医科・歯科・調剤薬局・介護向け：
厚労省医療情報ガイドライン第6.0版・第7.0版とSCS★3を同時に満たす3ステップ対策

#![forbid(unsafe_code)]

/// Maximum permitted duration for a vendor remote maintenance window (2 hours = 7200s).
pub const MAX_VENDOR_MAINTENANCE_WINDOW_SECS: u64 = 7200;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DualNicTerminalState {
    pub ip_forwarding_enabled: bool,
    pub closed_vpn_nic_has_default_gw: bool,
    pub clinic_lan_nic_has_default_gw: bool,
    pub clinic_lan_allowed_peer_count: u16,
    pub smb_v1_enabled: bool,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct VendorMaintenanceLease {
    pub ticket_id: u64,
    pub vendor_cert_serial: u128,
    pub clinic_approver_id: u32,
    pub window_start_unix: u64,
    pub window_end_unix: u64,
    pub session_recorded: bool,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum MedicalSecurityError {
    IpForwardingBridgingRisk,
    ClinicLanDefaultGatewayLeak,
    ClosedVpnRouteMissing,
    LegacySmbV1Prohibited,
    ExcessiveClinicLanPeerScope { peers: u16 },
    VendorWindowExceedsMaxTtl { duration_secs: u64 },
    VendorLeaseInactiveAtTimestamp { now: u64 },
    AuditSessionRecordingMandatory,
}

/// Verifies that an Online Qualification Terminal (OQS) or clinical gateway
/// strictly isolates the payment fund closed network from the clinic LAN.
pub fn audit_oqs_dual_nic_isolation(
    state: &DualNicTerminalState,
) -> Result<(), MedicalSecurityError> {
    if state.ip_forwarding_enabled {
        return Err(MedicalSecurityError::IpForwardingBridgingRisk);
    }
    if state.clinic_lan_nic_has_default_gw {
        return Err(MedicalSecurityError::ClinicLanDefaultGatewayLeak);
    }
    if !state.closed_vpn_nic_has_default_gw {
        return Err(MedicalSecurityError::ClosedVpnRouteMissing);
    }
    if state.smb_v1_enabled {
        return Err(MedicalSecurityError::LegacySmbV1Prohibited);
    }
    if state.clinic_lan_allowed_peer_count == 0 || state.clinic_lan_allowed_peer_count > 4 {
        return Err(MedicalSecurityError::ExcessiveClinicLanPeerScope {
            peers: state.clinic_lan_allowed_peer_count,
        });
    }
    Ok(())
}

/// Enforces MHLW Guideline v6.0 vendor remote maintenance governance:
/// no always-on VPN, strict 2-hour JIT lease cap, and mandatory session audit logging.
pub fn verify_vendor_maintenance_lease(
    lease: &VendorMaintenanceLease,
    current_unix_ts: u64,
) -> Result<u64, MedicalSecurityError> {
    if !lease.session_recorded {
        return Err(MedicalSecurityError::AuditSessionRecordingMandatory);
    }
    let duration = lease.window_end_unix.saturating_sub(lease.window_start_unix);
    if duration == 0 || duration > MAX_VENDOR_MAINTENANCE_WINDOW_SECS {
        return Err(MedicalSecurityError::VendorWindowExceedsMaxTtl {
            duration_secs: duration,
        });
    }
    if current_unix_ts < lease.window_start_unix || current_unix_ts > lease.window_end_unix {
        return Err(MedicalSecurityError::VendorLeaseInactiveAtTimestamp {
            now: current_unix_ts,
        });
    }

    let remaining_secs = lease.window_end_unix - current_unix_ts;
    Ok(remaining_secs)
}