<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.camunda</groupId>
        <artifactId>camunda-release-parent</artifactId>
        <version>4.1.1</version>
        <relativePath/>
    </parent>

    <groupId>io.camunda</groupId>
    <artifactId>camunda-security-library</artifactId>
    <version>0.1.0-alpha40</version>
    <packaging>pom</packaging>

    <name>Camunda Security Library</name>
    <description>Unified identity and authorization library for the Camunda 8 platform.</description>

    <licenses>
        <license>
            <name>Camunda License v1.0</name>
            <url>https://github.com/camunda/camunda-security-library/blob/main/licenses/CAMUNDA-LICENSE-1.0.txt</url>
        </license>
    </licenses>

    <scm>
        <connection>scm:git:https://github.com/camunda/camunda-security-library.git</connection>
        <developerConnection>scm:git:https://github.com/camunda/camunda-security-library.git</developerConnection>
        <url>https://github.com/camunda/camunda-security-library</url>
        <tag>0.1.0-alpha40</tag>
    </scm>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.release>21</maven.compiler.release>
        <spring-boot.version>4.1.0</spring-boot.version>
        <archunit.version>1.4.2</archunit.version>
        <testcontainers.version>2.0.5</testcontainers.version>
        <nimbus-jose-jwt.version>10.9.1</nimbus-jose-jwt.version>
        <plugin.version.enforcer>3.6.3</plugin.version.enforcer>
        <plugin.version.spotless>3.8.0</plugin.version.spotless>
        <plugin.version.google-java-format>1.35.0</plugin.version.google-java-format>
        <plugin.version.checkstyle>3.6.0</plugin.version.checkstyle>
        <version.checkstyle>13.7.0</version.checkstyle>
        <plugin.version.exec>3.6.3</plugin.version.exec>
        <plugin.version.dependency>3.11.0</plugin.version.dependency>
        <plugin.version.release>3.3.1</plugin.version.release>
        <license.header.file>${maven.multiModuleProjectDirectory}/COPYING-HEADER.txt</license.header.file>
        <spotless.check.skip>false</spotless.check.skip>
        <git.hooks.configure.skip>false</git.hooks.configure.skip>
    </properties>

    <modules>
        <module>core</module>
        <module>api</module>
        <module>validation</module>
        <module>spring-boot-starter</module>
    </modules>

