[package]
name = "sepot-relay"
version = "0.1.0"
edition.workspace = true
license.workspace = true

[dependencies]
sepot-proto = { path = "../sepot-proto" }
prost = { workspace = true }
tokio = { workspace = true }
anyhow = { workspace = true }
tracing = { workspace = true }
tracing-subscriber = { workspace = true }

axum = { version = "0.8", features = ["ws"] }
sqlx = { version = "0.8", default-features = false, features = [
    "postgres",
    "runtime-tokio",
    "tls-rustls",
    "chrono",
    "migrate",
    "macros",
] }
dashmap = "6"
# CIDR match trusted proxy sítí pro anti-abuse klíč (viz net.rs)
ipnet = "2"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
base64 = "0.22"
# TURN údaje pro hovory: coturn ověřuje HMAC-SHA1 (REST schéma use-auth-secret)
hmac = "0.12"
# Proof-of-work registrace (pow.rs); už v grafu závislostí přes libsignal
sha2 = "0.10"
sha1 = "0.10"
hex = "0.4"
chrono = "0.4"
rand = "0.9"
futures-util = "0.3"
# Streaming download příloh z disku (ReaderStream)
tokio-util = { version = "0.7", features = ["io"] }

# Oficiální Signal krypto — POUZE pro roli certifikační autority sealed
# senderu (ServerCertificate/SenderCertificate) a ověření XEdDSA podpisů
# při AUTH. Relay NIKDY nešifruje/nedešifruje zprávy (hloupý relay).
libsignal-protocol = { git = "https://github.com/signalapp/libsignal", tag = "v0.96.4" }
libsignal-core = { git = "https://github.com/signalapp/libsignal", tag = "v0.96.4" }
# Rate limity (token bucket per IP / Tor / globálně, limits.rs)
governor = "0.10"
tower-http = { version = "0.7.0", features = ["timeout"] }

# Push budíčky (UnifiedPush/WebPush = POST na endpoint). rustls, ať build
# zůstane bez OpenSSL (stejně jako sqlx tls-rustls). Bez default featur —
# nechceme native-tls ani zbytečné kodeky. http2: APNs jiný protokol
# nepřijme (HTTP/1.1 spojení odmítne) — bez něj nedorazil žádný iOS budíček.
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "http2"] }
# FCM fast mode: RS256 JWT pro OAuth2 service account flow
jsonwebtoken = "9"
# setrlimit(RLIMIT_NOFILE) při startu — docker dává soft limit 1024
libc = "0.2"

[dev-dependencies]
tokio = { workspace = true, features = ["full"] }