┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│  客户端 A    │     │  接入层       │     │  会议状态服务    │
│  (主持人)    │────▶│  (WebSocket) │────▶│  (State Machine)│
└─────────────┘     │  Gateway     │     │  - 角色仲裁      │
                    └──────┬───────┘     │  - 权限校验      │
                           │             │  - 事件发布      │
                    ┌──────▼───────┐     └────────┬────────┘
                    │  消息总线     │              │
                    │  (Kafka/     │              │
                    │   Redis      │              ▼
                    │   Stream)    │     ┌─────────────────┐
                    └──────┬───────┘     │  推送服务        │
                           │             │  (Push Service) │
           ┌───────────────┼───────────────┤  - 连接管理      │
           ▼               ▼               │  - 多端分发      │
    ┌─────────────┐ ┌─────────────┐       │  - 重试/降级     │
    │ 客户端 B    │ │ 客户端 C    │       └─────────────────┘
    │ (参会者)    │ │ (参会者)    │
    └─────────────┘ └─────────────┘

{
  "seq": 1024,                    // 单调递增序列号，用于去重/确认
  "type": "ROLE_CHANGE",          // 消息类型
  "meeting_id": "m_7x9k2p",       // 会议唯一标识
  "timestamp": 1704067200123,     // 服务端生成时间（毫秒）
  "payload": {
    "operator_id": "u_123",       // 操作发起人
    "target_id": "u_456",         // 被操作对象
    "action": "PROMOTE",          // 动作枚举
    "new_role": "CO_HOST",        // 目标角色
    "permissions": {              // 细粒度权限位图
      "can_mute_others": true,
      "can_share_screen": true,
      "can_manage_recording": false
    },
    "reason": "HOST_ACTION"       // 变更来源：HOST_ACTION/AUTO_TRANSFER/APPLY_APPROVE
  },
  "ack_required": true            // 是否需要客户端 ACK
}

enum RoleAction {
  PROMOTE = 'PROMOTE',           // 角色提升
  DEMOTE = 'DEMOTE',             // 角色降级
  MUTE = 'MUTE',                 // 静音
  UNMUTE = 'UNMUTE',             // 取消静音
  TRANSFER_HOST = 'TRANSFER_HOST', // 主持人移交
  REVOKE_SHARE = 'REVOKE_SHARE', // 撤销共享权限
  GRANT_SHARE = 'GRANT_SHARE'    // 授予共享权限
}

enum RoleType {
  HOST = 'HOST',                 // 主持人（唯一）
  CO_HOST = 'CO_HOST',           // 联席主持（可多个）
  PRESENTER = 'PRESENTER',       // 共享者
  ATTENDEE = 'ATTENDEE'          // 普通参会者
}

Client A (Host)          Server                    Client B (Attendee)
    │                      │                          │
    ├─ ROLE_CHANGE ───────▶│                          │
    │                      ├─ ROLE_CHANGE ───────────▶│
    │                      │                          ├─ ACK(seq=1024) ─▶│
    │                      │◀─────────────────────────┤
    │◀── ACK(seq=1024) ────┤                          │
    │                      │                          │

# 伪代码：会议角色状态机核心逻辑
class MeetingRoleStateMachine:
    # 角色层级：HOST > CO_HOST > PRESENTER > ATTENDEE
    HIERARCHY = ['HOST', 'CO_HOST', 'PRESENTER', 'ATTENDEE']
    
    # 权限矩阵
    PERMISSIONS = {
        'HOST': {'mute', 'unmute', 'promote', 'demote', 'transfer', 'share', 'record', 'kick'},
        'CO_HOST': {'mute', 'unmute', 'promote', 'demote', 'share', 'record'},
        'PRESENTER': {'share'},
        'ATTENDEE': set()
    }
    
    def __init__(self, meeting_id: str):
        self.meeting_id = meeting_id
        self.roles: Dict[str, str] = {}  # user_id -> role
        self.pending_actions: Dict[str, Action] = {}  # 幂等键 -> 动作
        self.version = 0  # 乐观锁版本号
    
    def apply(self, action: RoleChangeAction) -> Result:
        # 1. 幂等性检查
        idempotent_key = f"{action.operator_id}:{action.target_id}:{action.action}:{action.seq}"
        if idempotent_key in self.pending_actions:
            return Result.DUPLICATE
        
        # 2. 权限校验
        if not self._can_operate(action.operator_id, action.action, action.target_id):
            return Result.FORBIDDEN
        
