flowchart TB
    subgraph Client["客户端层"]
        WebApp["Web应用"]
        MobileApp["移动端"]
        ThirdParty["第三方集成"]
    end

    subgraph Gateway["网关层"]
        IstioGW["Istio Gateway<br/>TLS终止/路由转发"]
    end

    subgraph MiddlewareLayer["中间件层 pkg/middleware"]
        AuthMW["Auth Middleware<br/>JWT验证/权限检查"]
        TenantMW["Tenant Middleware<br/>租户隔离"]
        RateLimitMW["Rate Limiter<br/>请求限流"]
        IdempotencyMW["Idempotency<br/>幂等性保证"]
        RedactMW["PII Redact<br/>敏感信息脱敏"]
    end

    subgraph ResilienceLayer["弹性层 pkg/resilience"]
        CB["Circuit Breaker<br/>熔断器"]
        Retry["Retry Policy<br/>重试策略"]
        Degradation["Degradation<br/>降级管理"]
        RateLimiterAdv["Advanced Rate Limiter<br/>高级限流器"]
    end

    subgraph Services["业务服务层"]
        Identity["Identity Service"]
        Conversation["Conversation Service"]
        Knowledge["Knowledge Service"]
        Orchestrator["AI Orchestrator"]
    end

    subgraph Storage["存储层"]
        Redis["Redis<br/>缓存/限流/锁"]
        PostgreSQL["PostgreSQL<br/>用户数据"]
    end

    subgraph Monitoring["监控层"]
        Prometheus["Prometheus<br/>指标采集"]
        Jaeger["Jaeger<br/>分布式追踪"]
    end

    Client --> Gateway
    Gateway --> MiddlewareLayer
    MiddlewareLayer --> ResilienceLayer
    ResilienceLayer --> Services

    AuthMW --> Redis
    AuthMW --> PostgreSQL
    RateLimitMW --> Redis
    IdempotencyMW --> Redis

    CB --> Redis
    Degradation --> Redis

    Services --> Storage
    MiddlewareLayer -.-> Monitoring
    ResilienceLayer -.-> Monitoring
    Services -.-> Monitoring

    style Client fill:#e1f5ff
    style Gateway fill:#fff4e6
    style MiddlewareLayer fill:#e8f5e9
    style ResilienceLayer fill:#f3e5f5
    style Services fill:#fce4ec
    style Storage fill:#fff9c4
    style Monitoring fill:#e0f2f1

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant Gateway as Istio Gateway
    participant AuthMW as Auth Middleware
    participant JWTMgr as JWT Manager
    participant Redis as Redis
    participant Handler as 业务Handler
    participant DB as PostgreSQL

    Client->>Gateway: POST /api/profile<br/>Header: Authorization: Bearer {token}
    Gateway->>AuthMW: 转发请求

    AuthMW->>AuthMW: 1. 提取Authorization header
    alt header为空
        AuthMW-->>Client: 401 Unauthorized<br/>"Authorization header required"
    end

    AuthMW->>AuthMW: 2. 检查Bearer格式
    alt 格式错误
        AuthMW-->>Client: 401 Unauthorized<br/>"Invalid format"
    end

    AuthMW->>JWTMgr: ValidateToken(tokenString)
    JWTMgr->>JWTMgr: 解析JWT结构
    JWTMgr->>JWTMgr: 验证签名（HMAC-SHA256）

    alt Token签名无效
        JWTMgr-->>AuthMW: ErrInvalidToken
        AuthMW-->>Client: 401 Unauthorized<br/>"Invalid token"
    end

    JWTMgr->>JWTMgr: 检查过期时间
    alt Token已过期
        JWTMgr-->>AuthMW: ErrExpiredToken
        AuthMW-->>Client: 401 Unauthorized<br/>"Token expired"
    end

    JWTMgr->>Redis: GET token_blacklist:{token_hash}
    alt Token在黑名单中
        Redis-->>JWTMgr: "revoked"
        JWTMgr-->>AuthMW: ErrRevokedToken
        AuthMW-->>Client: 401 Unauthorized<br/>"Token revoked"
    end

