Description

<dependency>
    <groupId>de.cuioss.sheriff.gateway</groupId>
    <artifactId>api-sheriff-parent</artifactId>
    <version>0.1.1</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>de.cuioss</groupId>
        <artifactId>cui-java-parent</artifactId>
        <version>1.5.4</version>
        <relativePath />
    </parent>
    <groupId>de.cuioss.sheriff.gateway</groupId>
    <artifactId>api-sheriff-parent</artifactId>
    <version>0.1.1</version>
    <packaging>pom</packaging>
    <name>API Sheriff Parent</name>
    <description>An API-Gateway focused on Security and a lightweight approach.
        The module provides robust API gateway capabilities with comprehensive security features,
        rate limiting, authentication, and authorization in multi-tenant environments.
    </description>

    <url>https://github.com/cuioss/api-sheriff/</url>
    <modules>
        <module>api-sheriff</module>
        <module>integration-tests</module>
        <module>benchmarks</module>
        <!-- Demo SPA + Playwright end-to-end suite. Carries no Java and contributes no work to the
             default lane: every npm-touching execution lives inside its own 'e2e-demo' profile, so a
             standard reactor build walks through it without downloading Node or starting a container.
             Placed last so the existing module ordering is untouched. -->
        <module>demo-client</module>
        <!-- Production-shaped docker-compose sample. Carries no Java and contributes nothing to the
             default lane: every inherited Java plugin is switched off, so this leg builds no artifact. -->
        <module>deployment</module>
    </modules>
    <scm>
        <url>https://github.com/cuioss/api-sheriff/</url>
        <connection>
            scm:git:https://github.com/cuioss/api-sheriff.git
        </connection>
        <developerConnection>
            scm:git:https://github.com/cuioss/api-sheriff/
        </developerConnection>
        <tag>0.1.1</tag>
    </scm>
    <issueManagement>
        <url>https://github.com/cuioss/api-sheriff/issues</url>
        <system>GitHub Issues</system>
    </issueManagement>

    <properties>
        <!-- Project-owned pin, not an override: the resolved parent chain
             (de.cuioss:cui-java-parent:1.5.4 -> de.cuioss:cui-java-bom:1.5.4) declares no
             Quarkus version at all, so this property is the single source of truth for the
             Quarkus platform. It feeds the io.quarkus:quarkus-bom import below and the
             Quarkus build tooling, which is why the value has to be maintained here.
             Changing it is a platform migration, never a routine version bump: the
             quarkus-bom import is deliberately declared first so it wins the smallrye-config
             convergence (see the token-sheriff-bom comment below), and cui-java-bom aligns
             its JUnit Jupiter version to whatever the Quarkus BOM ships. -->
        <version.quarkus>3.38.0</version.quarkus>
        <version.token-sheriff>0.9.4</version.token-sheriff>
        <version.json-schema-validator>3.0.6</version.json-schema-validator>
        <!-- Default empty argLine for JaCoCo compatibility - JaCoCo will override this when active -->
        <argLine />
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>io.quarkus</groupId>
                <artifactId>quarkus-bom</artifactId>
                <version>${version.quarkus}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>de.cuioss</groupId>
                <artifactId>java-ee-orthogonal</artifactId>
                <version>${version.cui.parent}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>de.cuioss</groupId>
                <artifactId>java-ee-10-bom</artifactId>
                <version>${version.cui.parent}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- Token Sheriff BOM: supplies token-sheriff-client / -client-quarkus / -validation-quarkus
                 versions. Declared after quarkus-bom on purpose: quarkus-bom is imported first, so it wins
                 every artifact the two BOMs both manage. Verified against the resolved dependency graph at
                 token-sheriff 0.9.3 / Quarkus 3.37.4: token-sheriff-bom declares its Quarkus artifacts
                 (quarkus-config-yaml, quarkus-hibernate-validator) at 3.38.0 and the quarkus-bom import pins
                 them back to 3.37.4, after which io.smallrye.config converges on a single 3.17.2 across the
                 whole reactor at compile scope. Reordering these two imports would pull a second Quarkus line
                 into the build and split smallrye-config, which breaks Quarkus config-mapping augmentation. -->
            <dependency>
                <groupId>de.cuioss.sheriff.token</groupId>
                <artifactId>token-sheriff-bom</artifactId>
                <version>${version.token-sheriff}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- Configuration management: boot-time JSON Schema validation
                 (jackson-dataformat-yaml version is managed by the Quarkus BOM) -->
            <dependency>
                <groupId>com.networknt</groupId>
                <artifactId>json-schema-validator</artifactId>
                <version>${version.json-schema-validator}</version>
            </dependency>
            <!-- Internal modules -->
            <dependency>
                <groupId>de.cuioss.sheriff.gateway</groupId>
                <artifactId>api-sheriff</artifactId>
                <version>${project.version}</version>
            </dependency>
            <!-- Override JUnit Platform versions to match Jupiter (cui-java-parent provides
                 version.junit.jupiter, but the Quarkus BOM pins older Platform versions) -->
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-commons</artifactId>
                <version>${version.junit.jupiter}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-engine</artifactId>
                <version>${version.junit.jupiter}</version>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>org.junit.platform</groupId>
                <artifactId>junit-platform-launcher</artifactId>
                <version>${version.junit.jupiter}</version>
                <scope>test</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>io.quarkus</groupId>
                    <artifactId>quarkus-maven-plugin</artifactId>
                    <version>${version.quarkus}</version>
                    <extensions>true</extensions>
                    <executions>
                        <execution>
                            <goals>
                                <goal>build</goal>
                                <goal>generate-code</goal>
                                <goal>generate-code-tests</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <configuration>
                        <release>25</release>
                    </configuration>
                </plugin>
                <plugin>
                    <!--
                        cui-java-parent pins the javadoc plugin to <release>21</release>. This
                        project compiles at 25 (ADR-0001), so any Java 22+ construct in main
                        sources fails the javadoc tool with "unnamed variables are not supported
                        in -source 21" while javac itself is perfectly happy — the two tools were
                        being given different language levels.

