<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.camunda</groupId>
        <artifactId>camunda-release-parent</artifactId>
        <version>4.1.1</version>
        <relativePath/>
    </parent>

    <groupId>io.camunda</groupId>
    <artifactId>camunda-security-library</artifactId>
    <version>0.1.0-alpha21</version>
    <packaging>pom</packaging>

    <name>Camunda Security Library</name>
    <description>Unified identity and authorization library for the Camunda 8 platform.</description>

    <licenses>
        <license>
            <name>Camunda License v1.0</name>
            <url>https://github.com/camunda/camunda-security-library/blob/main/licenses/CAMUNDA-LICENSE-1.0.txt</url>
        </license>
    </licenses>

    <scm>
        <connection>scm:git:https://github.com/camunda/camunda-security-library.git</connection>
        <developerConnection>scm:git:https://github.com/camunda/camunda-security-library.git</developerConnection>
        <url>https://github.com/camunda/camunda-security-library</url>
        <tag>0.1.0-alpha21</tag>
    </scm>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.release>21</maven.compiler.release>
        <spring-boot.version>4.0.6</spring-boot.version>
        <archunit.version>1.4.2</archunit.version>
        <testcontainers.version>2.0.5</testcontainers.version>
        <nimbus-jose-jwt.version>10.9</nimbus-jose-jwt.version>
        <plugin.version.enforcer>3.6.3</plugin.version.enforcer>
        <plugin.version.spotless>3.5.1</plugin.version.spotless>
        <plugin.version.google-java-format>1.23.0</plugin.version.google-java-format>
        <plugin.version.checkstyle>3.6.0</plugin.version.checkstyle>
        <version.checkstyle>13.4.2</version.checkstyle>
        <plugin.version.exec>3.6.3</plugin.version.exec>
        <plugin.version.dependency>3.10.0</plugin.version.dependency>
        <plugin.version.release>3.3.1</plugin.version.release>
        <license.header.file>${maven.multiModuleProjectDirectory}/COPYING-HEADER.txt</license.header.file>
        <spotless.check.skip>false</spotless.check.skip>
        <git.hooks.configure.skip>false</git.hooks.configure.skip>
    </properties>

    <modules>
        <module>core</module>
        <module>api</module>
        <module>spring-boot-starter</module>
    </modules>

