わずか3秒の音声から「社長の声」まで偽造される時代——偽の振込先変更メール（BEC）をどう見破るか？

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum BecRiskVerdict {
    Clean,
    ReplyToDomainDivergence,
    PunycodeOrHomographSuspected,
    DisplayNameExecutiveImpersonation,
}

/// Extracts the lowercase domain part after `@` from an RFC 5322 address token.
#[inline]
pub fn extract_domain(addr: &str) -> Option<&str> {
    let trimmed = addr.trim().trim_matches(|c| c == '<' || c == '>');
    let at_pos = trimmed.rfind('@')?;
    Some(&trimmed[at_pos + 1..])
}

/// Checks for common ASCII visual lookalikes ("rn" -> "m", "vv" -> "w", "cl" -> "d", Puncyode "xn--").
#[inline]
pub fn has_homograph_or_punycode_pattern(domain: &str) -> bool {
    let bytes = domain.as_bytes();
    if domain.starts_with("xn--") || domain.contains(".xn--") {
        return true;
    }
    // Check non-ASCII bytes (mixed-script UTF-8 in domain header)
    if bytes.iter().any(|&b| b > 0x7F) {
        return true;
    }
    false
}

/// Evaluates an incoming email's From, Reply-To, and known executive names for BEC anomalies.
pub fn inspect_bec_headers(
    header_from_addr: &str,
    header_from_display: &str,
    reply_to_addr: Option<&str>,
    trusted_org_domain: &str,
    protected_executive_names: &[&str],
) -> BecRiskVerdict {
    let Some(from_dom) = extract_domain(header_from_addr) else {
        return BecRiskVerdict::PunycodeOrHomographSuspected;
    };

    if has_homograph_or_punycode_pattern(from_dom) {
        return BecRiskVerdict::PunycodeOrHomographSuspected;
    }

    if let Some(reply_raw) = reply_to_addr {
        if let Some(reply_dom) = extract_domain(reply_raw) {
            if !reply_dom.eq_ignore_ascii_case(from_dom) {
                return BecRiskVerdict::ReplyToDomainDivergence;
            }
        }
    }

    // Executive Display-Name spoofing from external domain
    if !from_dom.eq_ignore_ascii_case(trusted_org_domain) {
        for &exec_name in protected_executive_names {
            if header_from_display.contains(exec_name) {
                return BecRiskVerdict::DisplayNameExecutiveImpersonation;
            }
        }
    }

    BecRiskVerdict::Clean
}