    Redis-->>JWTMgr: nil (Token有效)
    JWTMgr-->>AuthMW: Claims{UserID, Username, Roles}

    AuthMW->>AuthMW: 4. 注入上下文
    Note over AuthMW: c.Set("user_id", claims.UserID)<br/>c.Set("username", claims.Username)<br/>c.Set("roles", claims.Roles)

    AuthMW->>Handler: c.Next() 继续处理
    Handler->>DB: 查询用户资料
    DB-->>Handler: 用户数据
    Handler-->>AuthMW: 响应数据
    AuthMW-->>Gateway: 200 OK + 数据
    Gateway-->>Client: 返回响应

authHeader := c.GetHeader("Authorization")
if authHeader == "" {
    c.JSON(http.StatusUnauthorized, gin.H{
        "error": "Authorization header required",
    })
    c.Abort()
    return
}

parts := strings.SplitN(authHeader, " ", 2)
if len(parts) != 2 || parts[0] != "Bearer" {
    c.JSON(http.StatusUnauthorized, gin.H{
        "error": "Invalid authorization header format",
    })
    c.Abort()
    return
}
tokenString := parts[1]

claims, err := jwtManager.ValidateToken(tokenString)

func (m *JWTManager) ValidateToken(tokenString string) (*Claims, error) {
    // 1. 解析Token
    token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
        // 验证签名算法
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, ErrInvalidToken
        }
        return []byte(m.secretKey), nil
    })

    if err != nil {
        if errors.Is(err, jwt.ErrTokenExpired) {
            return nil, ErrExpiredToken
        }
        return nil, ErrInvalidToken
    }

    // 2. 提取Claims
    if claims, ok := token.Claims.(*Claims); ok && token.Valid {
        // 3. 检查黑名单（在实际实现中）
        // isBlacklisted := redis.Exists("token_blacklist:" + tokenHash)
        return claims, nil
    }

    return nil, ErrInvalidToken
}

c.Set("user_id", claims.UserID)
c.Set("username", claims.Username)
c.Set("email", claims.Email)
c.Set("roles", claims.Roles)
c.Set("claims", claims)

c.Next()

func RequirePermission(rbacManager *auth.RBACManager, permission auth.Permission) gin.HandlerFunc {
    return func(c *gin.Context) {
        // 1. 从上下文获取角色
        rolesInterface, exists := c.Get("roles")
        if !exists {
            c.JSON(http.StatusForbidden, gin.H{
                "error": "No roles found in context",
            })
            c.Abort()
            return
        }

        roles, ok := rolesInterface.([]string)
        if !ok {
            c.JSON(http.StatusForbidden, gin.H{
                "error": "Invalid roles format",
            })
            c.Abort()
            return
        }

        // 2. 检查权限
        if !rbacManager.CheckUserPermission(roles, permission) {
            c.JSON(http.StatusForbidden, gin.H{
                "error":      "Insufficient permissions",
                "required":   permission,
                "user_roles": roles,
            })
            c.Abort()
            return
        }

        c.Next()
    }
}

r := gin.Default()

// 初始化JWT Manager和RBAC Manager
jwtManager := auth.NewJWTManager(
    "secret-key",
    15*time.Minute,  // access token过期时间
    7*24*time.Hour,  // refresh token过期时间
)
rbacManager := auth.NewRBACManager()

// 公开路由
public := r.Group("/api/v1/public")
{
    public.POST("/login", loginHandler)
    public.POST("/register", registerHandler)
}

// 需要认证的路由
authorized := r.Group("/api/v1")
authorized.Use(middleware.AuthMiddleware(jwtManager))
{
    // 任何已认证用户可访问
    authorized.GET("/profile", getProfile)

    // 需要特定权限
    documents := authorized.Group("/documents")
    documents.Use(middleware.RequirePermission(rbacManager, auth.PermissionWriteKG))
    {
        documents.POST("", createDocument)
        documents.PUT("/:id", updateDocument)
    }

    // 需要管理员角色
    admin := authorized.Group("/admin")
    admin.Use(middleware.RequireRole(auth.RoleAdmin))
    {
        admin.GET("/users", listUsers)
        admin.POST("/tenants", createTenant)
    }
}

