# Forbidden API regression gate lens (template)
#
# Copy and customize per repo. Set provider to FORBIDDEN for APIs that must not
# appear in production paths. CI fails when entitlements[] is non-empty.
definition:
  language:
    go:
      - name: "Deprecated internal auth client (example)"
        prefix: "github.com/acme/legacy-auth/"
        provider: FORBIDDEN
      - name: "Unsafe debug HTTP client (example)"
        prefix: "github.com/acme/debug-http/"
        provider: FORBIDDEN
      - name: "Deprecated AWS SDK v1"
        prefix: "github.com/aws/aws-sdk-go/service/"
        provider: FORBIDDEN
    java:
      - name: "Legacy sun.misc.Unsafe"
        prefix: "sun.misc.Unsafe"
        provider: FORBIDDEN
        rule: "sun\\.misc\\.Unsafe\\.(?<operation>[a-zA-Z0-9_]+)"
      - name: "Deprecated internal package (example)"
        prefix: "com.acme.legacy."
        provider: FORBIDDEN
    python:
      - name: "Pickle deserialization (unsafe)"
        prefix: "pickle."
        provider: FORBIDDEN
        rule: "pickle\\.(?<operation>load|loads)"
      - name: "Deprecated internal module (example)"
        prefix: "acme_legacy."
        provider: FORBIDDEN
        rule: "acme_legacy\\.(?<operation>[a-zA-Z0-9_]+)"
    javascript:
      - name: "eval / Function constructor"
        prefix: "eval"
        provider: FORBIDDEN
        rule: "eval\\("
      - name: "Deprecated internal package (example)"
        prefix: "@acme/legacy-"
        provider: FORBIDDEN

  providers:
    FORBIDDEN:
      servicenameMapping: {}
