# cargo-deny configuration
# See: https://embarkstudios.github.io/cargo-deny/

[graph]
# Target platforms to check
targets = [
    "x86_64-unknown-linux-gnu",
    "x86_64-apple-darwin",
    "aarch64-apple-darwin",
    "x86_64-pc-windows-msvc",
    "wasm32-unknown-unknown",
]
all-features = true

# =============================================================================
# Advisories - Check for known vulnerabilities
# =============================================================================
[advisories]
# Ignore specific advisories
ignore = [
    { id = "RUSTSEC-2024-0384", reason = "instant is a transitive dev-dep of wiremock, no fix available" },
]

# =============================================================================
# Licenses - Ensure compatible licensing
# =============================================================================
[licenses]
# Only these licenses are allowed (unlicensed crates are denied by default)
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",  # Used by some crypto crates
    "Unicode-3.0",  # Used by ICU crates (idna/url deps)
    "CDLA-Permissive-2.0",  # Used by webpki-roots
]
# Confidence threshold for license detection
confidence-threshold = 0.8
# Exceptions for specific crates
exceptions = [
    # None currently
]

[licenses.private]
# Private crates don't need license checking
ignore = false

# =============================================================================
# Bans - Disallow specific crates
# =============================================================================
[bans]
# Multiple versions of the same crate
multiple-versions = "warn"
# Wildcards in version requirements
wildcards = "deny"
# Highlight which crate causes duplicate dependencies
highlight = "all"
# Workspace dependencies should come from workspace root
workspace-default-features = "allow"
external-default-features = "allow"

# Deny specific crates
deny = [
    # Unmaintained or problematic crates
    { name = "openssl", wrappers = [] },  # Prefer rustls
]

# Skip checking certain crates for duplicate versions
skip = [
    # None currently
]

# Allow specific duplicate versions
skip-tree = [
    # None currently
]

# =============================================================================
# Sources - Restrict where crates can come from
# =============================================================================
[sources]
# Crates.io is the only allowed source by default
unknown-registry = "deny"
unknown-git = "deny"
# Allow crates from these registries
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# Allow crates from these git sources (be conservative)
allow-git = []

[sources.allow-org]
# Allow crates from specific GitHub organizations
github = []