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant RateLimiter as Rate Limiter MW
    participant Redis as Redis
    participant Handler as 业务Handler

    Client->>RateLimiter: 发送请求
    RateLimiter->>RateLimiter: 构建限流key<br/>rate_limit:{tenant}:{user}

    RateLimiter->>Redis: Pipeline开始
    RateLimiter->>Redis: INCR rate_limit:{tenant}:{user}
    RateLimiter->>Redis: EXPIRE rate_limit:{tenant}:{user} {window}
    RateLimiter->>Redis: Pipeline执行

    Redis-->>RateLimiter: 返回计数值 (count)

    alt count > maxRequests
        RateLimiter->>RateLimiter: 设置响应头<br/>X-RateLimit-Limit<br/>X-RateLimit-Remaining: 0<br/>X-RateLimit-Reset
        RateLimiter-->>Client: 429 Too Many Requests<br/>{"error": "rate limit exceeded",<br/>"retry_after": 60}
    else count ≤ maxRequests
        RateLimiter->>RateLimiter: 设置响应头<br/>X-RateLimit-Remaining: {maxRequests-count}
        RateLimiter->>Handler: c.Next() 继续处理
        Handler-->>RateLimiter: 返回响应
        RateLimiter-->>Client: 200 OK + 响应数据
    end

tenantID := c.GetString("tenant_id")
userID := c.GetString("user_id")
key := fmt.Sprintf("%s:%s:%s", config.KeyPrefix, tenantID, userID)

pipe := config.RedisClient.Pipeline()
incr := pipe.Incr(ctx, key)
pipe.Expire(ctx, key, config.Window)
_, err := pipe.Exec(ctx)

count := incr.Val()

if count > int64(config.MaxRequests) {
    c.Header("X-RateLimit-Limit", fmt.Sprintf("%d", config.MaxRequests))
    c.Header("X-RateLimit-Remaining", "0")
    c.Header("X-RateLimit-Reset", fmt.Sprintf("%d", time.Now().Add(config.Window).Unix()))

    c.JSON(429, gin.H{
        "error":       "rate limit exceeded",
        "retry_after": config.Window.Seconds(),
    })
    c.Abort()
    return
}

remaining := config.MaxRequests - int(count)
c.Header("X-RateLimit-Limit", fmt.Sprintf("%d", config.MaxRequests))
c.Header("X-RateLimit-Remaining", fmt.Sprintf("%d", remaining))
c.Header("X-RateLimit-Reset", fmt.Sprintf("%d", time.Now().Add(config.Window).Unix()))

c.Next()

func RateLimiterByIP(config RateLimiterConfig) gin.HandlerFunc {
    return func(c *gin.Context) {
        // 获取客户端IP
        clientIP := c.ClientIP()
        key := fmt.Sprintf("%s:%s", config.KeyPrefix, clientIP)

        // Redis计数逻辑（同上）
        pipe := config.RedisClient.Pipeline()
        incr := pipe.Incr(ctx, key)
        pipe.Expire(ctx, key, config.Window)
        _, err := pipe.Exec(ctx)

        count := incr.Val()
        if count > int64(config.MaxRequests) {
            c.JSON(429, gin.H{
                "error":       "too many requests from this IP",
                "retry_after": config.Window.Seconds(),
            })
            c.Abort()
            return
        }

        c.Next()
    }
}

// 用户级限流：每用户每分钟100次请求
userRateLimiter := middleware.RateLimiter(middleware.RateLimiterConfig{
    RedisClient: redisClient,
    MaxRequests: 100,
    Window:      time.Minute,
    KeyPrefix:   "rate_limit_user",
})

// IP级限流：每IP每分钟1000次请求（更宽松）
ipRateLimiter := middleware.RateLimiterByIP(middleware.RateLimiterConfig{
    RedisClient: redisClient,
    MaxRequests: 1000,
    Window:      time.Minute,
    KeyPrefix:   "rate_limit_ip",
})

// 应用中间件
router.Use(ipRateLimiter)  // 先执行IP限流
router.Use(authMiddleware)  // 认证
router.Use(userRateLimiter) // 再执行用户限流

