deny.toml

# cargo-deny configuration.
#
# Primary purpose for v1: codify the dependency-direction guard from
# GAP_PLAN.md V2.A.10 — adapter crates should consume the
# type/trait surface from `rvoip-core-traits`, not from `rvoip-core`,
# so the implementation crate (`rvoip-core`) is free to evolve
# without forcing downstream rebuilds. The `rvoip-core-traits` carve
# (V2.A) broke the dep cycle by extracting types into the sibling
# crate; this file prevents that work from regressing.
#
# Current state (2026-05-26): only `rvoip-harness` and `auth-core`
# have actually been retargeted onto `rvoip-core-traits`. The other
# adapter crates still consume `rvoip-core` directly; the
# `[[bans.deny].wrappers]` allow-list below grandfathers them in.
# Removing a crate from the wrappers list is the mechanical step in a
# follow-up adapter-migration ticket.
#
# Newly created crates (notably `rvoip-client`, per P12.3) MUST NOT
# be added to the wrappers list — they should depend on
# `rvoip-core-traits` from day one.
#
# Run `cargo deny check bans` locally; CI runs it on every PR via
# `.github/workflows/cargo-deny.yml`.

# Dependency-direction and production supply-chain policy applies to shipped
# dependencies. Workspace-only test harnesses deliberately use implementation
# crates (for example rvoip-client's loopback Orchestrator tests), so including
# dev-dependency edges creates false production-policy violations and cycles.
[graph]
exclude-dev = true
all-features = true

# RustSec security-advisory scanning. Enforced in CI (cargo-deny.yml runs
# `check advisories`) alongside the local beta release gate's `cargo audit`.
# Accepted transitive advisories are listed in `ignore` with rationale.
[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "warn"
# Unmaintained advisories are informational here, matching the beta release
# gate's `cargo audit` (which does not fail the build on them). The ones
# currently present are all deep transitive: paste, proc-macro-error2,
# audiopus_sys (via the opus codec) and rustls-pemfile. Tighten to
# "workspace" or "all" once those transitive stacks are cleaned up.
unmaintained = "none"
# Mirrors the accepted-advisory set enforced by the beta release gate
# (crates/sip/rvoip-sip/scripts/beta_gate.sh -> `cargo audit`). Each is
# transitive with no fixed upgrade adopted in the currently pinned versions;
# full rationale is in the gate's security/accepted-advisories.md. Revisit
# before stable release / when the upstream stacks publish fixes.
ignore = [
    # `rsa` — RustSec reports no fixed upgrade. Transitive via users-core
    # RS256/JWK support and webauthn-rs crypto-glue.
    "RUSTSEC-2023-0071",
    # `rustls-webpki` — transitive via the rustls stack. Revisit on the fixed line.
    "RUSTSEC-2026-0104",
    "RUSTSEC-2026-0098",
    "RUSTSEC-2026-0099",
]

# License compliance — permissive default; revisit when shipping
# binary releases. The workspace itself publishes under MIT only, but
# the `allow` list below still includes Apache-2.0 / BSD / etc. because
# those govern licenses we CONSUME from upstream deps (tokio, axum,
# rustls, etc. are Apache-licensed and we need them).
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "0BSD",
    "BSL-1.0",
    "CDLA-Permissive-2.0",
    "MPL-2.0",
    "CC0-1.0",
]
confidence-threshold = 0.8

# The ban guard. This is the load-bearing part of the file.
[bans]
multiple-versions = "allow"   # workspace has legitimate version skew today
wildcards         = "warn"

# Direct dep on `rvoip-core` is permitted only from the listed
# wrapper crates. Adding a new crate to the list requires an
# explicit decision (the goal is to shrink this list over time).
[[bans.deny]]
name     = "rvoip-core"
wrappers = [
    # The facade crate legitimately re-exports `rvoip-core` types and
    # the `Orchestrator` impl — that's its whole job.
    "rvoip",

    # Grandfathered adapter / surface crates. Each is a candidate for
    # a future Cargo.toml swap to `rvoip-core-traits` (V2.A.7
    # follow-up; tracked separately from P12).
    "rvoip-sip",
    "rvoip-webrtc",
    # bridgefu media adapter — drives the Orchestrator/bridge impl directly
    # (Orchestrator::bridge_connections, bridge::frame_pump::spawn_pump,
    # ConnectionAdapter), so it consumes `rvoip-core` rather than
    # `rvoip-core-traits`. Same category as `rvoip-webrtc`.
    "rvoip-amazon-connect",
    "rvoip-quic",
    "rvoip-webtransport",
    "rvoip-websocket",
    "rvoip-uctp",
    "rvoip-identity",
    # Vapi implements the full ConnectionAdapter and drives Orchestrator.
    "rvoip-vapi",
    # Optional VCon/PostgreSQL integration consumes Orchestrator storage APIs.
    "rvoip-vcon-postgres",
]
reason = "Adapter crates should consume type/trait surface from `rvoip-core-traits`; the implementation crate `rvoip-core` is reserved for the facade. See GAP_PLAN.md V2.A.10."

# Source registry policy — workspace, crates.io, and reviewed project-owned
# forks only. Cargo.toml must still use an exact 40-character `rev`; this URL
# allow-list never authorizes a floating branch. Fork changes remain private
# until project-owner review and do not imply permission to contact upstream.
[sources]
unknown-registry = "deny"
unknown-git      = "deny"
# Project-owned fork URLs remain pre-approved even in revisions whose lockfile
# does not currently contain both forks.
unused-allowed-source = "allow"
allow-registry   = ["https://github.com/rust-lang/crates.io-index"]
allow-git        = [
    "https://github.com/eisenzopf/rtc",
    "https://github.com/eisenzopf/moq-rs",
]