「詳しい社員が辞めたら誰も分からない」を防ぐ
中小企業のIT引き継ぎ・ブラックボックス解消ガイド

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AccountKind {
    InternalEmployee,
    SuperAdmin,
    ExternalVendor { expires_at_unix: Option<u64> },
}

#[derive(Debug, Clone)]
pub struct AccountRecord {
    pub account_id: &'static str,
    pub kind: AccountKind,
    pub is_enabled: bool,
    pub has_phishing_resistant_mfa: bool,
    pub last_activity_unix: u64,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct IamAuditSummary {
    pub active_super_admins: usize,
    pub bus_factor_safe: bool,
    pub dormant_account_ids: Vec<&'static str>,
    pub expired_vendor_ids: Vec<&'static str>,
    pub unverified_admin_ids: Vec<&'static str>,
}

pub fn audit_organization_accounts(
    records: &[AccountRecord],
    now_unix: u64,
    max_dormant_sec: u64,
) -> IamAuditSummary {
    let mut active_super_admins = 0usize;
    let mut dormant_account_ids = Vec::new();
    let mut expired_vendor_ids = Vec::new();
    let mut unverified_admin_ids = Vec::new();

    for rec in records {
        if !rec.is_enabled {
            continue;
        }

        if now_unix.saturating_sub(rec.last_activity_unix) > max_dormant_sec {
            dormant_account_ids.push(rec.account_id);
        }

        match rec.kind {
            AccountKind::SuperAdmin => {
                if rec.has_phishing_resistant_mfa {
                    active_super_admins += 1;
                } else {
                    unverified_admin_ids.push(rec.account_id);
                }
            }
            AccountKind::ExternalVendor { expires_at_unix } => {
                match expires_at_unix {
                    Some(exp) if exp > now_unix => {}
                    _ => expired_vendor_ids.push(rec.account_id),
                }
            }
            AccountKind::InternalEmployee => {}
        }
    }

    IamAuditSummary {
        active_super_admins,
        bus_factor_safe: (2..=3).contains(&active_super_admins),
        dormant_account_ids,
        expired_vendor_ids,
        unverified_admin_ids,
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_detects_single_admin_and_expired_vendor() {
        let now = 1_710_000_000;
        let accounts = vec![
            AccountRecord {
                account_id: "admin-1",
                kind: AccountKind::SuperAdmin,
                is_enabled: true,
                has_phishing_resistant_mfa: true,
                last_activity_unix: now - 3600,
            },
            AccountRecord {
                account_id: "vendor-legacy",
                kind: AccountKind::ExternalVendor {
                    expires_at_unix: Some(now - 86_400),
                },
                is_enabled: true,
                has_phishing_resistant_mfa: false,
                last_activity_unix: now - 100 * 86_400,
            },
        ];
        let summary = audit_organization_accounts(&accounts, now, 45 * 86_400);
        assert!(!summary.bus_factor_safe);
        assert_eq!(summary.expired_vendor_ids, vec!["vendor-legacy"]);
        assert_eq!(summary.dormant_account_ids, vec!["vendor-legacy"]);
    }
}