        # 3. 状态变更（单线程串行，无锁）
        old_role = self.roles.get(action.target_id, 'ATTENDEE')
        new_role = self._compute_new_role(old_role, action)
        
        if new_role == old_role:
            return Result.NO_CHANGE
        
        # 4. 版本号递增 + 事件生成
        self.version += 1
        event = RoleChangedEvent(
            meeting_id=self.meeting_id,
            version=self.version,
            operator_id=action.operator_id,
            target_id=action.target_id,
            old_role=old_role,
            new_role=new_role,
            permissions=self.PERMISSIONS[new_role],
            timestamp=time_ms()
        )
        
        # 5. 持久化 + 发布事件（同步事务或事务性发件箱）
        self.roles[action.target_id] = new_role
        self.pending_actions[idempotent_key] = action
        self._publish_event(event)
        
        return Result.SUCCESS

// 会议权限 Slice 设计
interface MeetingPermissionState {
  // 当前用户角色
  myRole: RoleType;
  // 全员角色映射
  roleMap: Record<string, RoleType>;
  // 细粒度权限缓存
  permissions: Record<string, PermissionSet>;
  // 版本号，用于增量同步
  version: number;
  // 待确认的乐观更新
  optimisticUpdates: Map<string, OptimisticAction>;
}

// 乐观更新流程
function handleRoleChangeEvent(event: RoleChangedEvent) {
  // 1. 版本号校验
  if (event.version <= state.version) return; // 旧事件丢弃
  
  // 2. 乐观更新 UI（即时反馈）
  dispatch({ type: 'ROLE_CHANGE_OPTIMISTIC', payload: event });
  
  // 3. 发送 ACK
  sendAck(event.seq);
  
  // 4. 确认后标记落地
  dispatch({ type: 'ROLE_CHANGE_CONFIRMED', payload: event });
}

<!-- 权限控制指令：v-can="['mute_others', 'manage_recording']" -->
const can = (permissions: string[]) => {
  const { permissions: myPerms } = useMeetingStore();
  return permissions.every(p => myPerms.value[p] === true);
};

// 静音按钮：仅主持人/联席主持可见且可交互
<el-button 
  v-if="can(['mute_others'])" 
  :disabled="targetUser.isMuted" 
  @click="muteUser(targetUser.id)"
>
  {{ targetUser.isMuted ? '取消静音' : '静音' }}
</el-button>

class MeetingSocket {
  private reconnectAttempts = 0;
  private maxReconnectAttempts = 10;
  
  async connect() {
    this.ws = new WebSocket(this.url);
    this.ws.onopen = () => {
      this.reconnectAttempts = 0;
      // 关键：携带版本号请求增量同步
      this.send({ type: 'SYNC_REQUEST', version: store.version });
    };
    
    this.ws.onmessage = (msg) => {
      const event = JSON.parse(msg.data);
      this.handleServerEvent(event);
    };
    
    this.ws.onclose = () => this.scheduleReconnect();
  }
  
  private scheduleReconnect() {
    const delay = Math.min(1000 * Math.pow(1.5, this.reconnectAttempts), 30000);
    this.reconnectAttempts++;
    setTimeout(() => this.connect(), delay);
  }
}

// 推送服务发送端背压控制（Go 伪代码）
func (p *PushService) Broadcast(meetingID string, msg *PushMessage) {
    conns := p.connIndex.GetConns(meetingID)
    
    // 分批发送，避免单次循环阻塞事件循环
    const batchSize = 100
    for i := 0; i < len(conns); i += batchSize {
        batch := conns[i:min(i+batchSize, len(conns))]
        
        // 非阻塞发送，慢客户端进入降级队列
        for _, conn := range batch {
            select {
            case conn.SendCh <- msg:
            default:
                p.handleSlowClient(conn, msg) // 缓冲区满：标记慢客户端，降级为轮询/离线补发
            }
        }
        
        // 微调度，让出 CPU
        runtime.Gosched()
    }
}

graph LR
    subgraph Core[核心层  单一代码库]
        A[状态机 State Machine]
        B[协议编解码 Protobuf Codec]
        C[重连调度 Reconnect Scheduler]
        D[幂等去重 Deduplicator]
        E[事件总线 Event Bus]
    end

    subgraph Adapters[适配层  平台相关]
        F[Web Adaptern- WS Polyfilln- IndexedDB 持久化n- Web Worker 隔离]
        G[Native Adaptern- JNI/FFI 桥接n- 前后台生命周期映射n- Keychain 加密存储]
        H[MiniApp Adaptern- wx.connectSocket 封装n- 双线程通信桥接n- 后台 5 分钟心跳策略]
        I[Desktop Adaptern- Node.js Bindingn- 系统托盘/全局快捷键n- 自动更新集成]
    end

