pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--

    Copyright © 2018 Sven Ruppert (sven.ruppert@gmail.com)

    Licensed under the EUPL, Version 1.2 or - as soon they will be
    approved by the European Commission - subsequent versions of the
    EUPL (the "Licence"); You may not use this work except in
    compliance with the Licence. You may obtain a copy of the Licence at:

    https://joinup.ec.europa.eu/software/page/eupl

-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>com.svenruppert</groupId>
        <artifactId>dependencies</artifactId>
        <version>06.02.02</version>
    </parent>

    <groupId>com.svenruppert.jsentinel</groupId>
    <artifactId>jSentinel-parent</artifactId>
    <version>00.79.20</version>
    <packaging>pom</packaging>

    <name>jSentinel — Security for Vaadin Flow</name>
    <description>A Core Java Security Framework for Vaadin</description>
    <inceptionYear>2018</inceptionYear>
    <organization>
        <name>jSentinel by Sven Ruppert</name>
        <url>https://jsentinel.eu</url>
    </organization>
    <url>https://github.com/vaadin-developer/security-for-flow</url>

    <scm>
        <url>https://github.com/vaadin-developer/security-for-flow</url>
        <connection>
            scm:git:https://github.com/vaadin-developer/security-for-flow.git
        </connection>
        <developerConnection>
            scm:git:https://github.com/vaadin-developer/security-for-flow.git
        </developerConnection>
        <tag>HEAD</tag>
    </scm>
    <developers>
        <developer>
            <name>Sven Ruppert</name>
            <email>sven.ruppert@gmail.com</email>
            <roles>
                <role>Developer</role>
            </roles>
            <timezone>+1</timezone>
        </developer>
    </developers>
    <issueManagement>
        <system>Github</system>
        <url>
            https://github.com/vaadin-developer/security-for-flow/issues
        </url>
    </issueManagement>
    <licenses>
        <license>
            <name>European Union Public Licence 1.2</name>
            <url>https://joinup.ec.europa.eu/software/page/eupl</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <modules>
        <module>jSentinel-core</module>
        <module>jSentinel-vaadin</module>
        <module>jSentinel-rest</module>
        <module>jSentinel-standalone</module>
        <module>jSentinel-test</module>
        <module>jSentinel-processor</module>
        <module>jSentinel-persistence-testkit</module>
        <module>jSentinel-persistence-eclipsestore</module>
        <module>jSentinel-crypto-bc</module>
        <module>jSentinel-credentials-hibp</module>
        <module>jSentinel-autoservice-annotations</module>
        <module>jSentinel-autoservice-processor</module>
        <module>jSentinel-dx</module>
        <module>jSentinel-dx-vaadin</module>
        <module>jSentinel-dx-rest</module>
        <module>jSentinel-dx-standalone</module>
        <module>jSentinel-vaadin-starter</module>
        <module>jSentinel-propagation</module>
        <module>jSentinel-propagation-processor</module>
        <module>jSentinel-propagation-oidc</module>
        <module>jSentinel-events</module>
        <module>jSentinel-events-rest</module>
        <module>jSentinel-events-testkit</module>
        <module>jSentinel-events-persistence-eclipsestore</module>
        <module>jSentinel-jwt</module>
        <module>jSentinel-oauth2</module>
        <module>jSentinel-oauth2-vaadin</module>
        <module>jSentinel-oauth2-rest</module>
        <module>jSentinel-identity-oidc</module>
        <module>jSentinel-identity-oidc-vaadin</module>
        <module>jSentinel-identity-oidc-rest</module>
        <module>jSentinel-test-oidc</module>
        <module>jSentinel-identity-vendor-keycloak</module>
        <module>jSentinel-identity-vendor-entra</module>
        <module>jSentinel-identity-vendor-auth0</module>
        <module>jSentinel-identity-vendor-okta</module>
        <module>jSentinel-identity-vendor-google</module>
        <module>jSentinel-identity-vendor-github</module>
        <module>jSentinel-dpop</module>
        <module>demo-rest-shared</module>
        <module>demo-vaadin</module>
        <module>demo-rest</module>
        <module>demo-vaadin-rest-client</module>
        <module>demo-standalone</module>
        <module>demo-jsentinel-vaadin</module>
        <module>demo-jsentinel-vaadin-persistence</module>
        <module>demo-jsentinel-vaadin-hardening</module>
        <module>demo-jsentinel-rest</module>
        <module>demo-jsentinel-rest-persistence</module>
        <module>demo-jsentinel-rest-hardening</module>
        <module>demo-jsentinel-standalone</module>
        <module>demo-jsentinel-standalone-persistence</module>
        <module>demo-jsentinel-standalone-hardening</module>
        <module>demo-jsentinel-vaadin-rest-client</module>
    </modules>

