Cargo.toml

[package]
name = "stackpit"
version = "0.3.15"
edition = "2021"
description = "Lightweight, self-hosted error tracking and event monitoring"
authors = ["Franz Geffke <mail@gofranz.com>"]
# src/commercial/ is governed by LICENSE-COMMERCIAL (LicenseRef-Stackpit-Commercial-1.0);
# its wire-format decode/verify comes from the MIT `signetlib` crate, and
# src/commercial/ itself holds only the entitlement policy (feature gating,
# grace/expiry, store, admin UI).
license = "MIT"
repository = "https://github.com/franzos/stackpit"
homepage = "https://github.com/franzos/stackpit"
keywords = ["error-tracking", "monitoring", "observability", "self-hosted", "sentry"]
categories = ["web-programming", "development-tools"]
readme = "README.md"

[features]
default = ["sqlite"]
sqlite = ["sqlx/sqlite"]
postgres = ["sqlx/postgres"]
integration-tests = []

[workspace]
members = ["stackpit-auth", "stackpit-bench"]

[lib]
name = "stackpit"
path = "src/lib.rs"

[[bin]]
name = "stackpit"
path = "src/main.rs"

[dependencies]
stackpit-auth = { path = "stackpit-auth", version = "0.1.0", features = ["axum"] }
anyhow = "1"
async-trait = "0.1"
form_urlencoded = "1"
askama = "0.16"
axum = { version = "0.8", features = ["multipart"] }
chrono = { version = "0.4", features = ["serde"] }
clap = { version = "4", features = ["derive"] }
memchr = "2"
sqlx = { version = "0.8", features = ["runtime-tokio", "chrono", "migrate", "macros"], default-features = false }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
tokio = { version = "1", features = ["full"] }
tokio-util = "0.7"
toml = "1"
tower-http = { version = "0.7", features = ["cors", "decompression-gzip", "decompression-zstd", "limit", "normalize-path", "timeout"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
uuid = { version = "1", features = ["v4", "serde"] }
zstd = "0.13"
dashmap = "6"
ipnet = "2"
lru = "0.16"
parking_lot = "0.12"
arc-swap = "1"
# Commercial license verification (src/commercial/): the OPLB/CBOR/Ed25519
# wire-format decode + signature check lives in the MIT `signetlib` crate.
# src/commercial/ keeps only the entitlement policy (feature gating,
# grace/expiry, store, admin UI). Verify-only; the private key never ships.
# ed25519-dalek stays to build the VerifyingKey from the baked-in pubkey.
signetlib = "0.1"
ed25519-dalek = "2"
simple_hll = "0.0.4"
charts-rs = "0.7"
reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
polymail = { version = "0.1.6", default-features = false, features = [
    "config",
    "lettermint-reqwest-012",
    "postmark",
    "sendgrid",
    "smtp",
] }
aes-gcm = "0.10"
base64 = "0.22"
email_address = "0.2"
# OS-backed entropy for handles / nonces / CSRF tokens: every secret comes
# straight from the OS RNG, never a userspace PRNG.
getrandom = "0.3"
hmac = "0.12"
sha1 = "0.10"
sha2 = "0.10"
hex = "0.4"
subtle = "2"
secrecy = { version = "0.10", features = ["serde"] }
zeroize = "1"
sourcemap = "9"
zip = { version = "8", default-features = false, features = ["deflate"] }
# OAuth/OIDC: openidconnect drives the auth-code + PKCE flow + id_token
# verification. The post-callback session is the BFF token vault in the
# `oidc_grants` table (see src/oidc/) -- no tower-sessions row anywhere.
openidconnect = { version = "4", default-features = false, features = ["reqwest", "rustls-tls"] }
# Back-channel logout: validate the logout_token JWT against Hydra's JWKS.
# openidconnect's id_token_verifier wants nonce + audience-match-client-id,
# both of which the spec forbids on logout tokens -- so we do it ourselves
# with jsonwebtoken. RSA-only (RS256); the JWK conversion in oidc::logout
# tracks Hydra's documented signing algorithm.
jsonwebtoken = { version = "10", default-features = false, features = ["rust_crypto"] }
url = "2"
# i18n: Fluent loader (embeds locales/*.ftl at compile time), language
# identifiers, and negotiation.
fluent-templates = "0.14"
unic-langid = { version = "0.9", features = ["macros"] }
fluent-langneg = "0.13"
metrics = "0.24"
metrics-exporter-prometheus = { version = "0.16", default-features = false }

[dev-dependencies]
# loopback http only — no TLS feature needed.
reqwest = { version = "0.12", default-features = false, features = ["cookies"] }
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
# reuse the real cookie-hash instead of reimplementing it in the auth test.
stackpit-auth = { path = "stackpit-auth" }
# same crate axum's Form uses, for round-tripping form structs in unit tests.
serde_urlencoded = "0.7"
# HTML render snapshots (pre-i18n-retrofit baseline).
insta = "1"
# .ftl parsing for the i18n parity test.
fluent-syntax = "0.12"
tower = { version = "0.5", features = ["util"] }
futures = "0.3"

[package.metadata.generate-rpm]
assets = [
    { source = "target/release/stackpit", dest = "/usr/bin/stackpit", mode = "755" },
]

[package.metadata.deb]
maintainer = "Franz Geffke <mail@gofranz.com>"
section = "web"
assets = [
    ["target/release/stackpit", "usr/bin/", "755"],
]

[profile.release]
opt-level = 3
lto = "fat"
codegen-units = 1
strip = "symbols"

# Gated so a bare `cargo test` (CI) skips it; run via `make test-integration`.
[[test]]
name = "integration"
path = "tests/integration.rs"
required-features = ["integration-tests"]

# Reaches crate internals (test-only helpers exposed under `integration-tests`).
[[test]]
name = "ingestion"
path = "tests/ingestion.rs"
required-features = ["integration-tests"]