id       = "robo-3t"
name     = "Robo 3T"
homepage = "https://github.com/Studio3T/robomongo"
description = "Native cross-platform MongoDB management tool."
# The app icon from the macOS icon set in the project's own repository.
icon     = "https://raw.githubusercontent.com/Studio3T/robomongo/master/install/macosx/robomongo.iconset/icon_256x256.png"
# Robo 3T ships no command-line tool of its own; robo3t is the name it is
# packaged and launched under, the same stem every release artifact carries
# (robo3t-1.4.4-darwin-x86_64, robo3t-1.4.4-linux-x86_64, the Windows .exe),
# per the download links in the project README.
executables   = ["robo3t"]

[dotfiles]

# src/robomongo/core/settings/SettingsManager.cpp lists every configuration
# file the application has used, oldest last, and opens the first that exists:
#
#     QString("%1/.3T/robo-3t/1.4.3/robo3t.json").arg(QDir::homePath())
#     … one line per release back to 1.1.1 …
#     QString("%1/.3T/robomongo/1.1.0-Beta/robomongo.json").arg(QDir::homePath())
#     QString("%1/.config/robomongo/1.0/robomongo.json").arg(QDir::homePath())
#     QString("%1/.config/robomongo/robomongo.json").arg(QDir::homePath())
#
# and it scans `QString("%1/.3T/robo-3t").arg(QDir::homePath())` for version
# directories at startup, which is why the version segment is a glob here.
#
# `paths` is empty on purpose: the one file this application keeps under the
# user's home is its connection list, and that list carries the passwords.
# SettingsManager writes a "connections" array, and each entry's credentials and
# ssh blocks are written by CredentialSettings::toVariant and
# SshSettings::toVariant as userPasswordEncrypted and passphraseEncrypted —
# "encrypted" meaning run through the application's own RoboCrypt with a key
# compiled into the binary, which is obfuscation, not a secret store. Older
# releases wrote them in the clear as userPassword and passphrase, and the
# reader still accepts both ("From version Robo 1.3 'userPasswordEncrypted' is
# used instead of 'userPassword' in config. file").
#
# A secret_paths rule could name those fields, but a rule's file has to be a
# concrete path and the version directory is not one: a rule pinned to 1.4.3
# would not run on 1.4.2, and a credential rule that silently does not run is
# the one failure this catalog cannot afford. So the whole file is classified as
# a credential. The cost is that a consumer does not carry the connection list
# as content; the alternative is publishing database passwords.
paths = []

exclude = []

secret = [
  "~/.3T/robo-3t/*/robo3t.json",
  "~/.3T/robomongo/*/robomongo.json",
  "~/.config/robomongo/*/robomongo.json",
  "~/.config/robomongo/robomongo.json",
]