お客様ごとの大切なデータや図面が決して混ざらない「顧客別データ分離設計」：
〜受付係の記憶に頼らず、金庫の扉そのものに鍵をかける「行レベル保護」の知恵〜

#![forbid(unsafe_code)]
use core::marker::PhantomData;

/// Marker trait representing a verified, isolated tenant context.
pub trait VerifiedTenantScope {}

pub struct Unscoped;
pub struct IsolatedTenant;
impl VerifiedTenantScope for IsolatedTenant {}

/// A database session wrapper parameterized by its typestate `S`.
pub struct DbSession<S> {
    tenant_uuid: [u8; 16],
    _scope: PhantomData<S>,
}

impl DbSession<Unscoped> {
    /// Transitions from `Unscoped` to `IsolatedTenant` ONLY after binding the
    /// transaction-local `app.current_tenant_id` GUC inside PostgreSQL 19.
    #[inline]
    pub fn bind_transaction_tenant(tenant_uuid: [u8; 16]) -> DbSession<IsolatedTenant> {
        // In production: executes `SELECT set_config('app.current_tenant_id', $1, true);`
        DbSession {
            tenant_uuid,
            _scope: PhantomData,
        }
    }
}

impl DbSession<IsolatedTenant> {
    /// Only callable on a session proven at compile time to be in `IsolatedTenant` state.
    #[inline]
    pub fn tenant_uuid(&self) -> &[u8; 16] {
        &self.tenant_uuid
    }
}

/// Scans built static artifacts to guarantee zero cross-project domain contamination.
pub fn verify_zero_domain_leakage<'a>(
    artifact_bytes: &'a [u8],
    forbidden_domains: &'a [&'a [u8]],
) -> Result<(), &'a [u8]> {
    for &needle in forbidden_domains {
        if !needle.is_empty()
            && artifact_bytes
                .windows(needle.len())
                .any(|w| w.eq_ignore_ascii_case(needle))
        {
            return Err(needle);
        }
    }
    Ok(())
}