build.gradle

plugins {
	id "java"
	id "idea"
	id "checkstyle"
	id "jacoco"
	id "com.github.andygoossens.modernizer" version "1.14.0"
	id "com.gorylenko.gradle-git-properties" version "4.0.1"
	id "org.springframework.boot" version "4.1.0"
	id "io.spring.dependency-management" version "1.1.7"
	id "com.github.ben-manes.versions" version "0.54.0"
	id "com.diffplug.spotless" version "8.7.0"
	id "org.cyclonedx.bom" version "3.2.4"
}

group = "de.tum.cit.aet.thesis"
version = "4.11.2"
description = "Thesis Management"

// The explicit Tomcat (11.0.22) and Netty (4.2.13.Final) version overrides that
// previously pulled security fixes ahead of the BOM are no longer needed: the
// Spring Boot 4.1.0 BOM now manages Tomcat 11.0.22 and Netty 4.2.15.Final
// (which supersedes the earlier netty-codec-http advisory fixes), so we let the
// BOM manage both rather than risk pinning to an older Netty.

gitProperties {
    // The plugin walks up from the project dir to auto-detect the .git
    // directory and natively handles git worktrees (where .git is a file
    // pointing into <main>/.git/worktrees/<name>). Setting dotGitDirectory
    // explicitly to file("../.git") breaks this for worktree checkouts
    // because that path is a file, not a directory, and JGit then fails
    // with "repository not found".
    failOnNoGitDirectory = false
}

springBoot {
	mainClass = "de.tum.cit.aet.thesis.ThesisManagementApplication"
}

java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(25)
    }
}

repositories {
	mavenCentral()
}

// Exclude Jackson 2.x databind from compile classpath to prevent accidental usage.
// Jackson 3.x (tools.jackson) is the primary Jackson version in Spring Boot 4.x.
// Jackson 2.x remains on the runtime classpath for third-party libraries (java-jwt, itext).
configurations.configureEach {
	if (it.name == "compileClasspath" || it.name == "testCompileClasspath") {
		exclude group: "com.fasterxml.jackson.core", module: "jackson-databind"
	}
}

dependencies {
	implementation "org.springframework.boot:spring-boot-starter-data-jpa"
	implementation "org.springframework.boot:spring-boot-starter-webmvc"
	implementation "org.springframework.boot:spring-boot-starter-validation"
	implementation "org.springframework.boot:spring-boot-starter-mail"
	implementation "org.springframework.boot:spring-boot-starter-webflux"
	implementation "org.springframework.boot:spring-boot-starter-security"
	implementation "org.springframework.boot:spring-boot-starter-security-oauth2-client"
	implementation "org.springframework.boot:spring-boot-starter-security-oauth2-resource-server"
	implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
	implementation "org.springframework.boot:spring-boot-starter-actuator"

	implementation platform("org.springframework.ai:spring-ai-bom:2.0.0")
	implementation "org.springframework.ai:spring-ai-pdf-document-reader"
	implementation 'org.springframework.ai:spring-ai-starter-model-openai'

	developmentOnly "org.springframework.boot:spring-boot-devtools"

    implementation "org.hibernate.orm:hibernate-core"
    implementation "org.hibernate.orm:hibernate-envers"
	
	// Avoid outdated version to prevent security issues
	implementation("net.minidev:json-smart") { version { 				strictly "2.6.0" } }

	implementation "org.springframework.boot:spring-boot-starter-liquibase"
	implementation "org.postgresql:postgresql:42.7.11"

	implementation "commons-io:commons-io:2.22.0"
	implementation "org.mnode.ical4j:ical4j:4.2.5"
	implementation "com.itextpdf:itext-core:9.6.0"
	implementation "com.itextpdf:html2pdf:6.3.2"
	implementation "com.auth0:java-jwt:4.5.2"

	// Use the latest version of commons-lang3 to avoid security issues
	implementation "org.apache.commons:commons-lang3:${commons_lang3_version}"

	implementation "ch.qos.logback:logback-classic:"
	implementation "ch.qos.logback:logback-core:"

	// use newest version of commons-compress to avoid security issues through outdated dependencies
	implementation "org.apache.commons:commons-compress:1.28.0"

	// Semantic version comparison for SBOM vulnerability range matching
	implementation "com.vdurmont:semver4j:3.1.0"

	compileOnly "org.projectlombok:lombok:1.18.46"
	annotationProcessor "org.projectlombok:lombok:1.18.46"

	testImplementation("org.springframework.boot:spring-boot-starter-test") {
		exclude group: "org.junit.vintage", module: "junit-vintage-engine"
		exclude group: "com.vaadin.external.google", module: "android-json"
		exclude group: "org.xmlunit", module: "xmlunit-core"
	}
	testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"

	testImplementation "org.mockito:mockito-core:5.23.0"
	testImplementation "org.mockito:mockito-junit-jupiter:5.23.0"

	testImplementation "org.testcontainers:testcontainers:${test_container_version}"
	testImplementation "org.testcontainers:testcontainers-junit-jupiter:${test_container_version}"
	testImplementation "org.testcontainers:testcontainers-jdbc:${test_container_version}"
	testImplementation "org.testcontainers:testcontainers-database-commons:${test_container_version}"
	testImplementation "org.testcontainers:testcontainers-postgresql:${test_container_version}"

