<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <groupId>com.mulesoft.modules</groupId>
    <artifactId>mule-wss-module</artifactId>
    <version>2.2.3</version>
    <packaging>mule-extension</packaging>

    <name>Web Service Security Module</name>
    <description>A Mule extension that provides functionality for applying security to Web Services</description>

    <parent>
        <groupId>org.mule.extensions</groupId>
        <artifactId>mule-ee-core-modules-parent</artifactId>
        <version>1.9.11</version>
    </parent>

    <properties>
        <licenseYear>2025</licenseYear>
        <wss4j.version>2.4.1</wss4j.version>
        <spring.version>6.5.10</spring.version>
        <spring-core.version>6.2.19</spring-core.version>
        <spring-context.version>6.2.19</spring-context.version>
        <!-- CVE-2026-41850/41851/41852: force spring-expression off the vulnerable 6.2.0 transitive -->
        <spring-expression.version>6.2.19</spring-expression.version>
        <!-- CVE-2026-41720 (P0): force spring-ldap-core off the vulnerable 3.2.16 transitive -->
        <spring-ldap-core.version>3.3.8</spring-ldap-core.version>
        <jaxws-rt.version>2.3.6</jaxws-rt.version>

        <formatterConfigPath>formatter.xml</formatterConfigPath>

        <!-- Remove when a new parent version with MTF is available -->
        <munit.input.directory>src/test/munit</munit.input.directory>
        <munit.output.directory>${basedir}/target/test-mule/munit</munit.output.directory>
        <munit.extensions.maven.plugin.version>1.7.1-rc3</munit.extensions.maven.plugin.version>
        <munit.version>3.7.3</munit.version>

        <docker.maven.plugin.version>0.43.0</docker.maven.plugin.version>
        <docker.skip>${skipTests}</docker.skip>
        <ldap.host>localhost</ldap.host>
        <ldap.port>10389</ldap.port>
        <powermock.version>2.0.9</powermock.version>
        <maven.surefire.plugin.version>3.1.2</maven.surefire.plugin.version>
        <maven.compiler.plugin.version>3.11.0</maven.compiler.plugin.version>
        <jacoco.version>0.8.14</jacoco.version>

        <mockito-core.version>4.11.0</mockito-core.version>
        <byte-buddy.version>1.17.5</byte-buddy.version>
        <commons.io.version>2.21.0</commons.io.version>
        <sdk-api.version>1.0.0</sdk-api.version>
        <jakarta-ws-api.version>4.0.2</jakarta-ws-api.version>
        <metro.version>4.0.4</metro.version>

        <validate.saml.empty.truststore.config.ref>${validate.saml.empty.truststore.config}</validate.saml.empty.truststore.config.ref>
        <validate.saml.truststore.config.ref>${validate.saml.truststore.config}</validate.saml.truststore.config.ref>
        <validate.saml.truststore.non.matching.config.ref>${validate.saml.truststore.non.matching.config}</validate.saml.truststore.non.matching.config.ref>
        <request.without.security.config.ref>${request.without.security.config}</request.without.security.config.ref>
        <validate.signature.config.ref>${validate.signature.config}</validate.signature.config.ref>
        <valid.certificate.constraint.config.ref>${valid.certificate.constraint.config}</valid.certificate.constraint.config.ref>
        <invalid.certificate.constraint.config.ref>${invalid.certificate.constraint.config}</invalid.certificate.constraint.config.ref>
        <expression.certificate.constraint.config.ref>${expression.certificate.constraint.config}</expression.certificate.constraint.config.ref>
        <decryption.config.ref>${decryption.config}</decryption.config.ref>
        <decryption.username.config.ref>${decryption.username.config}</decryption.username.config.ref>
        <remove.header.config.ref>${remove.header.config}</remove.header.config.ref>
        <wss.validation.config.ref>${wss.validation.config}</wss.validation.config.ref>
        <outbound.timestamp.sign.config.ref>${outbound.timestamp.sign.config}</outbound.timestamp.sign.config.ref>
        <encryption.config.ref>${encryption.config}</encryption.config.ref>
        <encryption.config.with.key.ref>${encryption.config.with.key}</encryption.config.with.key.ref>
        <sign.config.ref>${sign.config}</sign.config.ref>
        <check.signature.with.binary.security.token.config.ref>${check.signature.with.binary.security.token.config}</check.signature.with.binary.security.token.config.ref>
        <valid.encryption.without.keystore.config.ref>${valid.encryption.without.keystore.config}</valid.encryption.without.keystore.config.ref>
        <!-- FIPS-only tests: ignored by default, enabled when running in FIPS mode -->
        <env.ignore.outside-fips>true</env.ignore.outside-fips>
        <!-- SHA-1 rejection test: only runs in FIPS 140-3 (SHA-1 is allowed in FIPS 140-2) -->
        <env.ignore.outside-fips140-3>true</env.ignore.outside-fips140-3>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.mule.sdk</groupId>
            <artifactId>mule-sdk-api</artifactId>
            <version>${sdk-api.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-ldap</artifactId>
            <version>${spring.version}</version>