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant Idempotency as Idempotency MW
    participant Redis as Redis
    participant Handler as 业务Handler
    participant DB as 数据库

    Client->>Idempotency: POST /create-order<br/>Header: Idempotency-Key: {uuid}

    Idempotency->>Idempotency: 提取Idempotency-Key
    alt Key为空
        Idempotency->>Handler: c.Next() 不做幂等性检查
    end

    Idempotency->>Idempotency: 构建Redis Key<br/>hash = SHA256(method+path+key+tenant+user)

    Idempotency->>Redis: GET idempotency:{hash}
    alt 已存在（请求已处理）
        Redis-->>Idempotency: 缓存的响应结果
        Idempotency->>Idempotency: 设置响应头<br/>X-Idempotency-Replayed: true
        Idempotency-->>Client: 200 OK + 缓存结果
    end

    Redis-->>Idempotency: nil (新请求)

    Idempotency->>Redis: SETNX idempotency:{hash}:lock 1 EX 30
    alt 加锁失败（正在处理中）
        Redis-->>Idempotency: false
        Idempotency-->>Client: 409 Conflict<br/>{"error": "request is being processed"}
    end

    Redis-->>Idempotency: true (加锁成功)

    Idempotency->>Idempotency: 包装ResponseWriter<br/>捕获响应body

    Idempotency->>Handler: c.Next() 执行业务逻辑
    Handler->>DB: INSERT INTO orders...
    DB-->>Handler: order_id: 12345
    Handler-->>Idempotency: 返回响应<br/>{"order_id": 12345}

    alt 响应成功 (2xx)
        Idempotency->>Redis: SET idempotency:{hash}<br/> value: response_body<br/> EX 120
    end

    Idempotency->>Redis: DEL idempotency:{hash}:lock

    Idempotency-->>Client: 200 OK<br/>{"order_id": 12345}

idempotencyKey := c.GetHeader(IdempotencyKeyHeader)
if idempotencyKey == "" {
    // 没有提供幂等性Key，直接放行
    c.Next()
    return
}

tenantID := c.GetString("tenant_id")
userID := c.GetString("user_id")

hashInput := fmt.Sprintf("%s:%s:%s:%s:%s",
    c.Request.Method,
    c.Request.URL.Path,
    idempotencyKey,
    tenantID,
    userID,
)
hash := sha256.Sum256([]byte(hashInput))
redisKey := fmt.Sprintf("%s:%s", config.KeyPrefix, hex.EncodeToString(hash[:]))

result, err := config.RedisClient.Get(ctx, redisKey).Result()
if err == nil {
    // 已处理，返回缓存结果
    c.Header("X-Idempotency-Replayed", "true")
    c.Data(200, "application/json", []byte(result))
    c.Abort()
    return
}

lockKey := fmt.Sprintf("%s:lock", redisKey)
locked, err := config.RedisClient.SetNX(ctx, lockKey, "1", 30*time.Second).Result()

if !locked {
    // 正在处理中
    c.JSON(409, gin.H{"error": "request is being processed"})
    c.Abort()
    return
}

writer := &responseWriter{
    ResponseWriter: c.Writer,
    body:           []byte{},
}
c.Writer = writer

c.Next()

// 如果请求成功，缓存结果
if c.Writer.Status() >= 200 && c.Writer.Status() < 300 {
    config.RedisClient.Set(ctx, redisKey, writer.body, config.TTL)
}

// 释放锁
config.RedisClient.Del(ctx, lockKey)

stateDiagram-v2
    [*] --> Closed: 初始化

    Closed --> Open: 失败次数 ≥ MaxFailures
    Closed --> Closed: 请求成功 (重置计数器)

    Open --> HalfOpen: 超时时间 > Timeout
    Open --> Open: 请求被拒绝 (快速失败)