	testImplementation "com.github.dasniko:testcontainers-keycloak:4.2.1"

	testImplementation "com.icegreen:greenmail-junit5:2.1.9"
	testImplementation "org.wiremock:wiremock-standalone:3.13.2"

	testImplementation "org.junit.jupiter:junit-jupiter:${junit_version}"
	testImplementation "org.junit.jupiter:junit-jupiter-api:${junit_version}"
	testImplementation "org.junit.jupiter:junit-jupiter-engine:${junit_version}"
	testImplementation "org.junit.jupiter:junit-jupiter-params:${junit_version}"

	// NOTE: make sure this corresponds to the version used for JUnit in the testImplementation
	testImplementation "org.junit.platform:junit-platform-commons:${junit_version}"
	testImplementation "org.junit.platform:junit-platform-engine:${junit_version}"
	testRuntimeOnly "org.junit.platform:junit-platform-launcher:${junit_version}"
}

// Force a non-vulnerable plexus-utils across all configurations (Checkstyle's Doxia pulls in 3.3.0,
// which is affected by GHSA-6fmv-xxpf-w3cw).
configurations.configureEach {
	resolutionStrategy.eachDependency { details ->
		if (details.requested.group == "org.codehaus.plexus" && details.requested.name == "plexus-utils") {
			details.useVersion("3.6.1")
			details.because("GHSA-6fmv-xxpf-w3cw")
		}
	}
}

springBoot {
	buildInfo()
}

sourceSets {
	test {
		resources {
			srcDir '../keycloak'
		}
	}
}

spotless {
	java {
		target "src/*/java/**/*.java"
		removeUnusedImports()
		importOrder("", "jakarta", "javax", "java")
		trimTrailingWhitespace()
		endWithNewline()
		leadingSpacesToTabs()
	}
}


checkstyle {
	toolVersion = "13.6.0"
	configFile = file("config/checkstyle/checkstyle.xml")
	maxWarnings = 0
}

bootRun {
	systemProperty "spring.profiles.active", "dev"
	environment "LIQUIBASE_CONTEXTS", "dev,prod"
	environment "SERVER_PORT", "8180"
}

// PostgreSQL image tag for integration-test Testcontainers. Single source of truth is the repo-root
// .env file (POSTGRES_IMAGE_TAG), shared with the docker-compose files. A POSTGRES_IMAGE_TAG shell/CI
// environment variable overrides it, and 18.4-alpine is the final fallback so IDE/Gradle runs work
// even without .env. Read via the provider API so the configuration cache tracks .env. See
// docs/DATABASE.md.
def postgresImageTag = providers.environmentVariable("POSTGRES_IMAGE_TAG")
	.orElse(providers.fileContents(layout.projectDirectory.dir("..").file(".env")).asText.map { content ->
		def matcher = (content =~ /(?m)^\s*POSTGRES_IMAGE_TAG\s*=\s*(\S+)/)
		matcher.find() ? matcher.group(1) : null
	})
	.getOrElse("18.4-alpine")

test {
	useJUnitPlatform()
	finalizedBy jacocoTestReport

	maxParallelForks = 1
	forkEvery = 0
	maxHeapSize = "2g"

	testLogging {
		events "PASSED", "FAILED", "SKIPPED"
		showStandardStreams = false
		exceptionFormat = "full"
		showCauses = true
		showStackTraces = true
	}
	systemProperty "spring.profiles.active", "test"
	systemProperty "postgres.image.tag", postgresImageTag

	afterSuite { desc, result ->
		if (!desc.parent) {
			println ""
			println "==============================================================="
			println " Test Results: ${result.resultType}"
			println "==============================================================="
			println " Total:   ${result.testCount}"
			println " Passed:  ${result.successfulTestCount}"
			println " Failed:  ${result.failedTestCount}"
			println " Skipped: ${result.skippedTestCount}"
			println "==============================================================="
		}
	}
}

jacocoTestReport {
	dependsOn test
	reports {
		xml.required = true
		html.required = true
	}

	def reportFile = layout.buildDirectory.file("reports/jacoco/test/jacocoTestReport.xml")
	def htmlReportDir = layout.buildDirectory.dir("reports/jacoco/test/html")

	doLast {
		def report = reportFile.get().asFile
		if (report.exists()) {
			def parser = new groovy.xml.XmlSlurper()
			parser.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false)
			parser.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
			def xml = parser.parse(report)
			def counters = xml.counter

			def instructionCounter = counters.find { it.@type == 'INSTRUCTION' }
			def branchCounter = counters.find { it.@type == 'BRANCH' }
			def lineCounter = counters.find { it.@type == 'LINE' }
			def methodCounter = counters.find { it.@type == 'METHOD' }
			def classCounter = counters.find { it.@type == 'CLASS' }

			def calcCoverage = { counter ->
				if (counter == null) return "N/A"
				def missed = counter.@missed.toInteger()
				def covered = counter.@covered.toInteger()
				def total = missed + covered
				if (total == 0) return "N/A"
				return String.format("%.1f%%", (covered * 100.0) / total)
			}