            <exclusions>
                <exclusion>
                    <!-- This artifact doesn't end up being used and has known issues until 6.0.0 (6.0.0 has Java 17 as baseline) -->
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-crypto</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.wss4j</groupId>
            <artifactId>wss4j-ws-security-dom</artifactId>
            <version>${wss4j.version}</version>

            <exclusions>
                <exclusion>
                    <!-- This artifact doesn't end up being used and includes a jar-packaged vm agent -->
                    <groupId>org.ehcache</groupId>
                    <artifactId>ehcache</artifactId>
                </exclusion>
                <!--
                    bcprov is not FIPS approved and its usage is only allowed in non FIPS env
                    As we have no usage of bcprov in this module we can exclude it for FIPS compliance
                -->
                <exclusion>
                    <groupId>org.bouncycastle</groupId>
                    <artifactId>bcprov-jdk15on</artifactId>
                </exclusion>
                <!--
                    W-22373455 / CVE-2023-2976: wss4j-ws-security-common 2.4.1 declares guava 30.1-jre but
                    no class in the wss4j 2.4.1 chain references com.google.common.*. Verified via jdeps
                    against all jars in target/repository of a downstream Mule app. Excluding here so that
                    consumers don't ship the vulnerable artifact.
                -->
                <exclusion>
                    <groupId>com.google.guava</groupId>
                    <artifactId>guava</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- Update dependency to fix vulnerability       -->
        <dependency>
            <groupId>org.apache.santuario</groupId>
            <artifactId>xmlsec</artifactId>
            <version>3.0.3</version>
        </dependency>

        <!--
            W-22373455 / CVE-2023-2976: explicit guava 32.0.1-jre. Used by SoapMessageHandler
            (ImmutableMap) and WssErrorTypeProvider (ImmutableSet). Must be declared at <dependencies>
            level (not only dependencyManagement) so downstream Mule apps bundle 32.0.1-jre instead
            of falling back to wss4j-ws-security-common's transitive guava 30.1-jre request.

            Upstream context: Apache wss4j has not patched the 2.4.x line (2.4.0–2.4.3 all ship
            guava 30.1-jre). 3.0.0–3.0.4 ship guava 31.1-jre (also vulnerable). Only 3.0.5+ and
            4.0.x ship safe guava (33.x). A wss4j major upgrade is out of scope for this fix, so
            we exclude + pin instead.
        -->
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>32.0.1-jre</version>
        </dependency>

        <!--
            Spring CVE pins. spring-security-ldap ${spring.version} pulls spring-expression,
            spring-ldap-core, spring-core and spring-context transitively and UNMANAGED. Like guava
            above, these MUST be declared at <dependencies> level (not only dependencyManagement):
            dependencyManagement is not inherited when this module is consumed as a mule-plugin, so a
            depMgmt-only pin fixes our own build but is silently dropped downstream and the vulnerable
            transitive versions still land in the consuming app's classloader-model.json.

            CVE-2026-41720 (P0): spring-ldap-core off the vulnerable 3.2.16 transitive -> 3.3.8.
            CVE-2026-41850 / 41851 / 41852: spring-expression off the vulnerable 6.2.0 transitive -> 6.2.19.
        -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-expression</artifactId>
            <version>${spring-expression.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.ldap</groupId>
            <artifactId>spring-ldap-core</artifactId>
            <version>${spring-ldap-core.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring-core.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>${spring-context.version}</version>
        </dependency>

        <dependency>
            <groupId>jakarta.xml.ws</groupId>
            <artifactId>jakarta.xml.ws-api</artifactId>
            <version>${jakarta-ws-api.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.metro</groupId>
            <artifactId>webservices-rt</artifactId>
            <version>${metro.version}</version>
        </dependency>


