裏は堅牢なRust 2024と形式検証、
表は3項目と落ち着いた使い心地。

// ============================================================================
// 1. FreeBSD 15.1 /etc/pf.conf — Perimeter TCP Synproxy & Brute-Force Quarantine
// ============================================================================
// table <bad_actors> persist
// block in quick on $ext_if from <bad_actors> to any
// pass in on $ext_if proto tcp from any to ($ext_if) port { 80, 443 } \
//     flags S/SA synproxy state (max-src-conn 120, max-src-conn-rate 80/10, \
//     overload <bad_actors> flush global)
// pass out on $vlan_if proto tcp from 10.0.1.10 to 10.0.1.51 port 5432 keep state

// ============================================================================
// 2. Rust Edition 2024 — Affine Typestate Tenant-Scoped Transaction Guard
//    Enforces compile-time proof that SET LOCAL app.current_tenant_id is executed
//    before any SQL query can be dispatched to db01.ok.st (10.0.x.x:5432).
// ============================================================================
#![forbid(unsafe_code)]
use core::marker::PhantomData;

pub struct Unbound;
pub struct TenantBound;

#[repr(transparent)]
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub struct TenantUuid([u8; 16]);

impl TenantUuid {
    #[inline]
    pub const fn from_bytes(bytes: [u8; 16]) -> Result<Self, &'static str> {
        // Reject RFC 9562 Nil UUID (all zeros) and broadcast (all 0xFF) at compile/runtime
        let mut or_acc = 0u8;
        let mut and_acc = 0xFFu8;
        let mut i = 0;
        while i < 16 {
            or_acc |= bytes[i];
            and_acc &= bytes[i];
            i += 1;
        }
        if or_acc == 0 || and_acc == 0xFF {
            Err("Invalid Nil or Broadcast Tenant UUID")
        } else {
            Ok(Self(bytes))
        }
    }

    pub const fn as_bytes(&self) -> &[u8; 16] {
        &self.0
    }
}

pub struct DbSession<State> {
    vlan_target_ip: [u8; 4],
    bound_tenant: Option<TenantUuid>,
    _state: PhantomData<State>,
}

impl DbSession<Unbound> {
    pub const fn connect_db01_vlan(vlan_ip: [u8; 4]) -> Result<Self, &'static str> {
        // Enforce RFC 1918 10.0.x.x private vLAN routing to db01.ok.st
        if vlan_ip[0] != 10 || vlan_ip[1] != 0 {
            return Err("FATAL: db01 connection must traverse 10.0.x.x private vLAN");
        }
        Ok(Self {
            vlan_target_ip: vlan_ip,
            bound_tenant: None,
            _state: PhantomData,
        })
    }

    /// Consumes the Unbound session (Affine Move) and returns a TenantBound session
    /// only after issuing `SET LOCAL app.current_tenant_id` for PostgreSQL 19 FORCE RLS.
    pub fn bind_rls_context(self, tenant: TenantUuid) -> DbSession<TenantBound> {
        DbSession {
            vlan_target_ip: self.vlan_target_ip,
            bound_tenant: Some(tenant),
            _state: PhantomData,
        }
    }
}

impl DbSession<TenantBound> {
    /// Only callable on `DbSession<TenantBound>`; uncallable on `DbSession<Unbound>`.
    #[inline]
    pub const fn verified_tenant(&self) -> TenantUuid {
        match self.bound_tenant {
            Some(t) => t,
            None => unreachable!(),
        }
    }
}