			println ""
			println "==============================================================="
			println " Code Coverage Report"
			println "==============================================================="
			println " Instructions: ${calcCoverage(instructionCounter)}"
			println " Branches:     ${calcCoverage(branchCounter)}"
			println " Lines:        ${calcCoverage(lineCounter)}"
			println " Methods:      ${calcCoverage(methodCounter)}"
			println " Classes:      ${calcCoverage(classCounter)}"
			println "==============================================================="
			println " Full report: file://${htmlReportDir.get().asFile}"
			println "==============================================================="
		}
	}
}

tasks.withType(JavaCompile).configureEach {
    options.compilerArgs << "-Xlint:deprecation"
    options.compilerArgs << "-parameters"
}

def isNonStable = { String version ->
	def stableKeyword = ["RELEASE", "FINAL", "GA"].any { it -> version.toUpperCase().contains(it) }
	def regex = /^[0-9,.v-]+(-r)?$/
	return !stableKeyword && !(version ==~ regex)
}

tasks.named("dependencyUpdates").configure {
	rejectVersionIf {
		isNonStable(it.candidate.version)
	}

	rejectVersionIf {
		isNonStable(it.candidate.version) && !isNonStable(it.currentVersion)
	}
}

// Bundle the committed server + client SBOMs into the jar so the admin
// dependency overview and weekly vulnerability scan have data to read at
// runtime. Both files are kept in sync with their respective lockfiles
// by the refresh_sbom workflow, so no build-time regeneration is needed.
def serverSbomFile = file("sbom/bom.json")
def clientSbomFile = file("../client/sbom/bom.json")

processResources {
	from(serverSbomFile) {
		into "sbom"
		rename { "server-sbom.json" }
	}
	from(clientSbomFile) {
		into "sbom"
		rename { "client-sbom.json" }
	}
}

// CycloneDX SBOM
//
// Writes the SBOM to a tracked location (`sbom/`) so it can be committed and
// reused without being regenerated on every build. Not hooked into `build` —
// run `./gradlew cyclonedxBom` explicitly (or via CI) to refresh after
// dependency changes. Gradle's UP-TO-DATE check makes this a no-op when the
// runtime classpath hasn't changed.
//
// Files captured at configuration time so closures stay safe for the
// configuration cache (calling `file()` inside a closure would tie it to
// the live project instance).
def bomJsonFile = file("sbom/bom.json")
def sbomInputHashFile = file("sbom/.input-hash")
// build.gradle + gradle.properties + settings.gradle is the complete set
// of dep-defining inputs: pinned plugin versions, version vars, the root
// project name (used as the SBOM component name), and the project group.
// Order matches the shell `cat ... | shasum` in the CI verification step.
def sbomInputs = [file("build.gradle"), file("gradle.properties"), file("settings.gradle")]

cyclonedxBom {
	projectType = "application"
	schemaVersion = org.cyclonedx.Version.VERSION_16
	includeBomSerialNumber = false
	includeLicenseText = false
	componentGroup = project.group.toString()
	componentName = project.name
	componentVersion = project.version.toString()
	// Only emit JSON — Dependency-Track, Trivy, and Grype all read JSON
	// natively and an XML twin would need its own timestamp-stripping.
	jsonOutput = bomJsonFile

	// Strip the generation timestamp so the committed bom.json is
	// byte-stable when dependencies haven't changed.
	doLast {
		if (bomJsonFile.exists()) {
			def json = new groovy.json.JsonSlurper().parse(bomJsonFile)
			if (json.metadata instanceof Map) {
				json.metadata.remove("timestamp")
			}
			bomJsonFile.text = groovy.json.JsonOutput.prettyPrint(groovy.json.JsonOutput.toJson(json)) + "\n"
		}
	}
}

// Always-running side task that refreshes the input hash next to the SBOM.
// Kept separate from `cyclonedxBom` because that task is UP-TO-DATE when
// the runtime classpath hasn't changed — and we want the hash to also
// catch cosmetic edits to the dep-defining files, so CI's pure shell hash
// comparison doesn't false-alarm. Cost: read 3 small files + SHA-256.
tasks.register("writeSbomInputHash") {
	outputs.upToDateWhen { false }
	doLast {
		def md = java.security.MessageDigest.getInstance("SHA-256")
		sbomInputs.each { md.update(it.bytes) }
		sbomInputHashFile.text = md.digest().encodeHex().toString() + "\n"
	}
}

tasks.named("cyclonedxBom").configure {
	finalizedBy("writeSbomInputHash")
}

// Available commands:
//
// Find dependency updates:    ./gradlew dependencyUpdates -Drevision=release
// Test:                       ./gradlew test
// Test with coverage:         ./gradlew test jacocoTestReport
// Build:                      ./gradlew build -x test
// Run:                        ./gradlew bootRun
// Code formatting:            ./gradlew spotlessApply
// Check formatting:           ./gradlew spotlessCheck
// Checkstyle:                 ./gradlew checkstyleMain checkstyleTest