    HalfOpen --> Closed: 成功次数 ≥ SuccessThreshold
    HalfOpen --> Open: 任何请求失败
    HalfOpen --> HalfOpen: 请求数 < MaxRequests (限流)

    note right of Closed
        正常状态
        允许所有请求
        统计失败次数
    end note

    note right of Open
        熔断状态
        拒绝所有请求
        等待超时恢复
    end note

    note right of HalfOpen
        半开状态
        限流试探恢复
        快速失败或恢复
    end note

sequenceDiagram
    autonumber
    participant Service as 调用方服务
    participant CB as Circuit Breaker
    participant Redis as Redis
    participant Downstream as 下游服务

    Note over CB: 初始状态: Closed

    Service->>CB: Execute(func() error)
    CB->>CB: beforeRequest()<br/>检查状态

    alt 状态 = Closed
        CB->>Downstream: 调用下游服务
        Downstream-->>CB: 返回结果

        alt 请求成功
            CB->>CB: afterRequest(nil)<br/>重置failureCount=0
            CB-->>Service: 返回成功结果
        else 请求失败
            CB->>CB: afterRequest(err)<br/>failureCount++

            alt failureCount >= MaxFailures
                CB->>CB: setState(Open)<br/>触发熔断
                CB->>Redis: SET circuit_breaker:{service}<br/>state: Open
                CB->>CB: 回调 OnStateChange(Closed, Open)
            end

            CB-->>Service: 返回错误
        end
    end

    Note over CB: 状态转换为 Open

    Service->>CB: Execute(func() error)
    CB->>CB: beforeRequest()<br/>状态 = Open

    alt now - lastStateTime < Timeout
        CB-->>Service: ErrCircuitOpen<br/>快速失败（不调用下游）
    else now - lastStateTime ≥ Timeout
        CB->>CB: setState(HalfOpen)<br/>尝试恢复
        CB->>Redis: SET circuit_breaker:{service}<br/>state: HalfOpen

        CB->>Downstream: 调用下游服务

        alt 请求成功
            CB->>CB: successCount++

            alt successCount >= SuccessThreshold
                CB->>CB: setState(Closed)<br/>完全恢复
                CB->>Redis: SET circuit_breaker:{service}<br/>state: Closed
            end

            CB-->>Service: 返回成功结果
        else 请求失败
            CB->>CB: setState(Open)<br/>重新熔断
            CB->>Redis: SET circuit_breaker:{service}<br/>state: Open
            CB-->>Service: 返回错误
        end
    end

func (cb *CircuitBreaker) beforeRequest() error {
    cb.mu.Lock()
    defer cb.mu.Unlock()

    now := time.Now()

    switch cb.state {
    case StateClosed:
        // 关闭状态，允许请求
        return nil

    case StateOpen:
        // 检查是否可以转为半开状态
        if now.Sub(cb.lastStateTime) > cb.config.Timeout {
            cb.setState(StateHalfOpen, now)
            return nil
        }
        return ErrCircuitOpen

    case StateHalfOpen:
        // 半开状态，限制请求数
        if cb.successCount+cb.failureCount >= cb.config.MaxRequests {
            return ErrTooManyRequests
        }
        return nil

    default:
        return ErrCircuitOpen
    }
}

func (cb *CircuitBreaker) Execute(ctx context.Context, fn func() error) error {
    if err := cb.beforeRequest(); err != nil {
        return err
    }

    err := fn()

    cb.afterRequest(err)

    return err
}

func (cb *CircuitBreaker) afterRequest(err error) {
    cb.mu.Lock()
    defer cb.mu.Unlock()

    now := time.Now()

    if err != nil {
        cb.onFailure(now)
    } else {
        cb.onSuccess(now)
    }
}

func (cb *CircuitBreaker) onFailure(now time.Time) {
    cb.failureCount++
    cb.lastFailTime = now

    switch cb.state {
    case StateClosed:
        // 检查是否达到失败阈值
        if cb.failureCount >= cb.config.MaxFailures {
            cb.setState(StateOpen, now)
        }

    case StateHalfOpen:
        // 半开状态失败，重新打开
        cb.setState(StateOpen, now)
    }
}

func (cb *CircuitBreaker) onSuccess(now time.Time) {
    switch cb.state {
    case StateClosed:
        // 关闭状态，重置失败计数
        cb.failureCount = 0

    case StateHalfOpen:
        // 半开状态，增加成功计数
        cb.successCount++
        if cb.successCount >= cb.config.SuccessThreshold {
            // 达到成功阈值，关闭熔断器
            cb.setState(StateClosed, now)
        }
    }
}

