# cargo-deny configuration (review item 1.2: dependency audit, deny and
# license checks).
#
# Scope: the two crates that own the payment path, `nigig-pay-domain` and
# `nigig-pay-storage`. This file is deliberately strict -- a shipped payment
# binary justifies rules a GUI app does not.
#
# `nigig-build` is covered separately by `deny-nigig-build.toml` (Phase 0.4).
# It is a separate file rather than a shared one on purpose: merging them
# would mean loosening these rules to accommodate a Makepad + Robius
# dependency graph, and the payment policy is the one worth keeping tight.

[graph]
all-features = true

[advisories]
# Fail on any security advisory affecting the payment dependency graph.
version = 2
yanked = "deny"
ignore = []

[licenses]
version = 2
# Permissive licences only. A copyleft dependency in a shipped mobile payment
# binary is a distribution question that must be answered deliberately, not
# discovered at release time.
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
]
confidence-threshold = 0.9
# Allowances that the current graph does not exercise are listed deliberately
# as headroom for review, so they must not fail the build.
unused-allowed-license = "allow"

[bans]
multiple-versions = "warn"
wildcards = "deny"
# A payment crate must not pull in a UI framework. This is the machine-checked
# form of review item 1.4.
deny = [
    { name = "makepad-widgets" },
    { name = "makepad-draw" },
    { name = "makepad-platform" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# Only crates.io. A git dependency in the payment path would bypass the
# lockfile-plus-audit guarantee this configuration exists to provide.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]