IPA「情報セキュリティ10大脅威 2026」初選出3位：中小企業の「シャドーAI」対策と安全なAI活用ガイドライン

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DlpInterceptVerdict {
    AllowCleanPrompt,
    BlockHardcodedCredentialLeak,
    MaskDetectedMyNumberOrPhone,
}

/// Validates the official 12-digit Japanese Individual Number (My Number) Modulo-11 check digit
/// to prevent false-positive masking on ordinary 12-digit invoice or serial numbers.
#[inline]
pub fn is_valid_my_number_12digits(digits: &[u8; 12]) -> bool {
    let mut sum: u32 = 0;
    for i in 0..11 {
        let d = digits[i];
        if !d.is_ascii_digit() {
            return false;
        }
        let p_n = (d - b'0') as u32;
        let n = 11 - i as u32; — n = 1..=11 from right to left
        let q_n = if n <= 6 { n + 1 } else { n - 5 };
        sum += p_n * q_n;
    }
    let rem = sum % 11;
    let expected_check = if rem <= 1 { 0 } else { 11 - rem };
    let actual_check = (digits[11].wrapping_sub(b'0')) as u32;
    actual_check == expected_check
}

/// Scans an outgoing LLM prompt for leaked cloud credentials (`AKIA...`, `ghp_...`, `-----BEGIN`)
/// or unmasked 12-digit My Number sequences before any external API transmission.
pub fn inspect_outgoing_ai_prompt(prompt: &str) -> DlpInterceptVerdict {
    let bytes = prompt.as_bytes();
    if prompt.contains("-----BEGIN ")
        || prompt.contains("AKIA")
        || prompt.contains("ghp_")
        || prompt.contains("xoxb-")
    {
        return DlpInterceptVerdict::BlockHardcodedCredentialLeak;
    }

    if bytes.len() >= 12 {
        for window in bytes.windows(12) {
            if let Ok(arr) = <&[u8; 12]>::try_from(window) {
                if arr.iter().all(|b| b.is_ascii_digit()) && is_valid_my_number_12digits(arr) {
                    return DlpInterceptVerdict::MaskDetectedMyNumberOrPhone;
                }
            }
        }
    }
    DlpInterceptVerdict::AllowCleanPrompt
}