Cargo.toml

[workspace]
resolver = "3"
members = [
    "apps/auth-service",
    "apps/web",
    "crates/auth-sdk",
    "crates/common",
    "crates/crypto",
    "crates/database",
    "crates/telemetry",
    "crates/ui",
    "tools/xtask",
]

[workspace.package]
edition = "2024"
# Non-commercial by default. The SDK and the crates it depends on (auth-sdk,
# common, crypto) override this with Apache-2.0, so any application can use them;
# every other crate sets `publish = false`. See docs/dev/releasing.md.
license = "PolyForm-Noncommercial-1.0.0"
repository = "https://github.com/sourceorigin-dev/sourceorigin"
homepage = "https://sourceorigin.dev"
# The oldest Rust the published crates build with, which the `msrv` CI job checks.
rust-version = "1.88"
# Every crate shares it, and the published ones are released together.
version = "0.1.0"

[workspace.lints.rust]
unsafe_code = "forbid"
missing_docs = "warn"

# Every Clippy warning fails CI: `just rust lint` runs Clippy with `-D warnings`.
# The groups sit at priority -1 so the single lints below can override them.
[workspace.lints.clippy]
all = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
unwrap_used = "warn"
# Tests may expect, panic and dbg (see clippy.toml); production code
# propagates errors and logs through tracing.
expect_used = "warn"
panic = "warn"
todo = "warn"
unimplemented = "warn"
dbg_macro = "warn"
# Modules with children live in `foo/mod.rs`, never a `foo.rs` beside `foo/`.
self_named_module_files = "warn"

[workspace.dependencies]
# Local crates. Each names the workspace's version: cargo-deny (deny.toml)
# denies a dependency with no version as a wildcard, and crates.io would refuse
# to publish the SDK without one. The published crates require each other at
# exactly that version, since they are released together.
sourceorigin-common        = { version = "=0.1.0", path = "crates/common" }
sourceorigin-crypto        = { version = "=0.1.0", path = "crates/crypto" }
sourceorigin-repository    = { version = "0.1.0", path = "crates/database" }
sourceorigin-telemetry     = { version = "0.1.0", path = "crates/telemetry" }
sourceorigin-auth          = { version = "0.1.0", path = "crates/auth-sdk" }
sourceorigin-ui            = { version = "0.1.0", path = "crates/ui" }

# External crates
anyhow = "1"
async-trait = "0.1"
axum = "0.8"
base64 = "0.22"
bytes = "1"
clap = { version = "4.6", default-features = false, features = ["std", "derive", "help", "usage", "error-context"] }
chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
http = "1.3"
# Auth's own HTTP/1.1 server, for the header-read timeout and graceful drain
# axum::serve does not expose; both are already in the tree through axum.
hyper = { version = "1.10", features = ["server", "http1"] }
hyper-util = { version = "0.1.20", features = ["server-graceful", "service", "tokio"] }
ipnet = "2.12"
# Only webauthn-rs uses OpenSSL; naming it here builds it vendored, so no build
# needs the system's headers. Everything else uses aws-lc-rs.
openssl = { version = "0.10", features = ["vendored"] }
# OTLP/HTTP with protobuf, sent through the workspace's reqwest: no gRPC stack.
opentelemetry = { version = "0.33", default-features = false, features = ["trace", "metrics", "logs", "internal-logs"] }
opentelemetry_sdk = { version = "0.33", default-features = false, features = ["trace", "metrics", "logs", "internal-logs"] }
opentelemetry-otlp = { version = "0.33", default-features = false, features = ["http-proto", "trace", "metrics", "logs", "internal-logs"] }
opentelemetry-http = { version = "0.33", default-features = false }
opentelemetry-appender-tracing = "0.33"
# The public suffix list, compiled in, for the domains WebAuthn related origins count.
psl = "2.1"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
# RFC 8785 canonical JSON, which the audit chain hashes.
serde_json_canonicalizer = "0.4"
serde_urlencoded = "0.7"
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls-aws-lc-rs", "postgres", "chrono", "uuid", "json", "ipnet", "migrate", "macros"] }
thiserror = "2.0"
# Server-rendered pages: the router, `view!` and the tower service only. Its
# defaults add a browser runtime, `asset!` and discovery, which auth's pages avoid.
topcoat = { version = "0.10", default-features = false }
tokio = { version = "1.48", features = ["macros", "rt-multi-thread", "signal", "net", "sync", "time"] }
# The receiver stream a data export's body reads; already in the tree through sqlx.
tokio-stream = { version = "0.1", default-features = false }
tower = { version = "0.5", features = ["util"] }
tracing = "0.1"
tracing-opentelemetry = { version = "0.34", default-features = false }
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
url = { version = "2.5", features = ["serde"] }
unicode-normalization = "0.1"
unicode-security = "0.1"
uuid = { version = "1.19", features = ["v7", "serde"] }
webauthn-rs = { version = "0.5.5", features = ["danger-allow-state-serialisation", "conditional-ui", "workaround-google-passkey-specific-issues"] }

# Profile pictures: decodes the formats uploads may use, pure Rust, and writes the
# JPEG every stored picture is. No AVIF (C or a heavy encoder), no SVG, and no WebP
# until its decoder checks a frame's size against its canvas before decoding it.
image = { version = "0.25", default-features = false, features = ["jpeg", "png", "gif"] }

# Transactional email: SMTP over implicit TLS or required STARTTLS, with rustls
# on aws-lc-rs and webpki roots, never native-tls/OpenSSL.
lettre = { version = "0.11", default-features = false, features = ["builder", "smtp-transport", "tokio1-rustls", "aws-lc-rs", "webpki-roots"] }
# Decodes the SMTP user in AUTH_SMTP_URL; already in the tree through url and lettre.
percent-encoding = "2.3"

# The workspace's one cryptographic library, and rustls's provider for every TLS
# client: hashes, HMAC, PBKDF2, AES-256-GCM, RSA and Ed25519 signatures, and OS
# randomness. Its RSA is constant-time, which the RustCrypto `rsa` crate's
# RUSTSEC-2023-0071 is not. OpenSSL stays only inside webauthn-rs.
aws-lc-rs = "1.18"
secrecy = "0.10"
# Test-only: TypeScript declarations of the protocol types, which sourceorigin-common's
# tests write to packages/auth/src/protocol.ts for the TypeScript SDK. The only serde
# attribute it cannot read is `deserialize_with = "known"`, which drops unknown
# vocabulary values without changing the type, so its warnings are off.
ts-rs = { version = "12.0", features = ["url-impl", "no-serde-warnings"] }
trybuild = "1.0"
# Test-only: snapshots of rendered output, such as every email kind's bodies, so
# a change to what they say shows in review. No colored diffs, so no `console`.
insta = { version = "1.49", default-features = false }
# Test-only: a self-signed certificate and TLS listener so tests reach auth over HTTPS.
rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem", "aws_lc_rs"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "logging", "tls12"] }
# HTTP over rustls on aws-lc-rs, trusting the platform's certificate roots (the
# images install ca-certificates). No HTTP/2: every peer speaks HTTP/1.1.
reqwest = { version = "0.13", default-features = false, features = ["json", "form", "rustls"] }
webauthn-rs-proto = "0.5.5"

# Line tables keep file and line numbers in backtraces but drop the variable
# and type info that makes up most of a debug build's output. Also applies to
# tests, which inherit this profile.
[profile.dev]
debug = "line-tables-only"

[profile.dev.package."*"]
debug = false