type Claims struct {
    UserID    uint      `json:"user_id"`    // 用户 ID
    TenantID  uint      `json:"tenant_id"`  // 租户 ID
    Role      string    `json:"role"`       // 角色
    Email     string    `json:"email"`      // 邮箱
    Exp       int64     `json:"exp"`        // 过期时间戳
    Iss       string    `json:"iss"`        // 签发者
    Aud       string    `json:"aud"`        // 接收方
}

// 密码复杂度要求
type Policy struct {
    MinLength       int  // 最小长度（默认 12）
    RequireUpper    bool // 需要大写字母
    RequireLower    bool // 需要小写字母
    RequireNumber   bool // 需要数字
    RequireSpecial  bool // 需要特殊字符 (@$!%*?&)
    PreventReuse    int  // 防止重复使用最近 N 次密码
    ExpireDays      int  // 密码有效期（天）
}

import "golang.org/x/crypto/bcrypt"

func HashPassword(password string) (string, error) {
    bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost+2)
    return string(bytes), err
}

func CheckPassword(password, hash string) bool {
    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
    return err == nil
}

// 权限验证中间件
func RequirePermission(perm string) gin.HandlerFunc {
    return func(c *gin.Context) {
        role := c.GetString("role")
        tenantID := c.GetUint("tenant_id")

        // 查询用户权限（缓存到 Redis）
        cacheKey := fmt.Sprintf("perm:%d:%s", tenantID, role)
        permsJSON, err := redis.Get(cacheKey).Bytes()
        if err != nil {
            perms := loadPermissionsFromDB(tenantID, role)
            redis.SetEx(cacheKey, 3600, json.Marshal(perms))
        }

        if !hasPermission(perms, perm) {
            c.JSON(403, gin.H{
                "code":    2101,
                "message": "permission_denied",
                "data":    nil,
            })
            c.Abort()
            return
        }
        c.Next()
    }
}

// 路由使用示例
router.GET("/api/v1/tickets", authMiddleware, RequirePermission("ticket:read"), ticketController.List)
router.POST("/api/v1/tickets", authMiddleware, RequirePermission("ticket:create"), ticketController.Create)

// 中间件自动注入 tenant_id
func TenantMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        userID := c.GetInt("user_id")
        tenantID := getUserTenantID(userID)
        c.Set("tenant_id", tenantID)
        c.Next()
    }
}

// Repository 层自动添加 tenant_id 条件
func (r *TicketRepo) FindByID(id uint, tenantID uint) (*Ticket, error) {
    var t Ticket
    err := r.db.Where("id = ? AND tenant_id = ?", id, tenantID).First(&t).Error
    return &t, err
}

// 使用 GORM 全局 Scope
func (Ticket) ScopeTenant(tenantID uint) func(*gorm.DB) *gorm.DB {
    return func(db *gorm.DB) *gorm.DB {
        return db.Where("tenant_id = ?", tenantID)
    }
}

// 自动应用
db.Scopes(Ticket.ScopeTenant(tenantID)).Find(&tickets)

import "crypto/aes"

type EncryptedString struct {
    Data     []byte // 加密数据
    IV       []byte // 初始化向量
    Alg      string // 算法: aes-gcm
    Version  int    // 版本号，支持算法迁移
}

// 加密
func Encrypt(plaintext string, key []byte) (*EncryptedString, error) {
    block, _ := aes.NewCipher(key)
    gcm, _ := cipher.NewGCM(block)
    nonce := make([]byte, gcm.NonceSize())
    rand.Read(nonce)

    ciphertext := gcm.Seal(nil, nonce, []byte(plaintext), nil)
    return &EncryptedString{
        Data:    ciphertext,
        IV:      nonce,
        Alg:     "aes-gcm",
        Version: 1,
    }, nil
}

// 解密
func (es *EncryptedString) Decrypt(key []byte) (string, error) {
    block, _ := aes.NewCipher(key)
    gcm, _ := cipher.NewGCM(block)
    plaintext, _ := gcm.Open(nil, es.IV, es.Data, nil)
    return string(plaintext), nil
}

import "github.com/hashicorp/vault/api"

client, _ := api.NewClient(&api.Config{Address: "https://vault:8200"})
client.SetToken(os.Getenv("VAULT_TOKEN"))

// 读取密钥
secret, _ := client.KVv2("secret").Get(context.Background(), "itsm/jwt")
jwtSecret := secret.Data["jwt_secret"].(string)

import "github.com/ulule/limiter/v3"

func RateLimitMiddleware() gin.HandlerFunc {
    // 每 IP 100 请求/分钟
    store := store.NewMemory()
    r := limiter.New(store, 100, time.Minute)

    return func(c *gin.Context) {
        h := c.ClientIP()
        ctx := c.Request.Context()

        if limitContext, err := r.Peek(ctx, h); err == nil && limitContext.Reached {
            c.JSON(429, gin.H{"error": "rate limit exceeded"})
            c.Abort()
            return
        }

        if _, err := r.Increment(ctx, h); err != nil {
            c.JSON(500, gin.H{"error": "rate limit error"})
            c.Abort()
            return
        }
        c.Next()
    }
}

import "github.com/gin-contrib/cors"

config := cors.DefaultConfig()
config.AllowOrigins = []string{
    "https://itsm.yourdomain.com",
    "https://app.yourdomain.com",
}
config.AllowMethods = []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"}
config.AllowHeaders = []string{"Authorization", "Content-Type"}
config.ExposeHeaders = []string{"Content-Length"}
config.AllowCredentials = true
config.MaxAge = 12 * time.Hour

router.Use(cors.New(config))

type AuditLog struct {
    ID        uint      `json:"id"`
    UserID    uint      `json:"user_id"`
    TenantID  uint      `json:"tenant_id"`
    Action    string    `json:"action"`    // login, logout, create, update, delete
    Resource  string    `json:"resource"`  // ticket, user, etc.
    ResourceID uint     `json:"resource_id"`
    OldValue JSON      `json:"old_value"` // JSON 之前的值
    NewValue  JSON      `json:"new_value"` // JSON 之后的值
    IP        string    `json:"ip"`
    UserAgent string    `json:"user_agent"`
    CreatedAt time.Time `json:"created_at"`
}

func AuditLogger() gin.HandlerFunc {
    return func(c *gin.Context) {
        // 记录请求前数据
        c.Set("audit_start_time", time.Now())
        c.Next()

        // 记录操作
        if userID, exists := c.Get("user_id"); exists {
            log := AuditLog{
                UserID:    userID.(uint),
                TenantID:  c.GetUint("tenant_id"),
                Action:    c.Request.Method,
                Resource:  c.FullPath(),
                IP:        c.ClientIP(),
                UserAgent: c.Request.UserAgent(),
                CreatedAt: time.Now(),
            }
            auditRepo.Create(&log)
        }
    }
}