# Banned APIs, enforced by Microsoft.CodeAnalysis.BannedApiAnalyzers (RS0030).
# Format: <documentation-comment-id>;<message>
# See docs/adr/ for the reasoning behind each group.

## Time — everything in DodoSSH is UTC and must be fakeable in tests.
P:System.DateTime.Now;Use TimeProvider.GetUtcNow(). All DodoSSH timestamps are UTC (timestamptz) and must be injectable for tests.
P:System.DateTime.UtcNow;Use TimeProvider.GetUtcNow() so time can be faked in tests.
P:System.DateTime.Today;Use TimeProvider.GetUtcNow().Date.
P:System.DateTimeOffset.Now;Use TimeProvider.GetUtcNow().
P:System.DateTimeOffset.UtcNow;Use TimeProvider.GetUtcNow() so time can be faked in tests.

## Identifiers — UUIDv7 gives sortable PKs with good index locality, and clients
## must be able to mint ids offline.
M:System.Guid.NewGuid;Use Guid.CreateVersion7() for sortable primary keys.

## Randomness — anything key-, token- or nonce-adjacent must be cryptographic.
T:System.Random;Use RandomNumberGenerator for anything security-relevant, or inject a seeded generator for tests.

## Sync-over-async — deadlocks under ASP.NET and stalls the Avalonia UI thread.
P:System.Threading.Tasks.Task`1.Result;Await the task instead; .Result deadlocks and hides exceptions in an AggregateException.
M:System.Threading.Tasks.Task.Wait;Await the task instead.
M:System.Threading.Tasks.Task.WaitAll;Use Task.WhenAll with await.
M:System.Threading.Tasks.Task.WaitAny;Use Task.WhenAny with await.
M:System.Threading.Tasks.Task.GetAwaiter;Await the task directly rather than blocking on the awaiter.

## Request validation — FluentValidation arrives transitively with FastEndpoints and is
## deliberately unused. A validator short-circuits before the handler and answers with
## FastEndpoints' own envelope, which carries no ProblemDetails `code` — and the code is the only
## part of an error the client branches on. Validation lives in the feature services, where it can
## throw an exception the endpoint maps to a coded problem. See docs/adr/0008-fastendpoints.md.
T:FastEndpoints.Validator`1;Validate in the feature service and map its exception to a coded problem; a Validator<T> answers with FastEndpoints' envelope, which has no `code`.
T:FluentValidation.AbstractValidator`1;As above. FluentValidation is a transitive dependency of FastEndpoints, not a chosen one.

## Encoding — must be explicit, never the ambient codepage.
P:System.Text.Encoding.Default;Specify the encoding explicitly; Encoding.Default varies by platform.

## Culture-sensitive string handling is already covered by CA1304/CA1307/CA1311,
## which AnalysisLevel=latest-All turns on. Not duplicated here.

## Cryptography — the client holds key material in libsodium guarded memory, and
## MD5/SHA1 have no place in this product. Fingerprints are SHA-256.
T:System.Security.Cryptography.MD5;Banned. SSH fingerprints are SHA-256; see docs/crypto.md.
T:System.Security.Cryptography.SHA1;Banned. Use SHA-256 or better.
T:System.Security.Cryptography.Rfc2898DeriveBytes;PBKDF2 is not our KDF. Use Argon2id via DodoSSH.Crypto; see docs/crypto.md.
T:System.Security.SecureString;Deprecated and not cross-platform. Use a pooled byte[] zeroed with CryptographicOperations.ZeroMemory.

# Note: constant-time comparison of secrets (CryptographicOperations.FixedTimeEquals
# over Enumerable.SequenceEqual) is enforced by a BannedSymbols.txt scoped to
# DodoSSH.Crypto, not globally — banning SequenceEqual everywhere is pure noise in
# business logic and tests, and noisy bans just train people to suppress them.