Plan: Event Bus Data Enforcement

/// Field names that must never appear in event payloads.
/// Matches are case-insensitive against JSON object keys at any nesting depth.
const RESTRICTED_FIELDS: &[&str] = &[
    "ssn",
    "social_security_number",
    "ssn_encrypted",
    "ssn_last_four",
    "fti_",                    // any field prefixed with fti_
    "tax_return",
    "tax_income",
    "agi",                     // adjusted gross income (FTI)
    "ievs_",                   // any field prefixed with ievs_
    "wage_record",
    "unemployment_amount",
    "ssi_payment",
    "bendex_",
    "sdx_",
    "diagnosis",               // HIPAA
    "medical_record",
    "phi_",                    // protected health information prefix
    "medicaid_id",
    "income_amount",           // raw dollar amounts belong in service DBs, not events
    "benefit_amount",
    "asset_value",
];

pub async fn publish(&self, envelope: &EventEnvelope) -> Result<(), PublishError> {
    // Reject payloads containing restricted federal data fields.
    RestrictedFieldDetector::validate(&envelope.payload)?;

    let mut envelope = envelope.clone();
    envelope.trace_context = Self::inject_trace_context();
    // ... existing publish logic
}

#[derive(Debug, thiserror::Error)]
pub enum PublishError {
    #[error("serialization failed: {0}")]
    Serialization(#[from] serde_json::Error),
    #[error("AMQP error: {0}")]
    Amqp(#[from] lapin::Error),
    #[error("event payload contains restricted field: {0}")]
    RestrictedData(String),
}

event-bus-lint:
  stage: test
  image: alpine:latest
  tags:
    - dhs-aws-autoscaler-docker.small
  script:
    - |
      VIOLATIONS=0
      for f in $(find services -name events.rs); do
        if grep -inE '(ssn|social_security|fti_|ievs_|wage_record|tax_return|income_amount|benefit_amount|diagnosis|medical_record)' "$f"; then
          echo "VIOLATION: $f contains restricted field reference"
          VIOLATIONS=$((VIOLATIONS + 1))
        fi
      done
      if [ "$VIOLATIONS" -gt 0 ]; then
        echo "ERROR: $VIOLATIONS file(s) reference restricted fields in event payloads"
        exit 1
      fi
  rules:
    - if: $CI_COMMIT_BRANCH
      changes:
        - "services/*/src/events.rs"
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - "services/*/src/events.rs"

/// Marker trait for types safe to publish as event payloads.
///
/// Implementors assert that the type contains only IDs, status codes,
/// timestamps, and non-restricted metadata.  No FTI, IEVS, SSN, or
/// HIPAA-scoped fields.
///
/// Current enforcement: runtime `RestrictedFieldDetector` in Publisher.
/// Future: `#[derive(EventPayload)]` proc macro with `#[deny_field]` attributes.
pub trait EventPayload: serde::Serialize {}

pub mod restricted;
pub use restricted::RestrictedFieldDetector;