[package]
name = "swarm-nats-auth"
version.workspace = true
readme = "README.md"
edition.workspace = true

[[bin]]
name = "swarm-nats-auth"
path = "src/main.rs"

[dependencies]
anyhow.workspace = true
clap.workspace = true
reqwest.workspace = true
serde.workspace = true
serde_json.workspace = true
tokio.workspace = true
tracing.workspace = true
tracing-subscriber.workspace = true
# The NATS protocol client. `default-features = false` because the default set
# is broad - jetstream, kv, object-store, websockets, service - and a callout
# responder speaks none of them. What is named here is the whole requirement:
# the server generation we actually deploy, nkey auth, and a TLS backend.
# (Checked what dropping the defaults costs, the way `internal-logs` was once
# lost that way: nothing in the unused set is a diagnostic.)
async-nats = { version = "0.50", default-features = false, features = [
  "server_2_14",
  "nkeys",
  "ring",
] }
# base64url for decoding the inbound request JWT. Already in the tree via
# nkeys; named directly because this crate uses it directly.
data-encoding = "2"
# StreamExt::next on the subscription. async-nats returns a Stream, not an
# iterator, and futures is already in the tree.
futures = "0.3"
# nkey seed handling + signing. The primitives (ed25519-dalek, data-encoding)
# are already in the tree, but the nkey *format* - ed25519 + base32 + CRC16 -
# is not, and hand-rolling a key format on an auth path is how you get a
# CRC bug nobody reviews.
nkeys = "0.4"
# NATS JWT claim types + signing. The reply this responder sends is a *signed
# user JWT*, whose `jti` is base32(sha256(claims)) and whose header must say
# `ed25519-nkey` - format details with no feedback loop until the server
# rejects the token. Its own deps (data-encoding, nkeys, serde, serde_json,
# sha2) are already in the tree, so this costs no new transitive weight.
nats-jwt = "0.3"
# The jti digest. Already in the tree via nats-jwt; named directly because
# this crate computes one itself for the response wrapper.
sha2 = "0.10"

[lints]
workspace = true