-- PostgreSQL 行级安全策略（RLS）示例
CREATE POLICY meeting_tenant_isolation ON meetings
  USING (tenant_id = current_setting('app.current_tenant')::uuid);

-- 强制开启 RLS
ALTER TABLE meetings ENABLE ROW LEVEL SECURITY;
ALTER TABLE meetings FORCE ROW LEVEL SECURITY;

sequenceDiagram
    participant A as 租户A组织者
    participant GW as API网关
    participant AS as 认证服务
    participant B as 租户B受邀者
    
    A->>GW: POST /meetings/{mid}/invite {target_tenant, permissions}
    GW->>AS: 校验组织者权限 & 目标租户状态
    AS-->>GW: 签发短时 JWT (scope: meeting:join:read)
    GW-->>A: 返回带签名的邀请链接
    B->>GW: GET /join?token=xxx
    GW->>AS: 验签 & 绑定临时租户上下文
    AS-->>B: 颁发会议级访问凭证

# 租户间信任策略示例
federation:
  trusted_tenants:
    - tenant_id: "corp-hq"
      allowed_domains: ["hq.example.com"]
      default_role: "attendee"
      max_duration_minutes: 480
  auto_provision: true
  attribute_mapping:
    email: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
    display_name: "cn"

// 调度器核心逻辑伪代码
func (s *Scheduler) Allocate(room *MeetingRoom, req *AllocateRequest) (*MediaNode, error) {
    // 1. 租户亲和性：优先分配同租户已占用节点（复用连接/缓存）
    if node := s.affinityPicker.Pick(req.TenantID); node != nil {
        return node, nil
    }
    // 2. 合规亲和性：数据驻留要求（如 GDPR、数据不出境）
    if req.ComplianceZone != "" {
        return s.zonePicker.Pick(req.ComplianceZone)
    }
    // 3. 负载均衡：最少连接 + CPU/带宽水位
    return s.leastLoadedPicker.Pick()
}

graph TD
    A[租户管理员] -->|配置| B(角色模板)
    B --> C[会议组织者]
    B --> D[会议主持人]
    B --> E[普通参会者]
    B --> F[跨租户访客]
    
    C -->|拥有| G[创建/删除会议]
    C -->|拥有| H[设置会议密码/等候室]
    D -->|拥有| I[静音/移除参会者]
    D -->|拥有| J[开始/停止录制]
    F -->|仅限| K[加入会议/查看共享]
    F -.->|禁止| L[下载/转发/录屏]

package meeting.auth

allow {
    input.action == "download_recording"
    input.user.tenant_id == input.meeting.tenant_id
    input.user.role in ["organizer", "admin"]
    not input.meeting.is_external_share
}

deny[msg] {
    input.action == "screen_capture"
    input.user.tenant_id != input.meeting.tenant_id
    msg := "跨租户访客禁止本地录屏，请使用云端录制功能"
}

# 租户级会议成功率（排除网络自检失败）
sum(rate(meeting_join_success_total{tenant=~".+"}[5m])) by (tenant)
/
sum(rate(meeting_join_attempt_total{tenant=~".+"}[5m])) by (tenant)

# 媒体节点租户负载热力图
topk(10, sum by (tenant, node) (rate(media_node_tenant_bandwidth_bytes[1m])))

graph LR
    Client[客户端 SDK] -->|WSS/QUIC| GW[API 网关集群]
    GW -->|租户路由| Registry[(服务注册中心<br/>元数据: tenant_id, shard_id)]
    GW -->|Sticky Session| SignalNode[信令节点<br/>Shard-01...Shard-N]
    SignalNode -->|Pub/Sub| Kafka[租户分区 Topic]
    SignalNode -->|状态同步| RedisCluster[(Redis Cluster<br/>Key: tenant:{id}:conn:{uid})]

// 租户级在线状态 CRDT 结构 (LWW-Element-Set 变体)
type TenantPresence struct {
    TenantID   string            `json:"tid"`
    Version    uint64            `json:"ver"` // Hybrid Logical Clock
    States     map[string]UserState `json:"states"` // uid -> {status, device, ts}
    Tombstones map[string]uint64 `json:"tomb"`    // 逻辑删除版本号
}

