mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-02 07:34:45 +08:00
grs
40d1b48666
* feat(provider): add ability to request token exchange instead of client credentials as OAuth grant_type Signed-off-by: Gordon Sim <gsim@redhat.com> * test(proxy): add further tests for token exchange Signed-off-by: Gordon Sim <gsim@redhat.com> * test(provider): add runnable example for token exchange Signed-off-by: Gordon Sim <gsim@redhat.com> * test(e2e): cover Podman token exchange grants Signed-off-by: Gordon Sim <gsim@redhat.com> * refactor(oauth): extract duplicated functionality from server and supervisor Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(provider): evict nearest-to-expiry entry from intermediate token cache Signed-off-by: Gordon Sim <gsim@redhat.com> * doc(supervisor): add podman example for token exchange Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(provider): withhold token-exchange subject credentials Signed-off-by: Gordon Sim <gsim@redhat.com> --------- Signed-off-by: Gordon Sim <gsim@redhat.com>
175 lines
5.3 KiB
TOML
175 lines
5.3 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[workspace]
|
|
resolver = "2"
|
|
members = ["crates/*"]
|
|
|
|
[workspace.package]
|
|
version = "0.0.0"
|
|
edition = "2024"
|
|
rust-version = "1.90"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/NVIDIA/OpenShell"
|
|
|
|
[workspace.dependencies]
|
|
# Async runtime
|
|
tokio = { version = "1.43", features = ["full"] }
|
|
|
|
# gRPC/Protobuf
|
|
tonic = "0.14"
|
|
tonic-prost = "0.14"
|
|
tonic-prost-build = "0.14"
|
|
prost = "0.14"
|
|
prost-types = "0.14"
|
|
prost-reflect = { version = "0.16.5", features = ["serde"] }
|
|
|
|
# HTTP server
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["cors", "trace", "request-id"] }
|
|
hyper = { version = "1.6", features = ["full"] }
|
|
hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }
|
|
http = "1.2"
|
|
http-body = "1.0"
|
|
http-body-util = "0.1"
|
|
|
|
# TLS
|
|
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
|
|
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
|
|
rustls-pemfile = "2"
|
|
rcgen = { version = "0.13", features = ["crypto", "pem"] }
|
|
webpki-roots = "1"
|
|
rustls-native-certs = "0.8"
|
|
|
|
# CLI
|
|
clap = { version = "4.5", features = ["derive", "env"] }
|
|
clap_complete = { version = "4.5", features = ["unstable-dynamic"] }
|
|
indicatif = "0.17"
|
|
owo-colors = "4"
|
|
ratatui = "0.26"
|
|
crossterm = "0.28"
|
|
terminal-colorsaurus = "1.0"
|
|
|
|
# Error handling
|
|
miette = { version = "7", features = ["fancy"] }
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
|
|
# Logging/Tracing
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
tracing-appender = "0.2"
|
|
|
|
# OpenTelemetry — OTLP/gRPC export. Kept in lockstep with the workspace's
|
|
# tonic 0.14 / prost 0.14 via opentelemetry-proto's `grpc-tonic` feature.
|
|
opentelemetry = "0.32"
|
|
opentelemetry_sdk = { version = "0.32", features = ["rt-tokio"] }
|
|
opentelemetry-otlp = { version = "0.32", default-features = false, features = ["grpc-tonic", "trace"] }
|
|
tracing-opentelemetry = { version = "0.33", default-features = false, features = ["tracing-log"] }
|
|
|
|
# Metrics
|
|
metrics = "0.24"
|
|
metrics-exporter-prometheus = { version = "0.18", default-features = false, features = ["http-listener"] }
|
|
|
|
# Unix/Process
|
|
nix = { version = "0.29", features = ["signal", "process", "user", "fs", "term"] }
|
|
rustix = { version = "1.1", features = ["process"] }
|
|
socket2 = "0.6"
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yml = "0.0.12"
|
|
toml = "0.8"
|
|
apollo-parser = "0.8.5"
|
|
tower-mcp-types = "0.12.0"
|
|
regex = "1"
|
|
|
|
# HTTP client
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots"] }
|
|
|
|
# AWS SDK
|
|
aws-config = { version = "1", default-features = false, features = ["rustls", "rt-tokio", "behavior-version-latest"] }
|
|
aws-sdk-sts = { version = "1", default-features = false, features = ["rustls", "rt-tokio", "behavior-version-latest"] }
|
|
|
|
# WebSocket
|
|
tokio-tungstenite = { version = "0.26", default-features = false, features = ["connect", "rustls-tls-native-roots"] }
|
|
|
|
# Clipboard (OSC 52)
|
|
base64 = "0.22"
|
|
|
|
# Crypto / Auth
|
|
sha2 = "0.10"
|
|
rand = "0.9"
|
|
jsonwebtoken = { version = "10", features = ["aws_lc_rs"] }
|
|
getrandom = "0.3"
|
|
ring = "0.17"
|
|
spiffe = { version = "0.15", default-features = false, features = ["workload-api-jwt", "jwt-verify-rust-crypto", "tracing"] }
|
|
|
|
# Filesystem embedding
|
|
include_dir = "0.7"
|
|
|
|
# Glob matching
|
|
glob = "0.3"
|
|
|
|
# Utilities
|
|
futures = "0.3"
|
|
bytes = "1"
|
|
hickory-proto = "0.26.1"
|
|
pin-project-lite = "0.2"
|
|
tokio-stream = "0.1"
|
|
protoc-bin-vendored = "3.2.0"
|
|
url = "2"
|
|
indexmap = "2"
|
|
|
|
# Database
|
|
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls-ring-native-roots", "postgres", "sqlite", "migrate", "macros"] }
|
|
|
|
# Kubernetes
|
|
kube = { version = "0.90", default-features = false, features = ["client", "runtime", "derive", "rustls-tls"] }
|
|
kube-runtime = "0.90"
|
|
k8s-openapi = { version = "0.21.1", features = ["v1_26"] }
|
|
|
|
# IDs
|
|
uuid = { version = "1.10", features = ["v4"] }
|
|
|
|
# SMT solver (uses system libz3; enable z3/bundled via the prover's bundled-z3 feature for local dev without system z3)
|
|
z3 = "0.20"
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "warn"
|
|
rust_2018_idioms = { level = "warn", priority = -1 }
|
|
trivial_casts = "warn"
|
|
trivial_numeric_casts = "warn"
|
|
unused_lifetimes = "warn"
|
|
unused_qualifications = "warn"
|
|
|
|
[workspace.lints.clippy]
|
|
all = { level = "warn", priority = -1 }
|
|
pedantic = { level = "warn", priority = -1 }
|
|
nursery = { level = "warn", priority = -1 }
|
|
|
|
# Allow certain pedantic lints that are too noisy
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
|
|
# Allow noisy nursery lints
|
|
significant_drop_tightening = "allow" # Often gives incorrect suggestions
|
|
missing_const_for_fn = "allow" # Too noisy for async code patterns
|
|
|
|
# Allow noisy pedantic lints
|
|
too_many_lines = "allow" # Function length limits are subjective
|
|
needless_pass_by_value = "allow" # Common pattern in async handlers
|
|
ref_option = "allow" # Common pattern for optional references
|
|
missing_fields_in_debug = "allow" # Manual Debug impls often intentionally omit fields
|
|
|
|
[profile.release]
|
|
strip = true
|
|
|
|
[profile.dev]
|
|
# Faster compile times for dev builds
|
|
debug = 1
|