pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>io.bastillion</groupId>
    <artifactId>bastillion</artifactId>
    <version>6.0.4-SNAPSHOT</version>
    <packaging>jar</packaging>
    <name>Bastillion</name>

    <licenses>
        <license>
            <name>The Prosperity Public License 3.0.0</name>
            <url>https://prosperitylicense.com/versions/3.0.0.html</url>
        </license>
    </licenses>

    <developers>
        <developer>
            <name>Sean Kavanagh</name>
            <email>sean.p.kavanagh6@gmail.com</email>
            <organization>Loophole, LLC</organization>
            <organizationUrl>https://www.bastillion.io</organizationUrl>
        </developer>
    </developers>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <!-- Default for exec:java; override with -Dexec.mainClass=... -->
        <exec.mainClass>io.bastillion.Main</exec.mainClass>
    </properties>

    <repositories>
        <repository>
            <id>apache.snapshots</id>
            <name>Apache Snapshots</name>
            <url>https://repository.apache.org/content/repositories/snapshots/</url>
            <releases><enabled>false</enabled></releases>
            <snapshots><enabled>true</enabled></snapshots>
        </repository>
    </repositories>

    <!-- Pins transitive dependencies pulled in with known CVEs where the parent (here,
         jetty-jaas -> api-ldap-model) hasn't bumped its own declared version yet. -->
    <dependencyManagement>
        <dependencies>
            <!-- mina-core 2.2.3 (via jetty-jaas's LDAP JAAS module) has several CVEs around
                 deserialization of untrusted data in its object serialization codec, patched
                 (and re-patched after incomplete fixes) across 2.2.4-2.2.9. -->
            <dependency>
                <groupId>org.apache.mina</groupId>
                <artifactId>mina-core</artifactId>
                <version>2.2.10</version>
            </dependency>
            <!-- xmlsec 2.2.3 (via java-saml-core's XML Signature verification of SAML
                 assertions) is vulnerable to CVE-2023-44483 - a private key may be disclosed
                 in log files when generating an XML Signature with debug-level logging
                 enabled - fixed in 2.2.6, 2.3.4, and 3.0.3. Pinned to the nearest patched
                 release in the same minor line for the safest binary compatibility with
                 java-saml-core's internal usage. -->
            <dependency>
                <groupId>org.apache.santuario</groupId>
                <artifactId>xmlsec</artifactId>
                <version>4.0.4</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- MVC framework (formerly the io.bastillion:lmvc artifact; merged directly into
             src/main/java/loophole/mvc so the whole app builds from this one pom) -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.21.0</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>2.0.20</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j2-impl</artifactId>
            <version>2.26.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.26.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.26.1</version>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf</groupId>
            <artifactId>thymeleaf</artifactId>
            <version>3.1.5.RELEASE</version>
        </dependency>

        <!-- MVC framework tests -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>6.1.3</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>5.24.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-junit-jupiter</artifactId>
            <version>5.24.0</version>
            <scope>test</scope>
        </dependency>
        <!-- in-memory LDAP server for exercising the LDAP login path end to end -->
        <dependency>
            <groupId>com.unboundid</groupId>
            <artifactId>unboundid-ldapsdk</artifactId>
            <version>7.0.5</version>
            <scope>test</scope>
        </dependency>
        <!-- in-process SSH/SFTP server for exercising SSHUtil's connections end to end -->
        <dependency>
            <groupId>org.apache.sshd</groupId>
            <artifactId>sshd-core</artifactId>
            <version>2.20.0</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.sshd</groupId>
            <artifactId>sshd-sftp</artifactId>
            <version>2.20.0</version>
            <scope>test</scope>
        </dependency>

        <!-- Database -->
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <version>2.5.252</version>
        </dependency>

        <!-- SSH -->
        <dependency>
            <groupId>com.github.mwiede</groupId>
            <artifactId>jsch</artifactId>
            <version>2.28.8</version>
        </dependency>
        <!-- jsch needs BouncyCastle at runtime for Ed25519/Ed448 key generation
             (com.jcraft.jsch.bc.KeyPairGenEdDSA); not a transitive dependency of jsch
             itself, so it has to be declared explicitly. -->
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk18on</artifactId>
            <version>1.86</version>
        </dependency>

        <!-- JSON -->
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.15.0</version>
        </dependency>

        <!-- Commons -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-fileupload2-jakarta</artifactId>
            <version>2.0.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>1.23.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-dbcp2</artifactId>
            <version>2.14.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-configuration2</artifactId>
            <version>2.15.1</version>
        </dependency>
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.11.0</version>
        </dependency>

        <!-- QR / 2FA -->
        <dependency>
            <groupId>com.google.zxing</groupId>
            <artifactId>core</artifactId>
            <version>3.5.4</version>
        </dependency>

        <!-- Jetty 12 (Jakarta EE 10), embedded - the app is its own server now (see
             io.bastillion.Main), not a WAR deployed into an external container, so these
             are compile-scope (bundled into the runnable jar) rather than provided. Jetty 12
             split the old monolithic artifacts into an EE-version-agnostic core
             (jetty-server) plus per-Jakarta-EE-generation "ee10" modules for anything
             servlet-shaped (WebAppContext, the Jakarta WebSocket server integration). -->
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-server</artifactId>
            <version>12.1.14</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty.ee10</groupId>
            <artifactId>jetty-ee10-webapp</artifactId>
            <version>12.1.14</version>
        </dependency>
        <!-- JAAS LoginModule SPI (LdapLoginModule, AbstractLoginModule, ObjectCallback) used
             directly by ExternalAuthUtil - Jetty 12 dropped the standalone jetty-jaas
             artifact and folded its classes into jetty-security under
             org.eclipse.jetty.security.jaas.*. -->
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-security</artifactId>
            <version>12.1.14</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty.ee10.websocket</groupId>
            <artifactId>jetty-ee10-websocket-jakarta-server</artifactId>
            <version>12.1.14</version>
        </dependency>