    <properties>
        <licenseName>European Union Public Licence 1.2</licenseName>

        <!-- deploy-repo-url + deploy-repo-snapshots-url are inherited from
             com.svenruppert:dependencies:06.02.01 and point at the Sonatype
             OSSRH staging endpoint. Do NOT override them with the
             repo.maven.apache.org read mirror — that URL rejects uploads. -->

        <jdk.version>26</jdk.version>

        <maven.compiler.release>${jdk.version}</maven.compiler.release>
        <maven.compiler.source>${jdk.version}</maven.compiler.source> <!--redundant, but IntelliJ doesn't-->
        <maven.compiler.target>${jdk.version}</maven.compiler.target> <!--use release when importing-->

        <maven.compiler.testRelease>${jdk.version}</maven.compiler.testRelease>
        <maven.compiler.testSource>${jdk.version}</maven.compiler.testSource>
        <maven.compiler.testTarget>${jdk.version}</maven.compiler.testTarget>

        <minimum-maven.version>4.0.0-rc-5</minimum-maven.version>

        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

        <pitest-prod-classes>com.svenruppert.*</pitest-prod-classes>
        <pitest-test-classes>com.svenruppert.*</pitest-test-classes>

        <junit-platform-maven-plugin.timeout>300</junit-platform-maven-plugin.timeout>

        <spotbugs.skip>true</spotbugs.skip>

        <!--        Vaadin Flow Properties-->
        <failOnMissingWebXml>false</failOnMissingWebXml>
        <vaadin.version>25.1.1</vaadin.version>
        <drivers.downloader.phase>pre-integration-test</drivers.downloader.phase>
        <jetty.version>12.1.8</jetty.version>
        <slf4j-api.version>2.0.17</slf4j-api.version>
        <junit-jupiter.version>6.1.0</junit-jupiter.version>
    </properties>

    <repositories>
        <!-- The order of definitions matters. Explicitly defining central here to make sure it has the highest priority. -->
        <repository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>vaadin-prereleases</id>
            <url>
                https://maven.vaadin.com/vaadin-prereleases/
            </url>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </repository>
        <!-- Repository used by many Vaadin add-ons -->
        <repository>
            <id>Vaadin Directory</id>
            <url>https://maven.vaadin.com/vaadin-addons</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>apache snapshots</id>
            <url>https://repository.apache.org/content/repositories/snapshots</url>
        </repository>
    </repositories>

    <pluginRepositories>
        <!-- The order of definitions matters. Explicitly defining central here to make sure it has the highest priority. -->
        <pluginRepository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
        <pluginRepository>
            <id>vaadin-prereleases</id>
            <url>
                https://maven.vaadin.com/vaadin-prereleases/
            </url>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>

    <dependencyManagement>
        <dependencies>
            <!--
              V00.75.10: pin com.svenruppert:core to 06.02.02, overriding the
              06.02.01 managed by the dependencies BOM. 06.02.02 is the first
              core release that ships the MediaType enum (skill /mediatype)
              alongside HttpStatus and HasLogger; 06.02.01 had only HttpStatus.
            -->
            <dependency>
                <groupId>com.svenruppert</groupId>
                <artifactId>core</artifactId>
                <version>06.02.02</version>
            </dependency>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-bom</artifactId>
                <type>pom</type>
                <scope>import</scope>
                <version>${vaadin.version}</version>
            </dependency>
            <dependency>
                <groupId>org.junit.jupiter</groupId>
                <artifactId>junit-jupiter</artifactId>
                <version>${junit-jupiter.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <defaultGoal>jetty:run</defaultGoal>
        <plugins>
            <plugin>
                <groupId>org.sonatype.central</groupId>
                <artifactId>central-publishing-maven-plugin</artifactId>
                <extensions>true</extensions>
                <configuration>
                    <publishingServerId>central</publishingServerId>
                    <excludeArtifacts>
                        <excludeArtifact>demo-rest-shared</excludeArtifact>
                        <excludeArtifact>demo-rest</excludeArtifact>
                        <excludeArtifact>demo-vaadin</excludeArtifact>
                        <excludeArtifact>demo-vaadin-rest-client</excludeArtifact>
                        <excludeArtifact>demo-standalone</excludeArtifact>
                    </excludeArtifacts>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>license-maven-plugin</artifactId>
                <configuration>
                    <verbose>true</verbose>
                    <addSvnKeyWords>true</addSvnKeyWords>
                </configuration>
                <executions>
                    <execution>
                        <id>first</id>
                        <goals>
                            <goal>update-file-header</goal>
                        </goals>
                        <phase>process-sources</phase>
                        <configuration>
                            <licenseName>eupl_v1_1</licenseName>
                            <roots>
                                <root>src/main/java</root>
                                <root>src/test</root>
                            </roots>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-maven-plugin</artifactId>
                <version>${vaadin.version}</version>
                <executions>
                    <execution>
                        <phase>none</phase>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <inherited>true</inherited>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <executions>
                    <execution>
                        <id>enforce-maven-3</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>${minimum-maven.version}</version>
                                </requireMavenVersion>
                            </rules>
                            <fail>true</fail>
                        </configuration>
                    </execution>
                    <!--
                      V00.74.20 Phase 3 — Konzept §9 "No-Mocks-Disziplin":
                      jSentinel tests are written against real
                      implementations (real EmbeddedStorageManager wrappers,
                      real subjects, real storage facades). Mocking-framework
                      tests obscure contract violations and make refactors
                      brittle. The ban is reactor-wide because the discipline
                      applies to every module — including consumer demos.
                    -->
                    <execution>
                        <id>ban-mocking-frameworks</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <bannedDependencies>
                                    <excludes>
                                        <exclude>org.mockito:*</exclude>
                                        <exclude>org.easymock:*</exclude>
                                        <exclude>org.powermock:*</exclude>
                                        <exclude>net.bytebuddy:byte-buddy-agent</exclude>
                                    </excludes>
                                </bannedDependencies>
                            </rules>
                            <fail>true</fail>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
                <configuration>
                    <!--                    <rulesUri>version-number-rules.xml</rulesUri>-->
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-scm-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <!-- jar goal is bound by the default lifecycle; do not re-declare. -->
                            <goal>test-jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-repository-plugin</artifactId>
            </plugin>

