[package]
name = "argentor-security"
version.workspace = true
edition.workspace = true
description = "Capability-based permissions, RBAC, audit logging, and encryption for Argentor"
license.workspace = true
repository.workspace = true
authors.workspace = true
homepage.workspace = true
keywords.workspace = true
categories.workspace = true

[lints]
workspace = true

[dependencies]
argentor-core.workspace = true
serde.workspace = true
serde_json.workspace = true
tracing.workspace = true
tokio.workspace = true
chrono.workspace = true
uuid.workspace = true
async-trait.workspace = true
tokio-rustls = "0.26"
rustls-pemfile = "2"
sha2 = "0.10"
hex = "0.4"
getrandom = "0.2"
unicode-normalization.workspace = true
zstd = "0.13"
rusqlite = { workspace = true, optional = true }
reqwest = { workspace = true, optional = true }
hmac = { version = "0.12", optional = true }

[features]
# Enables the SQLite audit sink. Off by default to keep the bundled C
# SQLite build out of consumers that only need the JSONL sink.
sqlite = ["dep:rusqlite"]
# Enables the SIEM webhook audit sink (HTTP POST forwarder). Off by
# default to keep the reqwest HTTP stack out of JSONL-only consumers.
siem = ["dep:reqwest", "dep:hmac"]

[dev-dependencies]
tempfile = "3"
criterion = { version = "0.5", features = ["html_reports"] }

[[bench]]
name = "security_benchmarks"
harness = false
