func NewAuthStore(lg *zap.Logger, be backend.Backend, tp TokenProvider, bcryptCost int) *authStore {
	if bcryptCost < bcrypt.MinCost || bcryptCost > bcrypt.MaxCost {
		if lg != nil {
			lg.Warn(
				"use default bcrypt cost instead of the invalid given cost",
				zap.Int("min-cost", bcrypt.MinCost),
				zap.Int("max-cost", bcrypt.MaxCost),
				zap.Int("default-cost", bcrypt.DefaultCost),
				zap.Int("given-cost", bcryptCost))
		} else {
			plog.Warningf("Use default bcrypt-cost %d instead of the invalid value %d",
				bcrypt.DefaultCost, bcryptCost)
		}

		bcryptCost = bcrypt.DefaultCost
	}

	tx := be.BatchTx()
	tx.Lock()

	tx.UnsafeCreateBucket(authBucketName)
	tx.UnsafeCreateBucket(authUsersBucketName)
	tx.UnsafeCreateBucket(authRolesBucketName)

	enabled := false
	_, vs := tx.UnsafeRange(authBucketName, enableFlagKey, nil, 0)
	if len(vs) == 1 {
		if bytes.Equal(vs[0], authEnabled) {
			enabled = true
		}
	}

	as := &authStore{
		revision:       getRevision(tx),
		lg:             lg,
		be:             be,
		enabled:        enabled,
		rangePermCache: make(map[string]*unifiedRangePermissions),
		tokenProvider:  tp,
		bcryptCost:     bcryptCost,
	}

	if enabled {
		as.tokenProvider.enable()
	}

	if as.Revision() == 0 {
		as.commitRevision(tx)
	}

	tx.Unlock()
	be.ForceCommit()

	return as
}
func NewAuthStore(lg *zap.Logger, be backend.Backend, tp TokenProvider, bcryptCost int) *authStore {
	if bcryptCost < bcrypt.MinCost || bcryptCost > bcrypt.MaxCost {
		if lg != nil {
			lg.Warn(
				"use default bcrypt cost instead of the invalid given cost",
				zap.Int("min-cost", bcrypt.MinCost),
				zap.Int("max-cost", bcrypt.MaxCost),
				zap.Int("default-cost", bcrypt.DefaultCost),
				zap.Int("given-cost", bcryptCost))
		} else {
			plog.Warningf("Use default bcrypt-cost %d instead of the invalid value %d",
				bcrypt.DefaultCost, bcryptCost)
		}

		bcryptCost = bcrypt.DefaultCost
	}

	tx := be.BatchTx()
	tx.Lock()

	tx.UnsafeCreateBucket(authBucketName)
	tx.UnsafeCreateBucket(authUsersBucketName)
	tx.UnsafeCreateBucket(authRolesBucketName)

	enabled := false
	_, vs := tx.UnsafeRange(authBucketName, enableFlagKey, nil, 0)
	if len(vs) == 1 {
		if bytes.Equal(vs[0], authEnabled) {
			enabled = true
		}
	}

	as := &authStore{
		revision:       getRevision(tx),
		lg:             lg,
		be:             be,
		enabled:        enabled,
		rangePermCache: make(map[string]*unifiedRangePermissions),
		tokenProvider:  tp,
		bcryptCost:     bcryptCost,
	}

	if enabled {
		as.tokenProvider.enable()
	}

	if as.Revision() == 0 {
		as.commitRevision(tx)
	}

	tx.Unlock()
	be.ForceCommit()

	return as
}
// NewAuthStore creates a new AuthStore.