新员工入职第一天：花了三小时找公司内部AI规范文档

┌─────────────────────────────────────────────┐
│              接入层                          │
│  Web端  │  移动端  │  API Gateway           │
└─────────────────────────────────────────────┘
                    ↓
┌─────────────────────────────────────────────┐
│              服务层                          │
├─────────────────────────────────────────────┤
│  文档服务  │  版本服务  │  权限服务  │  搜索服务 │
└─────────────────────────────────────────────┘
                    ↓
┌─────────────────────────────────────────────┐
│              存储层                          │
│  OSS(文档存储)  │  MySQL(元数据)  │  ES(全文检索) │
└─────────────────────────────────────────────┘

-- 文档元数据表
CREATE TABLE document (
    id BIGINT PRIMARY KEY,
    title VARCHAR(255),
    version VARCHAR(32),        -- 语义版本号
    status VARCHAR(32),         -- draft/review/published/archived
    author_id BIGINT,
    department VARCHAR(64),     -- 所属部门
    created_at DATETIME,
    updated_at DATETIME
);

-- 文档版本关联表
CREATE TABLE document_version (
    id BIGINT PRIMARY KEY,
    doc_id BIGINT,
    version VARCHAR(32),
    oss_path VARCHAR(512),
    changelog TEXT,
    created_at DATETIME
);

-- 权限策略表（RBAC扩展）
CREATE TABLE policy (
    id BIGINT PRIMARY KEY,
    resource_type VARCHAR(64),  -- document/folder/tag
    resource_id BIGINT,
    role VARCHAR(64),           -- manager/editor/viewer
    subject_type VARCHAR(64),   -- user/department/role
    subject_id VARCHAR(128)
);

draft → review → published → archived
          ↓
       rejected → draft

# 获取有效版本
GET /api/documents/{id}/active
→ { version: "3.2.0-published", content_url: "..." }

# 获取版本历史
GET /api/documents/{id}/versions
→ [{ version: "3.2.0", status: "published" },
   { version: "3.1.2", status: "archived" }]

# 发布新版本
POST /api/documents/{id}/versions
Body: { version: "3.3.0", content: "...", changelog: "增加DeepSeek模型说明" }

{
  "policies": [
    {
      "resource": "doc:ai-spec",
      "role": "viewer",
      "subject": "dept:marketing",
      "effect": "allow"
    },
    {
      "resource": "doc:ai-spec",
      "role": "editor",
      "subject": "dept:it",
      "effect": "allow"
    },
    {
      "resource": "doc:ai-spec",
      "role": "admin",
      "subject": "user:admin",
      "effect": "allow"
    }
  ]
}

1. 用户发起请求 GET /documents/{id}
2. 网关解析JWT，获取用户身份(user_id/dept/roles)
3. 权限引擎查询该文档的策略
4. 匹配用户身份与策略规则
   - 用户是否在白名单？
   - 部门是否匹配？
   - 角色是否满足？
5. 返回200或403

def auth_middleware(request):
    user = get_user_from_token(request.token)
    doc = get_document(request.doc_id)
    
    policies = get_policies(doc.id)
    
    for policy in policies:
        if check_policy(user, policy):
            return next()
    
    return HTTPResponse(403, "无权限访问")

GET /api/search?q=AI规范&department=marketing
→ {
    "docs": [
        { "title": "AI工具使用规范", "version": "3.2.0", "score": 0.95 },
        { "title": "数据安全红线", "version": "2.1.0", "score": 0.82 }
    ]
}