            <!--Enable mutation testing-->
            <plugin>
                <groupId>org.pitest</groupId>
                <artifactId>pitest-maven</artifactId>
                <dependencies>
                    <dependency>
                        <groupId>org.pitest</groupId>
                        <artifactId>pitest-junit5-plugin</artifactId>
                        <version>1.2.3</version>
                    </dependency>

                </dependencies>
                <configuration>
                    <threads>2</threads>
                    <outputFormats>
                        <outputFormat>XML</outputFormat>
                        <outputFormat>HTML</outputFormat>
                    </outputFormats>
                    <targetClasses>
                        <param>${pitest-prod-classes}</param>
                        <!--<param>org.reflections.*</param>-->
                    </targetClasses>
                    <targetTests>
                        <param>${pitest-test-classes}</param>
                    </targetTests>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.9.1</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <projectType>library</projectType>
                    <schemaVersion>1.4</schemaVersion>
                    <includeBomSerialNumber>true</includeBomSerialNumber>
                    <includeCompileScope>true</includeCompileScope>
                    <includeProvidedScope>true</includeProvidedScope>
                    <includeRuntimeScope>true</includeRuntimeScope>
                    <includeSystemScope>true</includeSystemScope>
                    <includeTestScope>false</includeTestScope>
                    <includeLicenseText>false</includeLicenseText>
                    <outputReactorProjects>true</outputReactorProjects>
                    <outputFormat>all</outputFormat>
                    <outputName>CycloneDX-SBom</outputName>
                </configuration>
            </plugin>
            <!-- jSentinel-branded Javadoc: applies the project's theme skin
                 (docs/javadoc/jsentinel.css) on top of the stock JDK
                 stylesheet at generation time, so every generated /
                 published -javadoc.jar renders in the jSentinel design with
                 the built-in JDK Light/Dark/System toggle driving the
                 lime palette.