    <distributionManagement>
        <snapshotRepository>
            <id>camunda-nexus</id>
            <url>https://artifacts.camunda.com/artifactory/camunda-identity-snapshots/</url>
        </snapshotRepository>
        <repository>
            <id>camunda-nexus</id>
            <url>https://artifacts.camunda.com/artifactory/camunda-identity/</url>
        </repository>
    </distributionManagement>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.testcontainers</groupId>
                <artifactId>testcontainers-bom</artifactId>
                <version>${testcontainers.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5-api</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <dependency>
                <groupId>com.tngtech.archunit</groupId>
                <artifactId>archunit-junit5-engine</artifactId>
                <version>${archunit.version}</version>
            </dependency>
            <!--
              Pinned because Spring Boot 4.0.x's BOM does not manage
              nimbus-jose-jwt directly; it is pulled in transitively via
              spring-security-oauth2-jose → oauth2-oidc-sdk. CSL references
              Nimbus types directly from CompositeJWKSource and the composite
              JwtDecoder wiring, so the version is pinned here to keep the
              compile classpath aligned with the transitive runtime classpath.
            -->
            <dependency>
                <groupId>com.nimbusds</groupId>
                <artifactId>nimbus-jose-jwt</artifactId>
                <version>${nimbus-jose-jwt.version}</version>
            </dependency>
            <!--
              Pinned because Spring Boot 4.0.x's BOM does not manage
              commons-validator. It is used by UserValidator for email
              address validation via EmailValidator. The version is pinned
              here so all modules resolve the same artifact.
            -->
            <dependency>
                <groupId>commons-validator</groupId>
                <artifactId>commons-validator</artifactId>
                <version>1.10.1</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.5.6</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.15.0</version>
                    <configuration combine.self="override">
                        <release>${maven.compiler.release}</release>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>3.5.0</version>
                    <configuration combine.self="override">
                        <archive>
                            <manifest>
                                <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                            </manifest>
                        </archive>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>3.12.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-release-plugin</artifactId>
                    <version>${plugin.version.release}</version>
                    <configuration>
                        <!--
                            Re-canonicalize POMs after every release-plugin edit via the
                            spotless-maven-plugin <formats> block defined later in this
                            <pluginManagement>. Without this, the jdom-based
                            POM rewriter would introduce cosmetic churn (collapsed
                            <project> attrs, spaces in self-closing tags) on every release
                            commit. Override the default 'clean verify' for preparationGoals
                            because verify's spotless:check would reject the still-noisy
                            intermediate POM before spotless:apply could canonicalize it.
                            Main is gated by PR/build CI which runs mvn verify on every
                            push and PR, so the dispatcher releases from an already-
                            verified state; release:perform re-runs the verify+deploy
                            lifecycle on the tag, so a verify inside release:prepare
                            would be redundant.
                        -->
                        <preparationGoals>spotless:apply</preparationGoals>
                        <completionGoals>spotless:apply</completionGoals>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-enforcer-plugin</artifactId>
                    <version>${plugin.version.enforcer}</version>
                    <executions>
                        <execution>
                            <id>enforce-dependency-convergence</id>
                            <goals>
                                <goal>enforce</goal>
                            </goals>
                            <configuration>
                                <rules>
                                    <dependencyConvergence/>
                                </rules>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>${plugin.version.dependency}</version>
                    <executions>
                        <execution>
                            <id>analyze-dependencies</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>analyze-only</goal>
                            </goals>
                            <configuration>
                                <failOnWarning>true</failOnWarning>
                                <ignoredUnusedDeclaredDependencies combine.children="append">
                                    <!-- Runtime-only test engines; no source reference. -->
                                    <ignoredUnusedDeclaredDependency>com.tngtech.archunit:archunit-junit5-engine</ignoredUnusedDeclaredDependency>
                                    <ignoredUnusedDeclaredDependency>org.junit.jupiter:junit-jupiter-engine</ignoredUnusedDeclaredDependency>
                                </ignoredUnusedDeclaredDependencies>
                            </configuration>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>com.diffplug.spotless</groupId>
                    <artifactId>spotless-maven-plugin</artifactId>
                    <version>${plugin.version.spotless}</version>
                    <configuration>
                        <java>
                            <googleJavaFormat>
                                <version>${plugin.version.google-java-format}</version>
                                <style>GOOGLE</style>
                            </googleJavaFormat>
                            <licenseHeader>
                                <file>${license.header.file}</file>
                            </licenseHeader>
                        </java>
                        <formats>
                            <!--
                                Targeted fixes for the maven-release-plugin's jdom-based
                                POM rewriter, which otherwise introduces formatting churn
                                on every release commit:
                                  1. Drops the leading horizontal whitespace that jdom
                                     inserts before the slash in self-closing tags, e.g.
                                     turns "relativePath SPACE/>" back into
                                     "relativePath/>". (Spelled out because the literal
                                     noisy form gets canonicalized by this very rule.)
                                  2. Restores the multi-line <project xmlns="..."> opening
                                     (jdom collapses all attributes onto one line).
                                Implemented as text replacements rather than sortPom so we
                                don't reorder any of the existing POM structure.
                                Wired into release:prepare via the maven-release-plugin's
                                preparationGoals + completionGoals above.
                            -->
                            <format>
                                <includes>
                                    <include>pom.xml</include>
                                    <include>**/pom.xml</include>
                                </includes>
                                <excludes>
                                    <!-- Don't walk into build-output trees, in particular
                                         target/checkout/** which release:perform creates
                                         when localCheckout=true. -->
                                    <exclude>**/target/**</exclude>
                                </excludes>
                                <replaceRegex>
                                    <name>self-closing tag without leading space</name>
                                    <!-- \h matches horizontal whitespace and survives
                                         XML's leading-whitespace trim where a literal
                                         space would be eaten. -->
                                    <searchRegex>\h+/&gt;</searchRegex>
                                    <replacement>/&gt;</replacement>
                                </replaceRegex>
                                <replaceRegex>
                                    <name>multi-line project opening</name>
                                    <searchRegex>&lt;project xmlns="([^"]+)" xmlns:xsi="([^"]+)" xsi:schemaLocation="([^"]+)"&gt;</searchRegex>
                                    <replacement>&lt;project xmlns="$1"
         xmlns:xsi="$2"
         xsi:schemaLocation="$3"&gt;</replacement>
                                </replaceRegex>
                                <endWithNewline/>
                            </format>
                        </formats>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-checkstyle-plugin</artifactId>
                    <version>${plugin.version.checkstyle}</version>
                    <configuration>
                        <configLocation>${maven.multiModuleProjectDirectory}/config/checkstyle/checkstyle.xml</configLocation>
                        <includeTestSourceDirectory>true</includeTestSourceDirectory>
                        <failOnViolation>true</failOnViolation>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>com.puppycrawl.tools</groupId>
                            <artifactId>checkstyle</artifactId>
                            <version>${version.checkstyle}</version>
                        </dependency>
                    </dependencies>
                    <executions>
                        <execution>
                            <id>validate-java</id>
                            <phase>validate</phase>
                            <goals>
                                <goal>check</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>spotless-check</id>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <phase>verify</phase>
                        <configuration>
                            <skip>${spotless.check.skip}</skip>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <executions>
                    <execution>
                        <id>verify-javadoc</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                        <configuration>
                            <!--
                                Check HTML correctness and syntax on every verify run so
                                malformed Javadoc (e.g. unescaped angle brackets) is caught
                                in PRs, not only during release:perform. The "missing" linter
                                is excluded so that not every public type must carry a comment
                                (too strict for a library in early development).
                            -->
                            <doclint>html,syntax</doclint>
                            <quiet>true</quiet>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <id>autoFormat</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>com.diffplug.spotless</groupId>
                        <artifactId>spotless-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>spotless-apply</id>
                                <goals>
                                    <goal>apply</goal>
                                </goals>
                                <phase>process-sources</phase>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
            Points git's core.hooksPath at the in-tree .mvn/hooks directory during
            the initialize phase. Git then runs hooks directly from there — no copy,
            no .git/hooks/ management. core.hooksPath is a relative path resolved
            against each checkout's working tree root, so this works in standard
            clones and worktrees alike.