        <!-- Jakarta Servlet API (EE10 - jetty-ee10-webapp pulls this in transitively, but it's
             declared explicitly here since app code compiles directly against it). -->
        <dependency>
            <groupId>jakarta.servlet</groupId>
            <artifactId>jakarta.servlet-api</artifactId>
            <version>6.1.0</version>
        </dependency>

        <!-- SAML SSO -->
        <!-- java-saml-core, not java-saml (the "toolkit" module) - the toolkit's Auth facade
             class is coupled to javax.servlet.http.HttpServletRequest/Response (the
             pre-Jakarta-EE-9 namespace), which this Jetty 12 / Jakarta EE 10 app doesn't have
             on its classpath at all. java-saml-core is genuinely framework-agnostic (its own
             com.onelogin.saml2.http.HttpRequest is a plain POJO) - SamlAuthUtil adapts a
             jakarta.servlet.http.HttpServletRequest into it directly. Also brings in
             joda-time (DateTime return types) transitively. -->
        <dependency>
            <groupId>com.onelogin</groupId>
            <artifactId>java-saml-core</artifactId>
            <version>2.9.0</version>
        </dependency>
    </dependencies>

    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <includes>
                    <include>VERSION.txt</include>
                </includes>
                <filtering>true</filtering>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
            </resource>
            <!-- Served by io.bastillion.Main's embedded Jetty (WebAppContext resource base
                 resolved from this classpath root), not a WAR - see that class for why. -->
            <resource>
                <directory>src/main/webapp</directory>
                <targetPath>webapp</targetPath>
            </resource>
        </resources>

        <plugins>
            <!-- Fail early with a clear message when the build is run with an unsupported
                 Java or Maven version. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.6.3</version>
                <executions>
                    <execution>
                        <id>enforce-build-environment</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>[3.6.3,)</version>
                                </requireMavenVersion>
                                <requireJavaVersion>
                                    <version>[21,)</version>
                                </requireJavaVersion>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- Frontend -->
            <plugin>
                <groupId>com.github.eirslett</groupId>
                <artifactId>frontend-maven-plugin</artifactId>
                <version>2.0.2</version>
                <executions>
                    <execution>
                        <id>install-node-and-npm</id>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>install-node-and-npm</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>npm-install</id>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>npm</goal>
                        </goals>
                        <configuration>
                            <arguments>clean-install</arguments>
                        </configuration>
                    </execution>
                    <execution>
                        <id>build-frontend-assets</id>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>npm</goal>
                        </goals>
                        <configuration>
                            <arguments>run build-assets</arguments>
                        </configuration>
                    </execution>
                </executions>
                <configuration>
                    <nodeVersion>v24.18.0</nodeVersion>
                </configuration>
            </plugin>

            <!-- Compiler -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.16.0</version>
                <configuration>
                    <compilerArgs>
                        <arg>-Xlint:-options</arg>
                    </compilerArgs>
                </configuration>
            </plugin>

            <!-- Wipes target/test-config/ before every test run, not just `mvn clean test`.
                 Several SAML tests persist config through AppConfig.updateProperty(), which
                 writes to that directory's properties file on disk (not just in memory);
                 without this, a plain `mvn test` re-run would read back whatever an earlier
                 run left there and silently break any test asserting on an "unset" default. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.5.0</version>
                <executions>
                    <execution>
                        <id>clean-test-config</id>
                        <phase>process-test-classes</phase>
                        <goals>
                            <goal>clean</goal>
                        </goals>
                        <configuration>
                            <excludeDefaultDirectories>true</excludeDefaultDirectories>
                            <filesets>
                                <fileset>
                                    <directory>${project.build.directory}/test-config</directory>
                                </fileset>
                            </filesets>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- Unit tests -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.6.1</version>
                <configuration>
                    <systemPropertyVariables>
                        <MVC_CONTROLLER_PKGS>loophole.mvc.testctrl</MVC_CONTROLLER_PKGS>
                        <!-- AppConfig.CONFIG_DIR is a static final field resolved at class-load
                             time; setting it here (rather than in a test's @BeforeAll) makes
                             it deterministic regardless of which test class first touches
                             AppConfig/EncryptionUtil/KeyStoreUtil in the shared surefire JVM. -->
                        <CONFIG_DIR>${project.build.directory}/test-config/</CONFIG_DIR>
                    </systemPropertyVariables>
                </configuration>
            </plugin>

            <!-- Bundles all dependencies + io.bastillion.Main into one runnable jar, which
                 is what `java -jar` (and Google Cloud Buildpacks) expect to run. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
                <version>3.6.2</version>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>shade</goal>
                        </goals>
                        <configuration>
                            <transformers>
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                    <mainClass>io.bastillion.Main</mainClass>
                                </transformer>
                                <!-- Jetty's Configuration classes are discovered via
                                     META-INF/services; without this transformer, shading
                                     would let one dependency's services file clobber another's. -->
                                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
                            </transformers>
                            <filters>
                                <filter>
                                    <artifact>*:*</artifact>
                                    <excludes>
                                        <exclude>META-INF/*.SF</exclude>
                                        <exclude>META-INF/*.DSA</exclude>
                                        <exclude>META-INF/*.RSA</exclude>
                                    </excludes>
                                </filter>
                            </filters>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- mvn compile exec:java — runs io.bastillion.Main directly for local dev, the
                 same embedded-Jetty code path used in the packaged jar. -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <version>3.6.4</version>
                <configuration>
                    <mainClass>${exec.mainClass}</mainClass>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>