                 IMPORTANT: javadocDirectory must point at a TRACKED directory.
                 It used to point at build/javadoc, which is .gitignore'd
                 (build/), so a `git clean -dfx` or fresh clone left the
                 stylesheet absent. Combined with failOnError=false below,
                 the javadoc tool then aborted with "additional stylesheet
                 file does not exist", the error was swallowed, and the
                 release shipped EMPTY -javadoc.jar files (regression in
                 00.74.10). The theme source of truth lives under docs/. -->
            <plugin>
                <artifactId>maven-javadoc-plugin</artifactId>
                <configuration>
                    <javadocDirectory>${maven.multiModuleProjectDirectory}/docs/javadoc</javadocDirectory>
                    <addStylesheets>
                        <addStylesheet>jsentinel.css</addStylesheet>
                    </addStylesheets>
                    <doctitle>Sentinel for Java — ${project.version} API</doctitle>
                    <windowtitle>Sentinel for Java ${project.version} API</windowtitle>
                    <!-- Cross-module {@link …} references (e.g. jSentinel-dx-vaadin
                         linking into jSentinel-vaadin-starter, which it must not
                         depend on per the V00.72 module layering) don't resolve
                         per-module, so the javadoc tool emits hard "reference
                         not found" errors. We accept that — the rendered HTML
                         shows the unlinked classname instead, every other tag is
                         still validated, and the -javadoc.jar still ships. -->
                    <failOnError>false</failOnError>
                    <top><![CDATA[<div style="background:#15161a;padding:.4em .9em;font:600 13px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif"><a href="https://jsentinel.eu/" style="color:#a3e635;text-decoration:none">&#8592; jsentinel.eu</a> <span style="color:#9aa0aa">&middot; Sentinel for Java API</span></div>]]></top>
                    <bottom><![CDATA[Sentinel for Java &middot; ${project.version} &middot; EUPL&nbsp;1.2 &middot; <a href="https://jsentinel.eu/">jsentinel.eu</a>]]></bottom>
                    <notimestamp>true</notimestamp>
                    <!-- Register the three JEP 8068562 / JDK 9+ documentation
                         tags so the release-profile's failOnError doesn't
                         trip on them. apiNote / implSpec / implNote are
                         standard javadoc tags; the maven-javadoc-plugin only
                         knows about them when explicitly told. -->
                    <tags>
                        <tag>
                            <name>apiNote</name>
                            <placement>a</placement>
                            <head>API Note:</head>
                        </tag>
                        <tag>
                            <name>implSpec</name>
                            <placement>a</placement>
                            <head>Implementation Requirements:</head>
                        </tag>
                        <tag>
                            <name>implNote</name>
                            <placement>a</placement>
                            <head>Implementation Note:</head>
                        </tag>
                    </tags>
                </configuration>
            </plugin>
        </plugins>
    </build>
    <reporting>
        <plugins>
            <plugin>
                <groupId>org.pitest</groupId>
                <artifactId>pitest-maven</artifactId>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>report</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

        </plugins>
    </reporting>
    <profiles>
        <profile>
            <id>_java</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <dependencies>
                            <dependency>
                                <groupId>org.ow2.asm</groupId>
                                <artifactId>asm</artifactId>
                                <version>9.8</version> <!-- Use a newer version of ASM -->
                            </dependency>
                        </dependencies>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>build-helper-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>add sources</id>
                                <phase>compile</phase>
                                <goals>
                                    <goal>add-source</goal>
                                </goals>
                                <configuration>
                                    <sources>
                                        <source>${project.build.directory}/generated-sources/annotations</source>
                                        <source>src/main/java</source>
                                    </sources>
                                </configuration>
                            </execution>
                            <execution>
                                <id>add generated sources</id>
                                <phase>generate-sources</phase>
                                <goals>
                                    <goal>add-source</goal>
                                </goals>
                                <configuration>
                                    <sources>
                                        <source>${project.build.directory}/generated-sources/annotations</source>
                                        <source>src/main/java</source>
                                    </sources>
                                </configuration>
                            </execution>
                            <execution>
                                <id>add generated test sources</id>
                                <phase>generate-test-sources</phase>
                                <goals>
                                    <goal>add-test-source</goal>
                                </goals>
                                <configuration>
                                    <sources>
                                        <source>${project.build.directory}/generated-test-sources/test-annotations
                                        </source>
                                        <source>src/test/java</source>
                                        <source>src/test/kotlin</source>
                                    </sources>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <!-- Production mode is activated using -Pproduction -->
            <id>production</id>

            <build>
                <plugins>
                    <plugin>
                        <groupId>com.vaadin</groupId>
                        <artifactId>vaadin-maven-plugin</artifactId>
                        <version>${vaadin.version}</version>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>build-frontend</goal>
                                </goals>
                                <phase>compile</phase>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <!-- V00.76.10 H2: SpotBugs + FindSecBugs security/static-analysis gate,
             hoisted from the per-module poms into the parent so every library
             module (and any future module) inherits it automatically — closing
             the P001-class drift where a new module silently ships without the
             gate. Activated only via -Pstatic-analysis; spotbugs.skip defaults
             to true (see <properties>) so normal builds are unaffected. A central
             baseline exclude keeps it green so only NEW findings break the build.
             Demo modules inherit it too (opt-in/best-effort, A.0) but are not
             release-blocking; the release gate runs library modules only. -->
        <profile>
            <id>static-analysis</id>
            <properties>
                <spotbugs.skip>false</spotbugs.skip>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs-maven-plugin</artifactId>
                        <version>4.9.8.3</version>
                        <configuration>
                            <effort>Max</effort>
                            <threshold>Medium</threshold>
                            <failOnError>true</failOnError>
                            <excludeFilterFile>${maven.multiModuleProjectDirectory}/config/spotbugs/spotbugs-exclude.xml</excludeFilterFile>
                            <plugins>
                                <plugin>
                                    <groupId>com.h3xstream.findsecbugs</groupId>
                                    <artifactId>findsecbugs-plugin</artifactId>
                                    <version>1.13.0</version>
                                </plugin>
                            </plugins>
                        </configuration>
                        <executions>
                            <execution>
                                <id>spotbugs-gate</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>