    <distributionManagement>
        <snapshotRepository>
            <id>camunda-nexus</id>
            <url>https://artifacts.camunda.com/artifactory/camunda-identity-snapshots/</url>
        </snapshotRepository>
        <repository>
            <id>camunda-nexus</id>
            <url>https://artifacts.camunda.com/artifactory/camunda-identity/</url>
        </repository>
    </distributionManagement>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.testcontainers</groupId>
                <artifactId>testcontainers-bom</artifactId>
                <version>${testcontainers.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5-api</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5-engine</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <!--
              Pinned because Spring Boot 4.0.x's BOM does not manage
              nimbus-jose-jwt directly; it is pulled in transitively via
              spring-security-oauth2-jose → oauth2-oidc-sdk. CSL references
              Nimbus types directly from CompositeJWKSource and the composite
              JwtDecoder wiring, so the version is pinned here to keep the
              compile classpath aligned with the transitive runtime classpath.
            -->
            <dependency>
                <groupId>com.nimbusds</groupId>
                <artifactId>nimbus-jose-jwt</artifactId>
                <version>${nimbus-jose-jwt.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.5.5</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.15.0</version>
                    <configuration combine.self="override">
                        <release>${maven.compiler.release}</release>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>3.5.0</version>
                    <configuration combine.self="override">
                        <archive>
                            <manifest>
                                <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                            </manifest>
                        </archive>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>3.12.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-release-plugin</artifactId>
                    <version>${plugin.version.release}</version>
                    <configuration>
                        <!--
                            Re-canonicalize POMs after every release-plugin edit via the
                            spotless-maven-plugin <formats> block defined later in this
                            <pluginManagement>. Without this, the jdom-based
                            POM rewriter would introduce cosmetic churn (collapsed
                            <project> attrs, spaces in self-closing tags) on every release
                            commit. Override the default 'clean verify' for preparationGoals
                            because verify's spotless:check would reject the still-noisy
                            intermediate POM before spotless:apply could canonicalize it.
                            Main is gated by PR/build CI which runs mvn verify on every
                            push and PR, so the dispatcher releases from an already-
                            verified state; release:perform re-runs the verify+deploy
                            lifecycle on the tag, so a verify inside release:prepare
                            would be redundant.
                        -->
                        <preparationGoals>spotless:apply</preparationGoals>
                        <completionGoals>spotless:apply</completionGoals>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-enforcer-plugin</artifactId>
                    <version>${plugin.version.enforcer}</version>
                    <executions>
                        <execution>
                            <id>enforce-dependency-convergence</id>
                            <goals>
                                <goal>enforce</goal>
                            </goals>
                            <configuration>
                                <rules>
                                    <dependencyConvergence/>
                                </rules>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>${plugin.version.dependency}</version>
                    <executions>
                        <execution>
                            <id>analyze-dependencies</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>analyze-only</goal>
                            </goals>
                            <configuration>
                                <failOnWarning>true</failOnWarning>
                                <ignoredUnusedDeclaredDependencies combine.children="append">
                                    <!-- Runtime-only test engines; no source reference. -->
                                    <ignoredUnusedDeclaredDependency>com.tngtech.archunit:archunit-junit5-engine</ignoredUnusedDeclaredDependency>
                                    <ignoredUnusedDeclaredDependency>org.junit.jupiter:junit-jupiter-engine</ignoredUnusedDeclaredDependency>
                                </ignoredUnusedDeclaredDependencies>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>com.diffplug.spotless</groupId>
                    <artifactId>spotless-maven-plugin</artifactId>
                    <version>${plugin.version.spotless}</version>
                    <configuration>
                        <java>
                            <googleJavaFormat>
                                <version>${plugin.version.google-java-format}</version>
                                <style>GOOGLE</style>
                            </googleJavaFormat>
                            <licenseHeader>
                                <file>${license.header.file}</file>
                            </licenseHeader>
                        </java>
                        <formats>
                            <!--
                                Targeted fixes for the maven-release-plugin's jdom-based
                                POM rewriter, which otherwise introduces formatting churn
                                on every release commit:
                                  1. Drops the leading horizontal whitespace that jdom
                                     inserts before the slash in self-closing tags, e.g.
                                     turns "relativePath SPACE/>" back into
                                     "relativePath/>". (Spelled out because the literal
                                     noisy form gets canonicalized by this very rule.)
                                  2. Restores the multi-line <project xmlns="..."> opening
                                     (jdom collapses all attributes onto one line).
                                Implemented as text replacements rather than sortPom so we
                                don't reorder any of the existing POM structure.
                                Wired into release:prepare via the maven-release-plugin's
                                preparationGoals + completionGoals above.
                            -->
                            <format>
                                <includes>
                                    <include>pom.xml</include>
                                    <include>**/pom.xml</include>
                                </includes>
                                <excludes>
                                    <!-- Don't walk into build-output trees, in particular
                                         target/checkout/** which release:perform creates
                                         when localCheckout=true. -->
                                    <exclude>**/target/**</exclude>
                                </excludes>
                                <replaceRegex>
                                    <name>self-closing tag without leading space</name>
                                    <!-- \h matches horizontal whitespace and survives
                                         XML's leading-whitespace trim where a literal
                                         space would be eaten. -->
                                    <searchRegex>\h+/&gt;</searchRegex>
                                    <replacement>/&gt;</replacement>
                                </replaceRegex>
                                <replaceRegex>
                                    <name>multi-line project opening</name>
                                    <searchRegex>&lt;project xmlns="([^"]+)" xmlns:xsi="([^"]+)" xsi:schemaLocation="([^"]+)"&gt;</searchRegex>
                                    <replacement>&lt;project xmlns="$1"
         xmlns:xsi="$2"
         xsi:schemaLocation="$3"&gt;</replacement>
                                </replaceRegex>
                                <endWithNewline/>
                            </format>
                        </formats>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-checkstyle-plugin</artifactId>
                    <version>${plugin.version.checkstyle}</version>
                    <configuration>
                        <configLocation>${maven.multiModuleProjectDirectory}/config/checkstyle/checkstyle.xml</configLocation>
                        <includeTestSourceDirectory>true</includeTestSourceDirectory>
                        <failOnViolation>true</failOnViolation>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>com.puppycrawl.tools</groupId>
                            <artifactId>checkstyle</artifactId>
                            <version>${version.checkstyle}</version>
                        </dependency>
                    </dependencies>
                    <executions>
                        <execution>
                            <id>validate-java</id>
                            <phase>validate</phase>
                            <goals>
                                <goal>check</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>spotless-check</id>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <phase>verify</phase>
                        <configuration>
                            <skip>${spotless.check.skip}</skip>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <id>autoFormat</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>com.diffplug.spotless</groupId>
                        <artifactId>spotless-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>spotless-apply</id>
                                <goals>
                                    <goal>apply</goal>
                                </goals>
                                <phase>process-sources</phase>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
            Points git's core.hooksPath at the in-tree .mvn/hooks directory during
            the initialize phase. Git then runs hooks directly from there — no copy,
            no .git/hooks/ management. core.hooksPath is a relative path resolved
            against each checkout's working tree root, so this works in standard
            clones and worktrees alike.

            Active when both conditions hold:
              1. A .git file or directory exists at the project root.
              2. The skip.hooks property is NOT set (pass -Dskip.hooks=true to suppress).
            Maven profile activation ANDs multiple conditions within one <activation> block.

            CI environments: the companion profile below sets git.hooks.configure.skip=true
            when the CI env var is present, which toggles the exec plugin's skip flag.
        -->
        <profile>
            <id>configure-git-hooks</id>
            <activation>
                <file>
                    <exists>${project.basedir}/.git</exists>
                </file>
                <property>
                    <name>!skip.hooks</name>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <version>${plugin.version.exec}</version>
                        <executions>
                            <execution>
                                <id>configure-git-hooks-path</id>
                                <phase>initialize</phase>
                                <goals><goal>exec</goal></goals>
                                <configuration>
                                    <executable>git</executable>
                                    <arguments>
                                        <argument>config</argument>
                                        <argument>--local</argument>
                                        <argument>core.hooksPath</argument>
                                        <argument>.mvn/hooks</argument>
                                    </arguments>
                                    <skip>${git.hooks.configure.skip}</skip>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
            Suppresses the configure step in CI. When the CI environment variable is set
            (standard on GitHub Actions, GitLab CI, Jenkins, CircleCI, etc.), this profile
            activates and flips git.hooks.configure.skip to true so the exec execution
            is a no-op.
        -->
        <profile>
            <id>skip-git-hooks-in-ci</id>
            <activation>
                <property>
                    <name>env.CI</name>
                </property>
            </activation>
            <properties>
                <git.hooks.configure.skip>true</git.hooks.configure.skip>
            </properties>
        </profile>
    </profiles>
</project>
