    FedBroker->>FedBroker: Merge_Policies(Policy_A, Attestation_B)
    Note right of FedBroker: 取交集: min(Trust_Level_A, Trust_Level_B)
    FedBroker-->>GW_A: Final_Capability_Set
    GW_A->>UserB: Join Success + Downgraded_Caps

# .compliance/pipeline.yml
stages:
  - name: "Policy-as-Code 静态扫描"
    tool: "opa test -v policies/ | checkov -f policies/"
    rules:
      - "DENY_RULE_MUST_HAVE_EXPIRATION"
      - "NO_PII_IN_DECISION_LOGS"
      - "ENFORCE_MFA_FOR_ADMIN_ACTIONS"

  - name: "数据流向映射验证"
    tool: "custom-data-lineage-scanner"
    check: "确认姿态数据未流入非安全存储 (如 ELK 普通索引)"

  - name: "DPIA (数据保护影响评估) 自动生成"
    trigger: "策略变更涉及新增采集字段"
    output: "DPIA_Report_{{version}}.pdf"
    approver: "DPO (数据保护官)"

  - name: "等保 2.0 控制点映射覆盖率"
    target: "覆盖率 >= 95% (针对三级系统)"
    metric: "control_point_coverage_ratio"

# 使用 k6 脚本模拟真实信令+媒体流量混合场景
k6 run --vus 50000 --duration 30m 
  -e MEETING_ID="m_live_100k" 
  -e SCENARIO="join_mixed" 
  script/ztna_load_test.js

# 关键混合场景比例
# 60% 正常加入 (TRUSTED)
# 20% 降级加入 (LOW/MEDIUM_RISK -> 触发 SDP Rewrite)
# 10% 拒绝加入 (HIGH_RISK/DENY -> 触发 403)
# 10% 会话中姿态变更 (触发 Re-INVITE + Renegotiation)

package meeting.breakglass

# 仅当满足所有条件时允许
allow {
    # 1. 申请单状态为 Approved
    input.ticket.status == "APPROVED"
    # 2. 审批人为 CISO 或指定安全负责人
    input.ticket.approver_role in ["CISO", "SECURITY_LEAD"]
    # 3. 有效期内 (如 2 小时)
    time.now_ns() < input.ticket.expires_at
    # 4. 仅授予必要权限 (如仅音频)
    requested_caps == {"audio": "FULL_DUPLEX", "video": "DENY", "recording": "NONE"}
    # 5. 强制审计标记
    audit_tag = "BREAK_GLASS"
}

// ztna-meeting-sdk.d.ts
interface ZTNAMeetingSDK {
  // 初始化 (App 启动时调用一次)
  init(config: InitConfig): Promise<void>;

  // 会议加入前预检 (可选，用于 UI 提前提示)
  preCheck(meetingId: string): Promise<PreCheckResult>;

  // 加入会议 (核心入口，内部自动完成姿态上报、策略拉取、能力集协商)
  joinMeeting(params: JoinParams): Promise<JoinResult>;

  // 会话中能力变更监听 (UI 动态显隐按钮)
  onCapabilityChange(listener: (caps: CapabilitySet) => void): UnsubscribeFn;

  // 主动触发姿态上报 (如用户手动开启杀毒软件后)
  refreshPosture(): Promise<void>;

  // 获取当前设备信任等级 (用于设置页展示)
  getTrustLevel(): TrustLevel;
}

interface JoinResult {
  // 信令层连接信息
  signaling: SignalingConfig;
  // 媒体引擎初始化参数 (已注入 TURN、Codec 限制)
  mediaEngineConfig: MediaEngineConfig;
  // 当前生效能力集
  capabilities: CapabilitySet;
  // 授权版本号 (后续信令携带)
  authzVersion: string;
}