EC・小売・食品メーカー向け：
顧客カード情報保護（非保持化・Webスキミング対策）と受発注システムを守るSCS★3実践ガイド

#![forbid(unsafe_code)]

use std::collections::BTreeMap;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ScriptTagDescriptor {
    pub src_url: String,
    pub sri_integrity_attr: Option<String>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct CheckoutPageTelemetry {
    pub csp_header_value: String,
    pub has_raw_pan_input_in_merchant_dom: bool,
    pub discovered_scripts: Vec<ScriptTagDescriptor>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum PciSkimmingAuditError {
    RawCardInputFoundOnMerchantOrigin,
    MissingMandatoryCspDirective { directive: &'static str },
    UnsafeInlineOrEvalPermittedInCsp,
    UnapprovedScriptSource { src: String },
    MissingOrMismatchedSriDigest { src: String },
}

/// Audits a checkout page telemetry snapshot against PCI DSS v4.0 Requirements 6.4.3 & 11.6.1
/// and METI Credit Card Security Guidelines to prevent Magecart web skimming.
pub fn verify_checkout_page_integrity(
    telemetry: &CheckoutPageTelemetry,
    approved_script_sri_manifest: &BTreeMap<String, String>,
) -> Result<usize, PciSkimmingAuditError> {
    if telemetry.has_raw_pan_input_in_merchant_dom {
        return Err(PciSkimmingAuditError::RawCardInputFoundOnMerchantOrigin);
    }

    let csp = telemetry.csp_header_value.as_str();
    let required_directives = [
        "default-src",
        "script-src",
        "connect-src",
        "object-src 'none'",
        "base-uri 'none'",
        "frame-ancestors 'none'",
    ];

    for dir in required_directives {
        if !csp.contains(dir) {
            return Err(PciSkimmingAuditError::MissingMandatoryCspDirective { directive: dir });
        }
    }

    if csp.contains("'unsafe-inline'") || csp.contains("'unsafe-eval'") {
        return Err(PciSkimmingAuditError::UnsafeInlineOrEvalPermittedInCsp);
    }

    for script in &telemetry.discovered_scripts {
        let Some(expected_sri) = approved_script_sri_manifest.get(&script.src_url) else {
            return Err(PciSkimmingAuditError::UnapprovedScriptSource {
                src: script.src_url.clone(),
            });
        };

        match &script.sri_integrity_attr {
            Some(actual_sri) if actual_sri == expected_sri && actual_sri.starts_with("sha384-") => {}
            _ => {
                return Err(PciSkimmingAuditError::MissingOrMismatchedSriDigest {
                    src: script.src_url.clone(),
                });
            }
        }
    }

    Ok(telemetry.discovered_scripts.len())
}