        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>${mockito-core.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>${commons.io.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
	    <!-- from org.mule.extensions:mule-ee-core-modules-parent -->
	    <!--     from org.mule.services:mule-service-scheduler -->
	    <!-- The dep is unused. This ghost version bump is made so analysis tools don't get angry at us -->
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>32.0.1-jre</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
                <version>${spring-core.version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context</artifactId>
                <version>${spring-context.version}</version>
            </dependency>
            <!-- Pin Byte Buddy to a J25-aware version (Mockito ships older 1.12.x which fails on Java class-file 69). -->
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy</artifactId>
                <version>${byte-buddy.version}</version>
            </dependency>
            <dependency>
                <groupId>net.bytebuddy</groupId>
                <artifactId>byte-buddy-agent</artifactId>
                <version>${byte-buddy.version}</version>
            </dependency>
            <!--
                CVE-2026-41850 / 41851 / 41852: spring-security-ldap 6.5.10 pulls spring-expression 6.2.0
                transitively (UNMANAGED). Pin to 6.2.19 to match the already-managed spring-core/spring-context.
            -->
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-expression</artifactId>
                <version>${spring-expression.version}</version>
            </dependency>
            <!--
                CVE-2026-41720 (P0): spring-security-ldap 6.5.10 pulls spring-ldap-core 3.2.16 transitively
                (UNMANAGED). Pin to 3.3.8 (same 3.x major) which carries the fix.
            -->
            <dependency>
                <groupId>org.springframework.ldap</groupId>
                <artifactId>spring-ldap-core</artifactId>
                <version>${spring-ldap-core.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <distributionManagement>
        <repository>
            <id>mule-releases</id>
            <name>Mule Release Repository</name>
            <url>https://repository-master.mulesoft.org/nexus/content/repositories/releases</url>
        </repository>
        <snapshotRepository>
            <id>mule-ee-snapshots</id>
            <name>Mule Snapshot Repository</name>
            <url>https://repository-master.mulesoft.org/nexus/content/repositories/ci-snapshots</url>
            <uniqueVersion>false</uniqueVersion>
        </snapshotRepository>
    </distributionManagement>

    <repositories>
        <repository>
            <id>mulesoft-maven-all</id>
            <name>Mulesoft Maven All</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/content/repositories/mulesoft-maven-all/</url>
        </repository>
        <repository>
            <id>maven2-proxy-msp-n3builds</id>
            <name>Maven2 Proxy MSP n3 Builds</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/repository/maven2-proxy-msp-n3builds</url>
        </repository>
        <repository>
            <id>studio</id>
            <name>Studio build repositories</name>
            <url>https://repository.mulesoft.org/nexus/content/groups/studio</url>
        </repository>
        <repository>
            <id>mule-private</id>
            <name>Mule Repository</name>
            <url>https://repository.mulesoft.org/nexus/content/repositories/private/</url>
        </repository>
    </repositories>

    <pluginRepositories>
        <pluginRepository>
            <id>studio</id>
            <name>Studio build repositories</name>
            <url>https://repository.mulesoft.org/nexus/content/groups/studio</url>
        </pluginRepository>
        <pluginRepository>
            <id>mulesoft-maven-all</id>
            <name>Mulesoft Maven All</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/content/repositories/mulesoft-maven-all/</url>
        </pluginRepository>
        <pluginRepository>
            <id>maven2-proxy-msp-n3builds</id>
            <name>Maven2 Proxy MSP n3 Builds</name>
            <url>https://nexus-proxy.repo.local.sfdc.net/nexus/repository/maven2-proxy-msp-n3builds</url>
        </pluginRepository>

        <pluginRepository>
            <id>mule-private</id>
            <name>Mule Repository</name>
            <url>https://repository.mulesoft.org/nexus/content/repositories/private/</url>
        </pluginRepository>