    Core --> Adapters

// types/meeting.d.ts  单一事实来源
export interface MeetingPermissions {
  canMuteOthers: boolean;
  canUnmuteOthers: boolean;
  canPromote: boolean;
  canDemote: boolean;
  canTransferHost: boolean;
  canShareScreen: boolean;
  canManageRecording: boolean;
  canKick: boolean;
  // 扩展位图，避免频繁加字段破坏类型
  extended: Record<string, boolean>;
}

export interface UserRoleInfo {
  userId: string;
  role: 'HOST' | 'CO_HOST' | 'PRESENTER' | 'ATTENDEE';
  permissions: MeetingPermissions;
  isMuted: boolean;
  isLocal: boolean;
  // 临时权限（如：申请共享中、被邀请上台中）
  transient?: {
    type: 'SHARE_REQUEST' | 'STAGE_INVITE';
    expiresAt: number;
  };
}

// 会议状态快照：不可变数据结构，配合 Immer/Proxy 实现响应式
export interface MeetingSnapshot {
  meetingId: string;
  version: number;              // 单调递增
  hostId: string;               // 当前主持人
  coHostIds: string[];          // 联席主持列表
  presenterId: string | null;   // 当前共享者
  users: Map<string, UserRoleInfo>;
  // 会议级配置
  settings: {
    allowAttendeeUnmute: boolean;
    allowRoleChange: boolean;
    maxCoHosts: number;
  };
}

// useMeetingPermission.ts (Vue 3 / React 通用逻辑)
export function useMeetingPermission(meetingId: string) {
  const sdk = useMeetingSDK(); // 单例 SDK
  const snapshot = ref<MeetingSnapshot | null>(null);
  const pendingActions = ref<Map<string, PendingAction>>(new Map());
  
  // 衍生计算：当前用户权限
  const myPermissions = computed(() => 
    snapshot.value?.users.get(sdk.currentUserId)?.permissions ?? emptyPermissions
  );
  
  // 衍生计算：可操作目标用户列表（如：仅显示可静音的用户）
  const muteableUsers = computed(() => 
    Array.from(snapshot.value?.users.values() ?? [])
      .filter(u => !u.isLocal && !u.isMuted && myPermissions.value.canMuteOthers)
  );

  // 乐观更新封装：自动处理 ACK/回滚/重试
  const executeRoleAction = async (action: RoleActionPayload) => {
    const optimisticId = `opt_${Date.now()}_${Math.random()}`;
    const rollbackSnapshot = cloneDeep(snapshot.value); // 快照回滚用
    
    try {
      // 1. 乐观更新 UI
      applyOptimisticUpdate(snapshot.value!, action);
      pendingActions.value.set(optimisticId, { action, rollbackSnapshot });
      
      // 2. 发送指令（SDK 内部处理重试/ACK）
      await sdk.sendRoleAction(action, { 
        timeout: 5000, 
        onRetry: (attempt) => console.log(`重试 ${attempt}...`) 
      });
      
      // 3. 服务端确认事件会通过 onEvent 回调自然更新 snapshot，此处仅清理 pending
      pendingActions.value.delete(optimisticId);
      return { success: true };
    } catch (err) {
      // 4. 自动回滚 + 错误分类抛出
      snapshot.value = rollbackSnapshot;
      pendingActions.value.delete(optimisticId);
      throw enhanceError(err, action); // 附加“操作建议”：如 FORBIDDEN -> "您无权限操作"，CONFLICT -> "对方角色已变更，请刷新"
    }
  };

  // 生命周期：订阅 SDK 事件总线
  onMounted(() => sdk.on('SNAPSHOT', updateSnapshot));
  onUnmounted(() => sdk.off('SNAPSHOT', updateSnapshot));

  return { 
    snapshot, 
    myPermissions, 
    muteableUsers, 
    executeRoleAction,
    // 暴露底层连接状态，供 UI 展示“连接中/已断开/重连中”
    connectionState: sdk.connectionState 
  };
}

// 握手阶段协商
message ClientHello {
  string sdk_version = 1;           // 如 "3.2.1"
  repeated uint32 supported_protocols = 2; // [1, 2, 3] 支持的协议版本号
  string device_fingerprint = 3;
  map<string, string> capabilities = 4;    // {"e2ee": "true", "simulcast": "true"}
}

message ServerHello {
  uint32 negotiated_protocol = 1;   // 选定版本，如 3
  string session_token = 2;         // 后续帧携带
  uint64 server_time = 3;           // 时间同步基准
  repeated FeatureFlag features = 4; // 服务端开关
  string fallback_gateway = 5;      // 降级网关地址
}