// 创建熔断器
cb := resilience.NewCircuitBreaker(resilience.Config{
    MaxFailures:      5,               // 5次失败后熔断
    Timeout:          60 * time.Second, // 熔断60秒后尝试恢复
    MaxRequests:      3,                // 半开状态允许3个并发请求
    SuccessThreshold: 2,                // 2次成功后完全恢复
    OnStateChange: func(from, to resilience.State) {
        log.Info().
            Str("from", from.String()).
            Str("to", to.String()).
            Msg("Circuit breaker state changed")
    },
})

// 使用熔断器保护下游调用
err := cb.Execute(ctx, func() error {
    return httpClient.Get("https://api.example.com")
})

if err == resilience.ErrCircuitOpen {
    // 熔断打开，使用降级策略
    return fallbackResponse()
}

sequenceDiagram
    autonumber
    participant Service as 调用方服务
    participant Retry as Retry Policy
    participant Downstream as 下游服务

    Service->>Retry: Retry(ctx, policy, fn)

    Note over Retry: Attempt 0 (首次尝试，无延迟)
    Retry->>Downstream: fn() 执行业务逻辑
    Downstream-->>Retry: 返回错误 (err1)

    Retry->>Retry: 检查错误是否可重试<br/>policy.RetryableErrors(err1)

    alt 不可重试错误
        Retry-->>Service: 直接返回错误
    end

    Note over Retry: Attempt 1
    Retry->>Retry: 计算延迟<br/>delay = InitialDelay * BackoffMultiplier^0<br/>= 100ms
    Retry->>Retry: 触发OnRetry回调<br/>记录日志
    Retry->>Retry: time.Sleep(100ms)

    Retry->>Retry: 检查Context
    alt ctx.Done()
        Retry-->>Service: 返回ctx.Err() (超时/取消)
    end

    Retry->>Downstream: fn() 重试
    Downstream-->>Retry: 返回错误 (err2)

    Note over Retry: Attempt 2
    Retry->>Retry: 计算延迟<br/>delay = InitialDelay * BackoffMultiplier^1<br/>= 100ms * 2 = 200ms
    Retry->>Retry: time.Sleep(200ms)
    Retry->>Downstream: fn() 重试
    Downstream-->>Retry: 返回错误 (err3)

    Note over Retry: Attempt 3 (MaxRetries=3)
    Retry->>Retry: 计算延迟<br/>delay = InitialDelay * BackoffMultiplier^2<br/>= 100ms * 4 = 400ms<br/>限制 ≤ MaxDelay
    Retry->>Retry: time.Sleep(400ms)
    Retry->>Downstream: fn() 最后一次重试
    Downstream-->>Retry: 返回成功

    Retry-->>Service: 返回成功结果

func (p *RetryPolicy) calculateDelay(attempt int) time.Duration {
    delay := float64(p.InitialDelay) * math.Pow(p.BackoffMultiplier, float64(attempt-1))

    // 限制最大延迟
    if delay > float64(p.MaxDelay) {
        delay = float64(p.MaxDelay)
    }

    return time.Duration(delay)
}

func Retry(ctx context.Context, policy RetryPolicy, fn func() error) error {
    var lastErr error

    for attempt := 0; attempt <= policy.MaxRetries; attempt++ {
        // 第一次尝试不延迟
        if attempt > 0 {
            delay := policy.calculateDelay(attempt)

            // 调用重试回调
            if policy.OnRetry != nil {
                policy.OnRetry(attempt, lastErr, delay)
            }

            // 等待延迟
            select {
            case <-ctx.Done():
                return ctx.Err()
            case <-time.After(delay):
            }
        }

        // 执行函数
        err := fn()
        if err == nil {
            return nil
        }

        lastErr = err

        // 检查是否可重试
        if policy.RetryableErrors != nil && !policy.RetryableErrors(err) {
            return err
        }