    </pluginRepositories>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>com.mulesoft.munit</groupId>
                    <artifactId>munit-extensions-maven-plugin</artifactId>
                    <version>${munit.extensions.maven.plugin.version}</version>
                    <executions>
                        <execution>
                            <goals>
                                <goal>test</goal>
                            </goals>
                            <phase>integration-test</phase>
                        </execution>
                    </executions>
                    <configuration>
                        <argLines>
                            <argLine>
                                -javaagent:${settings.localRepository}/org/jacoco/org.jacoco.agent/${jacoco.version}/org.jacoco.agent-${jacoco.version}-runtime.jar=destfile=${session.executionRootDirectory}/target/jacoco.exec
                            </argLine>
                        </argLines>
                        <runtimeConfiguration>
                            <discoverRuntimes>
                                <product>EE</product>
                                <includeSnapshots>true</includeSnapshots>
                            </discoverRuntimes>
                        </runtimeConfiguration>
                        <environmentVariables>
                            <LDAP_HOST>${ldap.host}</LDAP_HOST>
                            <LDAP_PORT>${ldap.port}</LDAP_PORT>
                        </environmentVariables>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>com.mulesoft.munit</groupId>
                            <artifactId>munit-runner</artifactId>
                            <version>${munit.version}</version>
                            <classifier>mule-plugin</classifier>
                        </dependency>
                        <dependency>
                            <groupId>com.mulesoft.munit</groupId>
                            <artifactId>munit-tools</artifactId>
                            <version>${munit.version}</version>
                            <classifier>mule-plugin</classifier>
                        </dependency>
                    </dependencies>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>${maven.compiler.plugin.version}</version>
            </plugin>
            <plugin>
                <groupId>io.fabric8</groupId>
                <artifactId>docker-maven-plugin</artifactId>
                <version>${docker.maven.plugin.version}</version>
                <configuration>
                    <skip>${docker.skip}</skip>
                    <images>
                        <image>
                            <name>rroemhild/test-openldap:latest</name>
                            <build>
                                <dockerFileDir>${project.basedir}</dockerFileDir>
                            </build>
                            <run>
                                <platform>linux/amd64</platform>
                                <ports>
                                    <port>ldap.port:10389</port>
                                </ports>
                                <log>
                                    <enabled>false</enabled>
                                </log>
                                <!--Workaround for avoiding name collisions with zombie containers left from failed executions-->
                                <!--or parallel executions on same agent-->
                                <containerNamePattern>%n-%i-%t</containerNamePattern>
                            </run>
                        </image>
                    </images>
                    <verbose>true</verbose>
                </configuration>
                <executions>
                    <execution>
                        <id>start</id>
                        <phase>test-compile</phase>
                        <goals>
                            <goal>build</goal>
                            <goal>start</goal>
                        </goals>
                        <configuration>
                            <showLogs>false</showLogs>
                            <logStdout>false</logStdout>
                        </configuration>
                    </execution>
                    <!--https://github.com/fabric8io/docker-maven-plugin/issues/915, if tests fail, run docker stop <CONTAINER_ID>-->
                    <execution>
                        <id>stop</id>
                        <phase>post-integration-test</phase>
                        <goals>
                            <goal>stop</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <artifactId>maven-resources-plugin</artifactId>
                <executions>
                    <execution>
                        <id>copy-munit-resources</id>
                        <phase>process-test-resources</phase>
                        <goals>
                            <goal>copy-resources</goal>
                        </goals>
                        <configuration>
                            <outputDirectory>${munit.output.directory}</outputDirectory>
                            <resources>
                                <resource>
                                    <directory>${munit.input.directory}</directory>
                                    <filtering>true</filtering>
                                </resource>
                            </resources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven.surefire.plugin.version}</version>
            </plugin>
            <plugin>
                <groupId>com.mulesoft.munit</groupId>
                <artifactId>munit-extensions-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>io.qameta.allure</groupId>
                <artifactId>allure-maven</artifactId>
            </plugin>

        </plugins>
    </build>

    <profiles>
        <!-- Profile for SFDC Internal Nexus (used by first maven-publish step) -->
        <profile>
            <id>release-sfci</id>
            <activation>
                <activeByDefault>false</activeByDefault>
            </activation>
            <distributionManagement>
                <repository>
                    <id>project</id>
                    <name>SFCI Internal Releases</name>
                    <url>${env.NEXUS_BASE_URL}/repositories/releases/</url>
                </repository>
                <snapshotRepository>
                    <id>project</id>
                    <name>SFCI Internal Snapshots</name>
                    <url>${env.NEXUS_BASE_URL}/repositories/snapshots/</url>
                </snapshotRepository>
            </distributionManagement>
        </profile>

