[package]
name = "mssql-auth"
description = "Authentication strategies for SQL Server connections"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
keywords = ["sql-server", "authentication", "azure", "security"]
categories = ["authentication", "database"]

[package.metadata.docs.rs]
# docs.rs builds on Linux x86_64, so document the features that build there.
# Excluded: sspi-auth + windows-certstore (Windows-only deps) and integrated-auth
# (libgssapi system library not guaranteed on docs.rs).
features = ["azure-identity", "cert-auth", "zeroize", "always-encrypted", "azure-keyvault"]

[features]
default = []
# Azure Managed Identity and Service Principal authentication
azure-identity = ["dep:azure_identity", "dep:azure_core", "dep:time"]
# Integrated authentication (Kerberos/SPNEGO) - Linux/macOS
# Requires libkrb5-dev on Debian/Ubuntu or krb5-devel on RHEL/Fedora
integrated-auth = ["dep:libgssapi"]
# Windows SSPI integrated authentication (Windows only)
# Uses the native Windows Security Support Provider Interface via secur32.dll
# for integrated auth, and sspi-rs for explicit credentials
sspi-auth = ["dep:sspi", "dep:windows"]
# Client certificate authentication (Azure AD Service Principal with X.509 certificate)
# Note: This uses azure_identity's client_certificate feature which requires openssl
# Supports both PKCS#12 (.pfx/.p12) and PEM certificate formats
cert-auth = ["dep:azure_identity", "dep:azure_core", "dep:time", "dep:base64", "dep:p12", "dep:rustls-pemfile", "azure_identity/client_certificate"]
# Enable secure credential zeroization on drop
zeroize = ["dep:zeroize"]
# Always Encrypted client-side encryption support
# Provides AEAD_AES_256_CBC_HMAC_SHA256 encryption and RSA-OAEP key unwrapping
always-encrypted = ["dep:aes", "dep:cbc", "dep:hmac", "dep:sha1", "dep:sha2", "dep:rsa", "dep:rand", "dep:parking_lot"]
# Azure Key Vault CMK provider for Always Encrypted
# Requires always-encrypted feature and Azure authentication
azure-keyvault = ["always-encrypted", "dep:azure_security_keyvault_keys", "dep:azure_identity", "dep:azure_core", "dep:url"]
# Windows Certificate Store CMK provider for Always Encrypted (Windows only)
# Requires always-encrypted feature
windows-certstore = ["always-encrypted", "dep:windows"]

[dependencies]
thiserror = { workspace = true }
tracing = { workspace = true }
bytes = { workspace = true }
async-trait = { workspace = true }

# Optional: Azure authentication (Managed Identity, Service Principal)
azure_identity = { workspace = true, optional = true }
azure_core = { workspace = true, optional = true }
time = { version = "0.3", optional = true }

# Optional: Integrated authentication (Kerberos/SPNEGO)
libgssapi = { version = "0.11", optional = true }

# Optional: Windows SSPI authentication
sspi = { version = "0.18", optional = true }

# Optional: Base64 encoding for certificate data
base64 = { version = "0.22", optional = true }

# Optional: PEM certificate parsing and PKCS#12 conversion
p12 = { workspace = true, optional = true }
rustls-pemfile = { workspace = true, optional = true }

# Optional: Secure credential zeroization
zeroize = { version = "1.8", features = ["derive"], optional = true }

# Optional: Always Encrypted cryptography
aes = { version = "0.8", optional = true }
cbc = { version = "0.1", features = ["std"], optional = true }
hmac = { version = "0.12", optional = true }
sha1 = { version = "0.10", optional = true }
sha2 = { version = "0.10", optional = true }
rsa = { version = "0.9", features = ["sha2"], optional = true }
rand = { version = "0.8", optional = true }
parking_lot = { version = "0.12", optional = true }

# Optional: Azure Key Vault CMK provider
azure_security_keyvault_keys = { workspace = true, optional = true }
url = { version = "2.5", optional = true }

# Optional: Windows Certificate Store CMK provider (Windows only)
[target.'cfg(windows)'.dependencies]
windows = { version = "0.62", features = [
    "Win32_Foundation",
    "Win32_Security_Cryptography",
    "Win32_Security_Authentication_Identity",
    "Win32_Security_Credentials",
], optional = true }

[dev-dependencies]
tokio = { workspace = true }
tokio-test = { workspace = true }

[package.metadata.cargo-machete]
# tokio-test is used in dev-dependencies for test utilities
ignored = ["tokio-test"]

[lints]
workspace = true
