アフィン型システム（Affine Type System）と借用検査による CWE-78 / CWE-89 / CWE-416 のコンパイル時消去証明

#![forbid(unsafe_code)]

use core::marker::PhantomData;

// ============================================================================
// PART 1: Compile-Time Elimination of CWE-89 (SQL Injection) via Typestate
//         and `&'static str` Structural Query Template Enforcement
// ============================================================================

pub struct UnboundQuery;
pub struct TenantScoped;
pub struct ReadyToExecute;

#[derive(Clone, Debug, PartialEq, Eq)]
pub enum SqlParam {
    Uuid([u8; 16]),
    Int64(i64),
    StrictText(String),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum SecurityViolation {
    NullByteInArgument,
    ControlCharInIdentifier,
    ArgumentCountExceeded,
    UseAfterFreeEpochMismatch { expected_epoch: u64, handle_epoch: u64 },
    InvalidArenaSlot,
}

/// Zero-cost Typestate SQL Builder.
/// Dynamic `String` templates cannot be passed because `sql_template` requires `&'static str`.
pub struct SafeSqlQuery<State> {
    sql_template: &'static str,
    tenant_uuid: Option<[u8; 16]>,
    bind_params: Vec<SqlParam>,
    _state: PhantomData<State>,
}

impl SafeSqlQuery<UnboundQuery> {
    /// Accepts ONLY compile-time string literals (`&'static str`), rendering
    /// runtime string concatenation (`format!`) a compile-time lifetime error.
    #[inline]
    pub const fn from_static_template(sql_template: &'static str) -> Self {
        Self {
            sql_template,
            tenant_uuid: None,
            bind_params: Vec::new(),
            _state: PhantomData,
        }
    }

    /// Affine transition: consumes `UnboundQuery` and produces `TenantScoped`.
    #[inline]
    pub fn bind_rls_tenant(self, tenant_uuid: [u8; 16]) -> SafeSqlQuery<TenantScoped> {
        SafeSqlQuery {
            sql_template: self.sql_template,
            tenant_uuid: Some(tenant_uuid),
            bind_params: self.bind_params,
            _state: PhantomData,
        }
    }
}

impl SafeSqlQuery<TenantScoped> {
    pub fn push_param(mut self, param: SqlParam) -> Result<Self, SecurityViolation> {
        if let SqlParam::StrictText(ref s) = param {
            if s.as_bytes().contains(&0u8) {
                return Err(SecurityViolation::NullByteInArgument);
            }
        }
        self.bind_params.push(param);
        Ok(self)
    }

    /// Affine transition: seals parameter list and produces `ReadyToExecute`.
    #[inline]
    pub fn seal(self) -> SafeSqlQuery<ReadyToExecute> {
        SafeSqlQuery {
            sql_template: self.sql_template,
            tenant_uuid: self.tenant_uuid,
            bind_params: self.bind_params,
            _state: PhantomData,
        }
    }
}

impl SafeSqlQuery<ReadyToExecute> {
    /// Callable ONLY when both RLS Tenant Context and Parameter Sealing are complete.
    #[inline]
    pub fn into_wire_parts(self) -> (&'static str, [u8; 16], Vec<SqlParam>) {
        let tenant = self.tenant_uuid.unwrap_or([0u8; 16]);
        (self.sql_template, tenant, self.bind_params)
    }
}

// ============================================================================
// PART 2: Compile-Time Elimination of CWE-78 (OS Command Injection)
//         by Forbidding Shell Invocation (`sh -c`) & Enforcing Direct Argv
// ============================================================================

pub struct VerifiedBinaryPath(&'static str);

impl VerifiedBinaryPath {
    pub const ZFS_BIN: Self = Self("/sbin/zfs");
    pub const PFCTL_BIN: Self = Self("/sbin/pfctl");
}

pub struct ShellFreeCommand {
    program: VerifiedBinaryPath,
    argv: Vec<String>,
}

impl ShellFreeCommand {
    pub const fn new(program: VerifiedBinaryPath) -> Self {
        Self {
            program,
            argv: Vec::new(),
        }
    }

    /// Appends a single OS `execve` argument vector entry after rejecting NUL/control bytes.
    /// Because no shell (`sh -c`) is ever spawned, metacharacters (`;`, `|`, `$(...)`) cannot execute.
    pub fn arg_strict(mut self, raw_arg: &str) -> Result<Self, SecurityViolation> {
        if self.argv.len() >= 16 {
            return Err(SecurityViolation::ArgumentCountExceeded);
        }
        for &b in raw_arg.as_bytes() {
            if b == 0 || b < 0x20 || b == 0x7F {
                return Err(SecurityViolation::ControlCharInIdentifier);
            }
        }
        self.argv.push(raw_arg.to_owned());
        Ok(self)
    }

    #[inline]
    pub fn inspect_execve_spec(&self) -> (&'static str, &[String]) {
        (self.program.0, &self.argv)
    }
}

// ============================================================================
// PART 3: Safe Generational Arena Allocator (Eliminates CWE-416 for Graph Pools)
// ============================================================================

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct ArenaRef<T> {
    index: usize,
    epoch: u64,
    _marker: PhantomData<T>,
}

struct ArenaEntry<T> {
    epoch: u64,
    value: Option<T>,
}

pub struct SafeGenerationalArena<T> {
    entries: Vec<ArenaEntry<T>>,
}

impl<T> SafeGenerationalArena<T> {
    pub const fn new() -> Self {
        Self {
            entries: Vec::new(),
        }
    }

    pub fn allocate(&mut self, val: T) -> ArenaRef<T> {
        for (idx, entry) in self.entries.iter_mut().enumerate() {
            if entry.value.is_none() {
                entry.epoch = entry.epoch.wrapping_add(1);
                entry.value = Some(val);
                return ArenaRef {
                    index: idx,
                    epoch: entry.epoch,
                    _marker: PhantomData,
                };
            }
        }
        let epoch = 1u64;
        let index = self.entries.len();
        self.entries.push(ArenaEntry {
            epoch,
            value: Some(val),
        });
        ArenaRef {
            index,
            epoch,
            _marker: PhantomData,
        }
    }

    pub fn deallocate(&mut self, handle: ArenaRef<T>) -> Result<T, SecurityViolation> {
        let entry = self
            .entries
            .get_mut(handle.index)
            .ok_or(SecurityViolation::InvalidArenaSlot)?;
        if entry.epoch != handle.epoch || entry.value.is_none() {
            return Err(SecurityViolation::UseAfterFreeEpochMismatch {
                expected_epoch: entry.epoch,
                handle_epoch: handle.epoch,
            });
        }
        entry.epoch = entry.epoch.wrapping_add(1);
        Ok(entry.value.take().unwrap())
    }
}