-- rules/permission_v3.lua  存储于配置中心，网关/状态机热加载
local Rules = {}

-- 判断 operator 能否对 target 执行 action
function Rules.can_operate(operator_role, target_role, action, meeting_settings)
  -- 规则表驱动，非硬编码
  local hierarchy = { HOST=4, CO_HOST=3, PRESENTER=2, ATTENDEE=1 }
  
  if action == 'PROMOTE' then
    return hierarchy[operator_role] > hierarchy[target_role] 
       and hierarchy[operator_role] == 4 -- 仅 HOST 可提升
  end
  
  if action == 'TRANSFER_HOST' then
    return operator_role == 'HOST' and target_role ~= 'HOST'
  end
  
  -- 支持会议级配置覆盖
  if action == 'UNMUTE' and not meeting_settings.allowAttendeeUnmute then
    return operator_role ~= 'ATTENDEE'
  end
  
  return false
end

return Rules

// 1. 状态机层面：合并高频同类事件
func (sm *StateMachine) applyBatched(actions []Action) []Event {
    // 同一 target、同一 action 在 100ms 窗口内合并，仅保留最后一次
    // 全员静音/取消静音 → 仅生成 1 条 MUTE_ALL / UNMUTE_ALL 广播事件
}

// 2. 推送层面：大广播走“组播/广播树”而非单连接遍历
//    引入会议级“广播组”，网关层复用单份数据帧多路转发

// 3. 背压硬限制：连接级发送缓冲区上限 64KB / 100 条消息
//    超限直接标记为 Slow Client，切换降级通道，不再堆积内存

// 4. 客户端侧：操作防抖 300ms + 服务端侧：同用户同动作 200ms 幂等去重

{
  "audit_id": "audit_x7k9m2",
  "timestamp": "2024-01-15T08:30:00.123Z",
  "event_type": "ROLE_PERMISSION_CHANGE",
  "actor": {
    "user_id": "u_123",
    "role": "HOST",
    "ip": "183.*.*.* (脱敏)",
    "device_fingerprint": "fp_abc... (哈希)",
    "location": "CN-SH (GeoIP)"
  },
  "target": {
    "user_id": "u_456",
    "old_role": "ATTENDEE",
    "new_role": "CO_HOST"
  },
  "changed_permissions": {
    "can_mute_others": { "from": false, "to": true },
    "can_manage_recording": { "from": false, "to": true }
  },
  "reason": "HOST_MANUAL",
  "meeting_context": {
    "meeting_id": "m_7x9k2p",
    "meeting_type": "INTERNAL_COLLABORATION",
    "is_recorded": true,
    "data_region": "ap-shanghai-1"
  },
  "result": "SUCCESS",
  "risk_level": "MEDIUM"  // 自动风控评分：涉及录制权限变更提级
}

# 用户行使“被遗忘权”/“数据导出权”
POST /api/v1/compliance/dsr/request
{
  "user_id": "u_456",
  "request_type": "ERASURE",  // ACCESS / ERASURE / PORTABILITY
  "scope": "MEETING_ROLE_LOGS",
  "verification_token": "email_verified_code_xxx"
}

# 异步处理流程
1. 验证身份 -> 2. 扫描全量日志/备份 -> 3. 脱敏/删除/打包 -> 4. 回调通知/下载链接
# SLA: ACCESS 72h, ERASURE 30d (法律允许延期)

# 轻量级客户端模型 (TensorFlow.js / CoreML / MNN)
class PermissionPredictor:
    def predict_next_actions(self, behavior_sequence: List[Event]) -> List[PredictedAction]:
        # 输入：最近 30s 事件流 (hover, click, speak, chat)
        # 输出：Top-K 可能的权限操作 + 置信度
        pass

# 服务端预下发
if confidence > 0.85:
    push_service.preload_permissions(meeting_id, target_user, predicted_role)
    # 客户端本地预渲染 UI，用户点击瞬间生效（0ms 感知延迟）

sequenceDiagram
    participant Host as 主持人 (语音)
    participant ASR as 实时语音识别
    participant NLU as 意图理解 (LLM Function Calling)
    participant Orchestrator as 编排引擎
    participant StateMachine as 状态机
    
    Host->>ASR: "让小王共享屏幕并升为联席主持"
    ASR->>NLU: 文本
    NLU->>Orchestrator: [GRANT_SHARE(user=王), PROMOTE(user=王, role=CO_HOST)]
    Orchestrator->>StateMachine: 事务性执行 (原子性保证)
    StateMachine-->>All: 单条广播包含双变更

Effective_Permission = Base_Role_Permission 
                     ∩ Device_Trust_Level (MDM合规/越狱检测) 
                     ∩ Network_Trust_Level (企业内网/零信任代理/公网) 
                     ∩ Data_Sensitivity_Label (公开/内部/机密/绝密)
                     ∩ Time_Window (工作时间/非工作时间)