# Rust 2024 Security Hardening Configuration for Foxhunt HFT System
#
# This file contains environment variables and compiler flags for maximum
# security hardening using Rust 2024 features.

# Environment Variables for Security Hardening
[env]
# Rust 2024 Security Compiler Flags
RUSTFLAGS = [
    # Edition 2024 Security Lints (Mandatory)
    "-D", "unsafe_op_in_unsafe_fn",              # Forbid unsafe ops in unsafe fn
    "-D", "clippy::undocumented_unsafe_blocks",   # Require SAFETY comments
    "-W", "rust_2024_idioms",                     # Warn on outdated patterns
    
    # Memory Safety Hardening
    "-Z", "strict-provenance",                    # Enable strict provenance model
    "-C", "force-frame-pointers=yes",            # Enable frame pointers for security tracing
    "-C", "stack-protector=strong",              # Stack overflow protection
    
    # Production Security Flags
    "-C", "relocation-model=pic",                # Position-independent code
    "-C", "code-model=small",                    # Small code model for security
    
    # Future Security Features (when available)
    "-Z", "harden-all",                          # Umbrella hardening flag (nightly)
]

# Rust 2024 Sanitizer Flags (for CI/testing)
RUSTFLAGS_SANITIZER = [
    "-Z", "sanitizer=address",                   # AddressSanitizer for memory errors
    "-Z", "sanitizer=memory",                    # MemorySanitizer for uninitialized reads
    "-Z", "sanitizer=thread",                    # ThreadSanitizer for race conditions
    "-Z", "sanitizer=leak",                      # LeakSanitizer for memory leaks
]

# Miri Configuration for Advanced Safety Checking
MIRIFLAGS = [
    "-Zmiri-strict-provenance",                  # Strict pointer provenance
    "-Zmiri-symbolic-alignment-check",           # Check alignment symbolically
    "-Zmiri-check-number-validity",              # Validate number representations
    "-Zmiri-disable-isolation",                  # Allow system calls for testing
]

# Security-Specific Feature Flags
[features]
security-audit = [
    "const-eval-security",                       # Compile-time security validations
    "zeroize-on-drop",                          # Automatic secret zeroization
    "const-time-crypto",                        # Constant-time cryptographic operations
]

# Dependency Security Configuration
[dependencies.security-overrides]
# Force secure versions of crypto dependencies
ring = { version = "0.17", features = ["std"] }
aes-gcm = { version = "0.10", features = ["std", "aes"] }
chacha20poly1305 = { version = "0.10", features = ["std"] }
argon2 = { version = "0.5", features = ["std", "password-hash"] }
zeroize = { version = "1.7", features = ["derive"] }

# Security Linting Configuration
[lints]
workspace = true

[lints.rust]
# Mandatory security lints
unsafe_op_in_unsafe_fn = "forbid"
missing_docs = "warn"
unreachable_pub = "warn"
unused_must_use = "deny"

[lints.clippy]
# Security-critical clippy lints
undocumented_unsafe_blocks = "forbid"
suspicious_auto_trait_impls = "deny"
explicit_outlives_requirements = "warn"
mem_forget = "deny"
clone_on_ref_ptr = "deny"
rc_buffer = "deny"