クラウド共有フォルダの「リンクを知っている全員が閲覧可能」設定による情報漏洩と、
安全なファイル受け渡し設計

#![forbid(unsafe_code)]

/// Maximum permitted lifetime for external file sharing links (7 days in seconds).
pub const MAX_EXTERNAL_SHARE_TTL_SECS: u64 = 7 * 24 * 3600;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ShareScope {
    InternalOnly,
    SpecificVerifiedPrincipals,
    AnyoneWithLinkBearer,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ResourceKind {
    SingleFileObject,
    DirectoryContainer,
}

#[derive(Debug, Clone)]
pub struct SharePolicyEntry {
    pub object_id: u64,
    pub kind: ResourceKind,
    pub scope: ShareScope,
    pub created_at_epoch: u64,
    pub expires_at_epoch: Option<u64>,
    pub allow_editor_write: bool,
    pub recipient_principal_hash: Option<[u8; 32]>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum PolicyViolation {
    PublicBearerLinkForbidden { object_id: u64 },
    DirectoryLevelExternalShareForbidden { object_id: u64 },
    MissingOrExcessiveExpiration { object_id: u64 },
    ExternalWritePermissionRisk { object_id: u64 },
    MissingRecipientBinding { object_id: u64 },
}

/// Audits a cloud storage sharing entry against zero-leakage corporate governance rules.
pub fn audit_share_policy(entry: &SharePolicyEntry) -> Vec<PolicyViolation> {
    let mut violations = Vec::new();

    if entry.scope == ShareScope::InternalOnly {
        return violations;
    }

    // 1. "Anyone with the link" bearer access is strictly prohibited
    if entry.scope == ShareScope::AnyoneWithLinkBearer {
        violations.push(PolicyViolation::PublicBearerLinkForbidden {
            object_id: entry.object_id,
        });
    }

    // 2. Directories must never be shared externally (prevents future child object leakage)
    if entry.kind == ResourceKind::DirectoryContainer {
        violations.push(PolicyViolation::DirectoryLevelExternalShareForbidden {
            object_id: entry.object_id,
        });
    }

    // 3. Enforce strict TTL bound (<= 7 days)
    match entry.expires_at_epoch {
        None => violations.push(PolicyViolation::MissingOrExcessiveExpiration {
            object_id: entry.object_id,
        }),
        Some(exp) => {
            let ttl = exp.saturating_sub(entry.created_at_epoch);
            if ttl == 0 || ttl > MAX_EXTERNAL_SHARE_TTL_SECS {
                violations.push(PolicyViolation::MissingOrExcessiveExpiration {
                    object_id: entry.object_id,
                });
            }
        }
    }

    // 4. External shares should be read-only by default and bound to a verified recipient
    if entry.allow_editor_write {
        violations.push(PolicyViolation::ExternalWritePermissionRisk {
            object_id: entry.object_id,
        });
    }
    if entry.recipient_principal_hash.is_none() {
        violations.push(PolicyViolation::MissingRecipientBinding {
            object_id: entry.object_id,
        });
    }

    violations
}

/// Constant-time 32-byte digest comparison to prevent timing side-channel leaks.
#[inline]
pub fn constant_time_eq_32(a: &[u8; 32], b: &[u8; 32]) -> bool {
    let mut diff: u8 = 0;
    for i in 0..32 {
        diff |= a[i] ^ b[i];
    }
    diff == 0
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn rejects_unbounded_directory_bearer_link() {
        let bad_entry = SharePolicyEntry {
            object_id: 42,
            kind: ResourceKind::DirectoryContainer,
            scope: ShareScope::AnyoneWithLinkBearer,
            created_at_epoch: 1_700_000_000,
            expires_at_epoch: None,
            allow_editor_write: true,
            recipient_principal_hash: None,
        };
        let issues = audit_share_policy(&bad_entry);
        assert_eq!(issues.len(), 5);
    }
}