PostgreSQL 19 FORCE ROW LEVEL SECURITY と security_barrier による
マルチテナント分離設計（db01.ok.st 実装仕様）

-- ============================================================================
-- 1. PostgreSQL 19 Mandatory Multi-Tenant Schema & Restrictive Barrier Policy
-- ============================================================================
CREATE ROLE ok_app_runtime LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS;

CREATE TABLE IF NOT EXISTS tenant_medical_records (
    record_id       UUID NOT NULL DEFAULT gen_random_uuid(),
    tenant_id       UUID NOT NULL,
    patient_code    VARCHAR(64) NOT NULL,
    recorded_at     TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
    encrypted_body  BYTEA NOT NULL,
    blake3_digest   BYTEA NOT NULL CHECK (octet_length(blake3_digest) = 32),
    PRIMARY KEY (tenant_id, record_id)
);

ALTER TABLE tenant_medical_records ENABLE ROW LEVEL SECURITY;
ALTER TABLE tenant_medical_records FORCE ROW LEVEL SECURITY;

-- Permissive base policy + Restrictive mandatory guard (missing_ok = false)
CREATE POLICY tenant_isolation_base ON tenant_medical_records
    AS PERMISSIVE FOR ALL TO ok_app_runtime
    USING (tenant_id = current_setting('app.current_tenant_id', false)::uuid)
    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', false)::uuid);

CREATE POLICY tenant_isolation_restrictive_guard ON tenant_medical_records
    AS RESTRICTIVE FOR ALL TO PUBLIC
    USING (tenant_id = current_setting('app.current_tenant_id', false)::uuid)
    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', false)::uuid);

// ============================================================================
// 2. Rust Edition 2024: Compile-Time Typestate Session Wrapper for PostgreSQL 19
//    Makes it a compile error to execute any query before binding `tenant_id`.
// ============================================================================
#![forbid(unsafe_code)]

use core::marker::PhantomData;

/// RFC 4122 v4 / v7 Tenant Identifier validated before GUC binding.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct TenantUuid([u8; 16]);

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum RlsSessionError {
    NilTenantUuidRejected,
    InvalidUuidVersion(u8),
    GucBindingFailed,
    CrossTenantRowDetected,
}

impl TenantUuid {
    /// Rejects all-zero NIL UUIDs (`00000000-0000-0000-0000-000000000000`) and validates RFC 4122 variant.
    pub const fn try_from_bytes(bytes: [u8; 16]) -> Result<Self, RlsSessionError> {
        let mut all_zero = true;
        let mut i = 0;
        while i < 16 {
            if bytes[i] != 0 {
                all_zero = false;
                break;
            }
            i += 1;
        }
        if all_zero {
            return Err(RlsSessionError::NilTenantUuidRejected);
        }
        let version = (bytes[6] >> 4) & 0x0F;
        if version != 4 && version != 7 {
            return Err(RlsSessionError::InvalidUuidVersion(version));
        }
        Ok(Self(bytes))
    }

    pub const fn as_bytes(&self) -> &[u8; 16] {
        &self.0
    }
}

/// Typestate markers: `Unbound` has NO query execution methods.
pub struct Unbound;
pub struct BoundToTenant(TenantUuid);

/// Abstraction over a PostgreSQL 19 database transaction connection.
pub trait Pg19TransactionDriver {
    fn exec_set_local_tenant(&mut self, tenant: &TenantUuid) -> Result<(), RlsSessionError>;
    fn fetch_tenant_rows(&mut self, sql: &str) -> Result<usize, RlsSessionError>;
}

/// Affine Typestate wrapper: consumes `RlsTransaction<D, Unbound>` to produce
/// `RlsTransaction<D, BoundToTenant>` only after `SET LOCAL app.current_tenant_id` succeeds.
pub struct RlsTransaction<D: Pg19TransactionDriver, State> {
    driver: D,
    state: State,
    _marker: PhantomData<State>,
}

impl<D: Pg19TransactionDriver> RlsTransaction<D, Unbound> {
    pub const fn new_unbound(driver: D) -> Self {
        Self {
            driver,
            state: Unbound,
            _marker: PhantomData,
        }
    }

    /// Consumes the `Unbound` transaction and executes `SELECT set_config('app.current_tenant_id', $1, true)`.
    pub fn bind_tenant(
        mut self,
        tenant: TenantUuid,
    ) -> Result<RlsTransaction<D, BoundToTenant>, RlsSessionError> {
        self.driver.exec_set_local_tenant(&tenant)?;
        Ok(RlsTransaction {
            driver: self.driver,
            state: BoundToTenant(tenant),
            _marker: PhantomData,
        })
    }
}

impl<D: Pg19TransactionDriver> RlsTransaction<D, BoundToTenant> {
    /// Only callable after typestate transition to `BoundToTenant`.
    pub fn execute_isolated_query(&mut self, sql: &str) -> Result<usize, RlsSessionError> {
        self.driver.fetch_tenant_rows(sql)
    }

    pub const fn active_tenant(&self) -> TenantUuid {
        self.state.0
    }
}