建設業・工務店・設備工事向け：
2026年SCS評価制度（★3）取得実践ガイド：現場タブレット紛失対策と施工図面の安全な共有設計

#![forbid(unsafe_code)]

/// Bitmask flags representing mobile device MDM posture for field tablets.
pub const POSTURE_DISK_ENCRYPTED: u8 = 1 << 0;
pub const POSTURE_BIOMETRIC_LOCKED: u8 = 1 << 1;
pub const POSTURE_OS_PATCH_CURRENT: u8 = 1 << 2;
pub const POSTURE_NOT_REPORTED_LOST: u8 = 1 << 3;
pub const REQUIRED_FIELD_POSTURE: u8 = POSTURE_DISK_ENCRYPTED
    | POSTURE_BIOMETRIC_LOCKED
    | POSTURE_OS_PATCH_CURRENT
    | POSTURE_NOT_REPORTED_LOST;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BlueprintAccessClaim {
    pub project_id: u64,
    pub contractor_id: u64,
    pub allowed_zone_mask: u32,
    pub token_expires_unix: u64,
    pub project_handover_unix: u64,
    pub device_posture_mask: u8,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum SiteSecurityError {
    DevicePostureNonCompliant { missing_bits: u8 },
    LeaseExpiredOrPostHandover,
    ZoneScopeUnauthorized,
    InvalidJpegHeader,
    TruncatedJpegSegment { offset: usize },
}

/// Verifies that a subcontractor tablet satisfies SCS ★3 device posture,
/// project handover deadline, and trade zone RBAC before serving a CAD/PDF blueprint.
pub fn authorize_blueprint_access(
    claim: &BlueprintAccessClaim,
    requested_zone_bit: u32,
    current_unix_ts: u64,
) -> Result<(), SiteSecurityError> {
    let missing = REQUIRED_FIELD_POSTURE & !claim.device_posture_mask;
    if missing != 0 {
        return Err(SiteSecurityError::DevicePostureNonCompliant { missing_bits: missing });
    }

    let effective_deadline = claim.token_expires_unix.min(claim.project_handover_unix);
    if current_unix_ts > effective_deadline {
        return Err(SiteSecurityError::LeaseExpiredOrPostHandover);
    }

    if (claim.allowed_zone_mask & requested_zone_bit) == 0 {
        return Err(SiteSecurityError::ZoneScopeUnauthorized);
    }

    Ok(())
}

/// Losslessly strips APP1..APP15 (EXIF/GPS/XMP) and COM segments from a JPEG byte stream
/// without re-compressing image pixels, preventing job-site GPS coordinate leakage.
pub fn strip_jpeg_exif_and_gps(raw_jpeg: &[u8]) -> Result<(Vec<u8>, usize), SiteSecurityError> {
    if raw_jpeg.len() < 4 || raw_jpeg[0] != 0xFF || raw_jpeg[1] != 0xD8 {
        return Err(SiteSecurityError::InvalidJpegHeader);
    }

    let mut clean = Vec::with_capacity(raw_jpeg.len());
    clean.extend_from_slice(&raw_jpeg[0..2]); — Write SOI (0xFF, 0xD8)

    let mut pos = 2usize;
    let mut removed_bytes = 0usize;

    while pos < raw_jpeg.len() {
        if raw_jpeg[pos] != 0xFF {
            return Err(SiteSecurityError::TruncatedJpegSegment { offset: pos });
        }
        while pos < raw_jpeg.len() && raw_jpeg[pos] == 0xFF {
            pos += 1;
        }
        if pos >= raw_jpeg.len() {
            break;
        }

        let marker = raw_jpeg[pos];
        pos += 1;

        // SOS (0xDA) or EOI (0xD9): copy remaining entropy-coded scan data verbatim
        if marker == 0xDA || marker == 0xD9 {
            clean.push(0xFF);
            clean.push(marker);
            clean.extend_from_slice(&raw_jpeg[pos..]);
            break;
        }

        if pos + 2 > raw_jpeg.len() {
            return Err(SiteSecurityError::TruncatedJpegSegment { offset: pos });
        }
        let seg_len = usize::from(u16::from_be_bytes([raw_jpeg[pos], raw_jpeg[pos + 1]]));
        if seg_len < 2 || pos + seg_len > raw_jpeg.len() {
            return Err(SiteSecurityError::TruncatedJpegSegment { offset: pos });
        }

        // Strip APP1..APP15 (0xE1..=0xEF) and Comment (0xFE); keep APP0 (JFIF) and DQT/DHT/SOF
        let is_metadata_segment = (0xE1..=0xEF).contains(&marker) || marker == 0xFE;
        if is_metadata_segment {
            removed_bytes += seg_len + 2;
        } else {
            clean.push(0xFF);
            clean.push(marker);
            clean.extend_from_slice(&raw_jpeg[pos..pos + seg_len]);
        }
        pos += seg_len;
    }

    Ok((clean, removed_bytes))
}