// 合并规则：版本号高者胜，平局按 UID 字典序
func (a *TenantPresence) Merge(b *TenantPresence) {
    for uid, state := range b.States {
        if v, ok := a.States[uid]; !ok || state.Version > v.Version {
            a.States[uid] = state
        }
    }
    // 垃圾回收：定期清理 Version < (Now - 24h) 的 Tombstones
}

// 前端 SDK 初始化时动态下发 ICE 策略
const iceConfig = await fetch(`/api/v1/tenants/${tenantId}/ice-policy`).then(r => r.json());

const pc = new RTCPeerConnection({
  iceServers: iceConfig.servers, // 包含租户专属 TURN 域名、凭证、过期时间
  iceTransportPolicy: iceConfig.forceRelay ? 'relay' : 'all', // 高安租户强制 relay
  iceCandidatePoolSize: 10
});

// 关键：候选对采集上报租户标识，便于后台大数据分析穿透成功率
pc.onicecandidate = e => {
  if (e.candidate) telemetry.report('ice_candidate', { tenantId, candidate: e.candidate.toJSON() });
};

graph TD
    KMS[租户自带密钥 KMS / 云厂商 KMS] -->|Unwrap| KEK[密钥加密密钥 KEK<br/>按租户/地域隔离]
    KEK -->|Envelope Encryption| DEK[数据加密密钥 DEK<br/>每录制文件/会话唯一]
    DEK -->|AES-256-GCM| MediaFile[(媒体文件/数据库字段)]
    DEK -->|加密存储| MetaDB[(元数据库<br/>字段级加密)]
    
    style KMS fill:#f9f,stroke:#333
    style KEK fill:#bbf,stroke:#333
    style DEK fill:#bfb,stroke:#333

# 数据出境策略即代码
cross_border_policy:
  tenant_whitelist: ["corp-global", "edu-intl"] # 仅通过评估的租户放行
  data_categories_allowed: 
    - "meeting_metadata"      # 允许：会议ID、时间、参会人数
    - "aggregated_stats"      # 允许：聚合统计指标
  data_categories_denied:
    - "raw_audio_video"       # 禁止：原始音视频流
    - "transcript_raw"        # 禁止：原文转写
    - "pii_fields"            # 禁止：身份证、人脸特征向量
  technical_measures:
    - "media_node_geo_fence: cn-only"  # 媒体节点强制部署中国大陆
    - "recording_transcode_watermark"  # 跨境分发版本强制加水印/降码率
    - "audit_log_immutable"            # 出境审计日志 WORM 存储 3 年

-- 分钟级资源消耗事实表 (ClickHouse / Doris)
CREATE TABLE tenant_usage_minute (
    tenant_id       UUID,
    minute_bucket   DateTime,
    -- 计算资源
    cpu_core_seconds    Float64,  -- vCPU * 秒
    gpu_seconds         Float64,  -- GPU 显存秒 (按显存比例折算)
    -- 网络资源
    ingress_bytes       UInt64,
    egress_bytes        UInt64,
    turn_relay_bytes    UInt64,   -- 昂贵的中转流量单独核算
    -- 存储资源
    storage_hot_gb_hour Float64,
    storage_cold_gb_hour Float64,
    -- AI 资源
    asr_seconds         Float64,
    llm_tokens_in       UInt64,
    llm_tokens_out      UInt64,
    -- 业务量
    meeting_count       UInt32,
    participant_peak    UInt32,
    recording_minutes   UInt32
) ENGINE = MergeTree()
PARTITION BY toYYYYMM(minute_bucket)
ORDER BY (tenant_id, minute_bucket);

graph LR
    CI[CI 构建镜像] --> Canary[金丝雀环境<br/>1% 核心租户 + 内部犬食]
    Canary -->|指标校验<br/>P99延迟/错误率/业务指标| Shadow[影子流量验证<br/>镜像生产 10% 流量至新版<br/>仅记录Diff不返回]
    Shadow -->|Diff报告<br/>功能/性能/安全| Gradual[分批灰度<br/>按租户分级:<br/>L1标准租户 10%→50%→100%<br/>L2大客户 手动确认]
    Gradual -->|全量通过| Prod[全量发布]
    Prod -->|回滚钩子| Rollback[一键回滚<br/>含数据库迁移逆向脚本]