                        Pinning javadoc to the same release as the compiler is the fix. This is
                        the same class of parent-assumes-Java-21 override as the pre-commit
                        profile's UpgradeToJava21 -> UpgradeToJava25 replacement below; keep the
                        two in sync with the compiler release.
                    -->
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <configuration>
                        <release>25</release>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <configuration>
                        <systemPropertyVariables>
                            <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                            <java.util.logging.config.file>${project.build.testOutputDirectory}/logging.properties</java.util.logging.config.file>
                            <maven.home>${maven.home}</maven.home>
                            <quarkus.test.arg-line>@{argLine}</quarkus.test.arg-line>
                        </systemPropertyVariables>
                        <useModulePath>false</useModulePath>
                        <useFile>false</useFile>
                        <trimStackTrace>false</trimStackTrace>
                        <enableAssertions>true</enableAssertions>
                        <!-- JaCoCo-compatible argLine (will be empty if JaCoCo not active) -->
                        <argLine>@{argLine} -XX:+IgnoreUnrecognizedVMOptions -Djava.awt.headless=true</argLine>
                        <!-- Stability configurations -->
                        <forkedProcessTimeoutInSeconds>0</forkedProcessTimeoutInSeconds>
                        <forkedProcessExitTimeoutInSeconds>60</forkedProcessExitTimeoutInSeconds>
                        <!-- Fix for class loading issues -->
                        <useSystemClassLoader>false</useSystemClassLoader>
                        <reuseForks>false</reuseForks>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-failsafe-plugin</artifactId>
                    <configuration>
                        <systemPropertyVariables>
                            <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                            <java.util.logging.config.file>${project.build.testOutputDirectory}/logging.properties</java.util.logging.config.file>
                            <maven.home>${maven.home}</maven.home>
                            <quarkus.test.arg-line>@{argLine}</quarkus.test.arg-line>
                        </systemPropertyVariables>
                        <useModulePath>false</useModulePath>
                        <useFile>false</useFile>
                        <trimStackTrace>false</trimStackTrace>
                        <enableAssertions>true</enableAssertions>
                        <argLine>@{argLine} -XX:+IgnoreUnrecognizedVMOptions -Djava.awt.headless=true</argLine>
                        <!-- Fix for class loading issues -->
                        <useSystemClassLoader>false</useSystemClassLoader>
                        <reuseForks>false</reuseForks>
                        <!-- Standardized IT naming patterns -->
                        <includes>
                            <include>**/*IT.java</include>
                            <include>**/*IntegrationTest.java</include>
                        </includes>
                    </configuration>
                    <executions>
                        <execution>
                            <goals>
                                <goal>integration-test</goal>
                                <goal>verify</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

