医科・歯科クリニック・薬局のための
「オンライン資格確認・電子カルテ・保守回線」安全点検ガイド

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ClinicZone {
    ElectronicHealthRecordVlan10,
    OnlineQualificationVlan20,
    OfficeInternetVlan30,
    GuestWifiVlan40,
    MaintenanceBastionVlan99,
}

#[derive(Debug, Clone)]
pub struct JitMaintenanceTicket {
    pub ticket_id: u64,
    pub vendor_cert_fingerprint: [u8; 32],
    pub approved_by_clinic_director: bool,
    pub valid_from_unix: u64,
    pub valid_until_unix: u64,
    pub session_recording_active: bool,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AccessDecision {
    AllowIsolatedInternal,
    AllowApprovedMaintenance { remaining_sec: u64 },
    DenyCrossZoneViolation,
    DenyUnapprovedOrExpiredTicket,
    DenyMaxDurationExceeded,
}

pub const MAX_MAINTENANCE_WINDOW_SEC: u64 = 7_200; — Max 2 hours per approval

pub fn evaluate_medical_zone_flow(
    src: ClinicZone,
    dst: ClinicZone,
    now_unix: u64,
    ticket: Option<&JitMaintenanceTicket>,
    presented_fingerprint: Option<&[u8; 32]>,
) -> AccessDecision {
    if src == dst && src != ClinicZone::GuestWifiVlan40 {
        return AccessDecision::AllowIsolatedInternal;
    }

    if src == ClinicZone::MaintenanceBastionVlan99 && dst == ClinicZone::ElectronicHealthRecordVlan10 {
        let Some(t) = ticket else {
            return AccessDecision::DenyUnapprovedOrExpiredTicket;
        };
        let Some(fp) = presented_fingerprint else {
            return AccessDecision::DenyUnapprovedOrExpiredTicket;
        };

        if !t.approved_by_clinic_director || !t.session_recording_active || &t.vendor_cert_fingerprint != fp {
            return AccessDecision::DenyUnapprovedOrExpiredTicket;
        }
        if t.valid_until_unix.saturating_sub(t.valid_from_unix) > MAX_MAINTENANCE_WINDOW_SEC {
            return AccessDecision::DenyMaxDurationExceeded;
        }
        if now_unix < t.valid_from_unix || now_unix > t.valid_until_unix {
            return AccessDecision::DenyUnapprovedOrExpiredTicket;
        }

        return AccessDecision::AllowApprovedMaintenance {
            remaining_sec: t.valid_until_unix - now_unix,
        };
    }

    AccessDecision::DenyCrossZoneViolation
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_office_or_guest_to_ehr_is_strictly_denied() {
        let dec = evaluate_medical_zone_flow(
            ClinicZone::OfficeInternetVlan30,
            ClinicZone::ElectronicHealthRecordVlan10,
            1_710_000_000,
            None,
            None,
        );
        assert_eq!(dec, AccessDecision::DenyCrossZoneViolation);
    }
}