        // 检查context
        if ctx.Err() != nil {
            return ctx.Err()
        }
    }

    // 超过最大重试次数
    return errors.Join(ErrMaxRetriesExceeded, lastErr)
}

// 默认策略
err := resilience.Retry(
    ctx,
    resilience.DefaultRetryPolicy(),
    func() error {
        return httpClient.Get("https://api.example.com")
    },
)

// 自定义策略
policy := resilience.RetryPolicy{
    MaxRetries:        5,
    InitialDelay:      100 * time.Millisecond,
    MaxDelay:          10 * time.Second,
    BackoffMultiplier: 2.0,
    RetryableErrors: func(err error) bool {
        // 只重试网络错误和5xx错误
        if errors.Is(err, context.DeadlineExceeded) {
            return true
        }
        if httpErr, ok := err.(*HTTPError); ok {
            return httpErr.StatusCode >= 500
        }
        return false
    },
    OnRetry: func(attempt int, err error, delay time.Duration) {
        log.Warn().
            Int("attempt", attempt).
            Err(err).
            Dur("delay", delay).
            Msg("Retrying request")
    },
}

err := resilience.Retry(ctx, policy, func() error {
    return doSomething()
})

sequenceDiagram
    autonumber
    participant Client as 客户端
    participant Gateway as Istio Gateway
    participant Auth as Auth MW
    participant Tenant as Tenant MW
    participant RateLimit as Rate Limit MW
    participant Idempotency as Idempotency MW
    participant CB as Circuit Breaker
    participant Retry as Retry Policy
    participant Service as 业务服务
    participant Redis as Redis
    participant DB as PostgreSQL

    Client->>Gateway: POST /api/documents<br/>Headers: Authorization, X-Tenant-ID, Idempotency-Key
    Gateway->>Auth: 认证检查

    Auth->>Redis: 验证Token + 黑名单检查
    Redis-->>Auth: Token有效
    Auth->>Auth: 注入user_id, roles到context

    Auth->>Tenant: 继续处理
    Tenant->>Tenant: 提取X-Tenant-ID<br/>注入tenant_id到context

    Tenant->>RateLimit: 继续处理
    RateLimit->>Redis: INCR rate_limit:{tenant}:{user}<br/>EXPIRE
    Redis-->>RateLimit: count=45

    alt count > 100 (超限)
        RateLimit-->>Client: 429 Too Many Requests
    end

    RateLimit->>Idempotency: 继续处理 (count=45, 未超限)
    Idempotency->>Redis: GET idempotency:{hash}

    alt 请求已处理
        Redis-->>Idempotency: 缓存响应
        Idempotency-->>Client: 200 OK + 缓存结果<br/>X-Idempotency-Replayed: true
    end

    Idempotency->>Redis: SETNX idempotency:{hash}:lock (加锁)
    Redis-->>Idempotency: 加锁成功

    Idempotency->>CB: 继续处理
    CB->>CB: beforeRequest()<br/>检查熔断器状态

    alt 熔断器Open
        CB-->>Idempotency: ErrCircuitOpen
        Idempotency-->>Client: 503 Service Unavailable
    end

    CB->>Retry: 状态Closed，执行重试策略

    Note over Retry: Attempt 0
    Retry->>Service: 调用业务逻辑
    Service->>DB: INSERT INTO documents...
    DB-->>Service: 网络抖动，临时失败
    Service-->>Retry: 返回错误

    Note over Retry: Attempt 1 (延迟100ms)
    Retry->>Service: 重试
    Service->>DB: INSERT INTO documents...
    DB-->>Service: order_id: 12345
    Service-->>Retry: 成功

    Retry-->>CB: 成功
    CB->>CB: afterRequest(nil)<br/>重置failureCount=0

    CB-->>Idempotency: 返回响应
    Idempotency->>Redis: SET idempotency:{hash} {response}<br/>DEL lock

    Idempotency-->>RateLimit: 返回响应
    RateLimit-->>Tenant: 返回响应
    Tenant-->>Auth: 返回响应
    Auth-->>Gateway: 返回响应
    Gateway-->>Client: 200 OK + 响应数据