《游戏服务端架构·品类、状态与拓扑》6.2 反作弊应该放在架构的哪一层

客户端完整性 ──┐
网关频率/协议 ──┼──> 评分与归因 ──> 阈值分级 ──> 人工复核 / 封禁
战斗服规则 ────┤         │
经济审计 ──────┤         └──> 证据链（只追加、可校验）
离线复核 ──────┘

// file: internal/anticheat/engine.go
// tier: L1
// verify: go test ./internal/anticheat/
package anticheat

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"sort"
	"time"
)

// Layer names where a signal was produced. The order is the escalation order,
// not a priority: a cheap gateway rule runs long before an expensive replay
// review, and a ban should never rest on one layer alone.
type Layer string

const (
	LayerClient  Layer = "client"
	LayerGateway Layer = "gateway"
	LayerBattle  Layer = "battle"
	LayerEconomy Layer = "economy"
	LayerReview  Layer = "review"
)

// Finding is one rule hit. Score is a policy weight, not a probability.
type Finding struct {
	Rule   string
	Layer  Layer
	Score  int
	Detail string
}

// Evidence is an append-only record. PrevHash and Hash make the trail
// tamper-evident without requiring a database trigger.
type Evidence struct {
	Seq      int
	PlayerID string
	Rule     string
	Layer    Layer
	Score    int
	Detail   string
	At       time.Time
	TraceID  string
	PrevHash string
	Hash     string
}

type Verdict string

const (
	VerdictPass   Verdict = "pass"
	VerdictWatch  Verdict = "watch"
	VerdictReview Verdict = "review"
	VerdictBan    Verdict = "ban"
)

// Policy separates "how much evidence" from "how much corroboration". A ban
// requires both a score and findings from at least MinBanLayers layers.
type Policy struct {
	Watch        int
	Review       int
	Ban          int
	MinBanLayers int
}

func DefaultPolicy() Policy {
	return Policy{Watch: 20, Review: 60, Ban: 120, MinBanLayers: 2}
}

type Engine struct {
	policy   Policy
	scores   map[string]int
	layers   map[string]map[Layer]int
	evidence []Evidence
}

func NewEngine(p Policy) *Engine {
	if p.MinBanLayers < 1 {
		p.MinBanLayers = 1
	}
	return &Engine{
		policy: p,
		scores: make(map[string]int),
		layers: make(map[string]map[Layer]int),
	}
}

// Record appends a finding and returns the sealed evidence record. Callers must
// keep the returned record; the in-memory chain is a convenience, not storage.
func (e *Engine) Record(playerID string, at time.Time, traceID string, f Finding) Evidence {
	ev := Evidence{
		Seq:      len(e.evidence) + 1,
		PlayerID: playerID,
		Rule:     f.Rule,
		Layer:    f.Layer,
		Score:    f.Score,
		Detail:   f.Detail,
		At:       at.UTC(),
		TraceID:  traceID,
	}
	if n := len(e.evidence); n > 0 {
		ev.PrevHash = e.evidence[n-1].Hash
	}
	ev.Hash = hashEvidence(ev.PrevHash, ev)

	e.evidence = append(e.evidence, ev)
	e.scores[playerID] += f.Score
	if e.layers[playerID] == nil {
		e.layers[playerID] = make(map[Layer]int)
	}
	e.layers[playerID][f.Layer] += f.Score
	return ev
}

type Assessment struct {
	PlayerID string
	Score    int
	Layers   []Layer
	Verdict  Verdict
	Note     string
}

// Assess caps a single-layer score at review. This is the architecture rule
// that says "no single sensor may ban an account".
func (e *Engine) Assess(playerID string) Assessment {
	layers := make([]Layer, 0, len(e.layers[playerID]))
	for layer := range e.layers[playerID] {
		layers = append(layers, layer)
	}
	sort.Slice(layers, func(i, j int) bool { return layers[i] < layers[j] })

	verdict := e.verdict(e.scores[playerID])
	note := ""
	if verdict == VerdictBan && len(layers) < e.policy.MinBanLayers {
		verdict = VerdictReview
		note = "ban requires corroboration from at least two layers"
	}
	return Assessment{
		PlayerID: playerID,
		Score:    e.scores[playerID],
		Layers:   layers,
		Verdict:  verdict,
		Note:     note,
	}
}

func (e *Engine) verdict(score int) Verdict {
	switch {
	case score >= e.policy.Ban:
		return VerdictBan
	case score >= e.policy.Review:
		return VerdictReview
	case score >= e.policy.Watch:
		return VerdictWatch
	default:
		return VerdictPass
	}
}

func (e *Engine) Score(playerID string) int { return e.scores[playerID] }

func (e *Engine) LayerScore(playerID string, layer Layer) int {
	return e.layers[playerID][layer]
}

func (e *Engine) Evidence() []Evidence {
	return append([]Evidence(nil), e.evidence...)
}

// VerifyChain recomputes every hash and link. A modified score, detail or
// timestamp anywhere in the trail fails the whole chain.
func VerifyChain(evidence []Evidence) error {
	prev := ""
	for i, ev := range evidence {
		if ev.Seq != i+1 {
			return fmt.Errorf("anticheat: evidence %d has seq %d", i, ev.Seq)
		}
		if ev.PrevHash != prev {
			return fmt.Errorf("anticheat: evidence %d prev hash mismatch", i)
		}
		if ev.Hash != hashEvidence(prev, ev) {
			return fmt.Errorf("anticheat: evidence %d hash mismatch", i)
		}
		prev = ev.Hash
	}
	return nil
}

func hashEvidence(prev string, ev Evidence) string {
	raw := fmt.Sprintf("%s|%s|%s|%s|%d|%d|%s|%s|%s",
		prev, ev.PlayerID, ev.Rule, ev.Layer, ev.Score, ev.Seq,
		ev.At.UTC().Format(time.RFC3339Nano), ev.TraceID, ev.Detail)
	sum := sha256.Sum256([]byte(raw))
	return hex.EncodeToString(sum[:])
}

$ go test -count=1 -v ./internal/anticheat/
--- PASS: TestVerdictThresholds (0.00s)
--- PASS: TestBanRequiresTwoLayers (0.00s)
--- PASS: TestLayerAttribution (0.00s)
--- PASS: TestAssessmentTable (0.00s)
--- PASS: TestEvidenceChainDetectsTampering (0.00s)
PASS
ok  	gsarchlab/internal/anticheat	0.268s