            Active when both conditions hold:
              1. A .git file or directory exists at the project root.
              2. The skip.hooks property is NOT set (pass -Dskip.hooks=true to suppress).
            Maven profile activation ANDs multiple conditions within one <activation> block.

            CI environments: the companion profile below sets git.hooks.configure.skip=true
            when the CI env var is present, which toggles the exec plugin's skip flag.
        -->
        <profile>
            <id>configure-git-hooks</id>
            <activation>
                <file>
                    <exists>${project.basedir}/.git</exists>
                </file>
                <property>
                    <name>!skip.hooks</name>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <version>${plugin.version.exec}</version>
                        <executions>
                            <execution>
                                <id>configure-git-hooks-path</id>
                                <phase>initialize</phase>
                                <goals><goal>exec</goal></goals>
                                <configuration>
                                    <executable>git</executable>
                                    <arguments>
                                        <argument>config</argument>
                                        <argument>--local</argument>
                                        <argument>core.hooksPath</argument>
                                        <argument>.mvn/hooks</argument>
                                    </arguments>
                                    <skip>${git.hooks.configure.skip}</skip>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
            Suppresses the configure step in CI. When the CI environment variable is set
            (standard on GitHub Actions, GitLab CI, Jenkins, CircleCI, etc.), this profile
            activates and flips git.hooks.configure.skip to true so the exec execution
            is a no-op.
        -->
        <profile>
            <id>skip-git-hooks-in-ci</id>
            <activation>
                <property>
                    <name>env.CI</name>
                </property>
            </activation>
            <properties>
                <git.hooks.configure.skip>true</git.hooks.configure.skip>
            </properties>
        </profile>

        <!--
            Override of the central-publishing-maven-plugin inherited from
            camunda-release-parent's central-sonatype-publish profile.

            The release parent activates -Pcentral-sonatype-publish during
            release:perform (via the maven-release-plugin <arguments>) and
            configures central-publishing-maven-plugin with autoPublish=false,
            which leaves the deployment parked at VALIDATED in the Sonatype
            Central Portal and requires a manual "Publish" click.

            We keep using the release parent for everything else; this profile
            shares the same id (central-sonatype-publish), so Maven merges it
            into the inherited profile and the child plugin <configuration>
            wins for autoPublish. All other settings (executions, deployment
            name, skipPublishing, checksums, server id) continue to come from
            the parent. autoPublish=true lets the Central Portal publish
            automatically once validation passes, matching Management Identity.
        -->
        <profile>
            <id>central-sonatype-publish</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <configuration>
                            <autoPublish>true</autoPublish>
                            <waitUntil>published</waitUntil>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>