        <profile>
            <id>default-config</id>
            <activation>
                <property>
                    <name>!mule.security.model</name> <!-- if mule.security.model does not exist -->
                </property>
            </activation>
            <properties>
                <validate.saml.empty.truststore.config>validate-saml-using-empty-truststore-config</validate.saml.empty.truststore.config>
                <validate.saml.truststore.config>validate-saml-using-truststore-config</validate.saml.truststore.config>
                <validate.saml.truststore.non.matching.config>validate-saml-using-truststore-non-matching-issuer-config</validate.saml.truststore.non.matching.config>
                <request.without.security.config>request-without-security-config</request.without.security.config>
                <validate.signature.config>validate-signature-config</validate.signature.config>
                <valid.certificate.constraint.config>valid-certificate-constraint-config</valid.certificate.constraint.config>
                <invalid.certificate.constraint.config>invalid-certificate-constraint-config</invalid.certificate.constraint.config>
                <expression.certificate.constraint.config>expression-certificate-constraint-config</expression.certificate.constraint.config>
                <decryption.config>decryption-config</decryption.config>
                <decryption.username.config>decryption-username-config</decryption.username.config>
                <remove.header.config>remove-header-config</remove.header.config>
                <wss.validation.config>wss-validation-config</wss.validation.config>
                <outbound.timestamp.sign.config>outbound-timestamp-sign-config</outbound.timestamp.sign.config>
                <encryption.config>encryption-config</encryption.config>
                <encryption.config.with.key>encryption-config-with-encryption-key-identifier</encryption.config.with.key>
                <sign.config>sign-config</sign.config>
                <check.signature.with.binary.security.token.config>check-signature-with-binary-security-token-config</check.signature.with.binary.security.token.config>
                <valid.encryption.without.keystore.config>valid-encryption-without-keystore-config</valid.encryption.without.keystore.config>
            </properties>
        </profile>
        <profile>
            <id>fips-config</id>
            <activation>
                <property>
                    <name>mule.security.model</name>
                </property>
            </activation>
            <properties>
                <validate.saml.empty.truststore.config>validate-saml-using-empty-truststore-config-fips</validate.saml.empty.truststore.config>
                <validate.saml.truststore.config>validate-saml-using-truststore-config-fips</validate.saml.truststore.config>
                <validate.saml.truststore.non.matching.config>validate-saml-using-truststore-non-matching-issuer-config-fips</validate.saml.truststore.non.matching.config>
                <request.without.security.config>request-without-security-config-fips</request.without.security.config>
                <validate.signature.config>validate-signature-config-fips</validate.signature.config>
                <valid.certificate.constraint.config>valid-certificate-constraint-config-fips</valid.certificate.constraint.config>
                <invalid.certificate.constraint.config>invalid-certificate-constraint-config-fips</invalid.certificate.constraint.config>
                <expression.certificate.constraint.config>expression-certificate-constraint-config-fips</expression.certificate.constraint.config>
                <decryption.config>decryption-config-fips</decryption.config>
                <decryption.username.config>decryption-username-config-fips</decryption.username.config>
                <remove.header.config>remove-header-config-fips</remove.header.config>
                <wss.validation.config>wss-validation-config-fips</wss.validation.config>
                <outbound.timestamp.sign.config>outbound-timestamp-sign-config-fips</outbound.timestamp.sign.config>
                <encryption.config>encryption-config-fips</encryption.config>
                <encryption.config.with.key>encryption-config-with-encryption-key-identifier-fips</encryption.config.with.key>
                <sign.config>sign-config-fips</sign.config>
                <check.signature.with.binary.security.token.config>check-signature-with-binary-security-token-config-fips</check.signature.with.binary.security.token.config>
                <valid.encryption.without.keystore.config>valid-encryption-without-keystore-config-fips</valid.encryption.without.keystore.config>
                <!-- Enable FIPS-only tests (rejection tests) when running in FIPS mode -->
                <env.ignore.outside-fips>false</env.ignore.outside-fips>
            </properties>
        </profile>
        <!-- FIPS 140-3 specific: SHA-1 is only rejected in FIPS 140-3 (not 140-2) -->
        <profile>
            <id>fips140-3-config</id>
            <activation>
                <property>
                    <name>mule.security.model</name>
                    <value>fips140-3</value>
                </property>
            </activation>
            <properties>
                <env.ignore.outside-fips140-3>false</env.ignore.outside-fips140-3>
            </properties>
        </profile>
    </profiles>
</project>