    <profiles>
        <profile>
            <id>coverage</id>
            <build>
                <pluginManagement>
                    <plugins>
                        <plugin>
                            <groupId>org.jacoco</groupId>
                            <artifactId>jacoco-maven-plugin</artifactId>
                            <executions>
                                <execution>
                                    <id>prepare-agent</id>
                                    <goals>
                                        <goal>prepare-agent</goal>
                                    </goals>
                                    <configuration>
                                        <append>true</append>
                                        <destFile>${project.build.directory}/jacoco.exec</destFile>
                                    </configuration>
                                </execution>
                                <execution>
                                    <id>prepare-agent-integration</id>
                                    <goals>
                                        <goal>prepare-agent-integration</goal>
                                    </goals>
                                    <configuration>
                                        <destFile>${project.build.directory}/jacoco-it.exec</destFile>
                                        <append>true</append>
                                    </configuration>
                                </execution>
                                <execution>
                                    <id>report</id>
                                    <phase>test</phase>
                                    <goals>
                                        <goal>report</goal>
                                    </goals>
                                    <configuration>
                                        <outputDirectory>${project.build.directory}/site/jacoco</outputDirectory>
                                        <formats>
                                            <format>XML</format>
                                            <format>HTML</format>
                                        </formats>
                                    </configuration>
                                </execution>
                                <execution>
                                    <id>report-integration</id>
                                    <phase>post-integration-test</phase>
                                    <goals>
                                        <goal>report-integration</goal>
                                    </goals>
                                    <configuration>
                                        <outputDirectory>${project.build.directory}/site/jacoco-it</outputDirectory>
                                        <formats>
                                            <format>XML</format>
                                            <format>HTML</format>
                                        </formats>
                                    </configuration>
                                </execution>
                                <execution>
                                    <id>merge-results</id>
                                    <phase>verify</phase>
                                    <goals>
                                        <goal>merge</goal>
                                    </goals>
                                    <configuration>
                                        <fileSets>
                                            <fileSet>
                                                <directory>${project.build.directory}</directory>
                                                <includes>
                                                    <include>*.exec</include>
                                                </includes>
                                            </fileSet>
                                        </fileSets>
                                        <destFile>${project.build.directory}/jacoco-merged.exec</destFile>
                                    </configuration>
                                </execution>
                                <execution>
                                    <id>report-merged</id>
                                    <phase>verify</phase>
                                    <goals>
                                        <goal>report</goal>
                                    </goals>
                                    <configuration>
                                        <dataFile>${project.build.directory}/jacoco-merged.exec</dataFile>
                                        <outputDirectory>${project.build.directory}/site/jacoco-merged</outputDirectory>
                                        <formats>
                                            <format>XML</format>
                                            <format>HTML</format>
                                        </formats>
                                    </configuration>
                                </execution>
                            </executions>
                        </plugin>
                    </plugins>
                </pluginManagement>
                <plugins>
                    <plugin>
                        <groupId>org.jacoco</groupId>
                        <artifactId>jacoco-maven-plugin</artifactId>
                    </plugin>
                </plugins>
            </build>
            <properties>
                <sonar.coverage.jacoco.xmlReportPaths>
                    ${project.build.directory}/site/jacoco/jacoco.xml,
                    api-sheriff/target/site/jacoco/jacoco.xml,
                    ../target/site/jacoco/jacoco.xml
                </sonar.coverage.jacoco.xmlReportPaths>
            </properties>
        </profile>
        <profile>
            <!--
                Local override of the inherited cui-java-parent 'pre-commit' profile's
                OpenRewrite recipe list.

                The parent (de.cuioss:cui-java-parent) activates the recipe
                'org.openrewrite.java.migrate.UpgradeToJava21' — a Java-21-TARGETED
                migration. On this Java 25 project (ADR-0001) its build-config migration
                rewrites the maven-compiler-plugin release DOWN from 25 to 21, silently
                regressing the language baseline and breaking any Java 22+ source once
                committed.

                Maven merges an inherited <activeRecipes> list by APPEND, so a single
                recipe cannot be removed in isolation. This re-declares the full list
                with combine.children="override" — identical to cui-java-parent's list,
                except UpgradeToJava21 is replaced by UpgradeToJava25 so the modernization
                migrations still run while the compiler release is pinned to the correct
                25 baseline. Keep this list in sync if the parent's recipe set changes.
            -->
            <id>pre-commit</id>
            <build>
                <plugins>
                    <plugin>
                        <!--
                            Second half of the Java-25 baseline fix (the first is the
                            maven-javadoc-plugin pluginManagement entry above).

                            The parent's pre-commit profile declares maven-javadoc-plugin in
                            build/plugins with <release>21</release> set at EXECUTION level, which
                            takes precedence over any plugin-level pluginManagement configuration.
                            The pluginManagement override alone is therefore shadowed here and the
                            javadoc tool still runs at -source 21, failing on Java 22+ constructs
                            such as unnamed variables (`catch (IOException _)`).

                            Overriding requires re-declaring both execution ids the parent binds
                            and pinning each to release 25. Executions merge by id, so this only
                            changes the language level and leaves every other inherited setting
                            (sourcepath, doclint, failOnError, ...) intact.
                        -->
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <!-- Plugin level: covers any javadoc goal invoked outside the two bound
                             executions (e.g. a direct `mvn javadoc:javadoc` under this profile),
                             which would otherwise still inherit the parent's release 21. -->
                        <configuration>
                            <release>25</release>
                        </configuration>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <configuration>
                                    <release>25</release>
                                </configuration>
                            </execution>
                            <execution>
                                <id>check-javadocs-pre-commit</id>
                                <configuration>
                                    <release>25</release>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.openrewrite.maven</groupId>
                        <artifactId>rewrite-maven-plugin</artifactId>
                        <configuration>
                            <activeRecipes combine.children="override">
                                <recipe>org.openrewrite.java.format.AutoFormat</recipe>
                                <recipe>org.openrewrite.java.format.NormalizeLineBreaks</recipe>
                                <recipe>org.openrewrite.java.format.RemoveTrailingWhitespace</recipe>
                                <recipe>de.cuioss.rewrite.format.AnnotationNewlineFormat</recipe>
                                <recipe>de.cuioss.rewrite.logging.CuiLoggerStandardsRecipe</recipe>
                                <recipe>de.cuioss.rewrite.logging.CuiLogRecordPatternRecipe</recipe>
                                <recipe>de.cuioss.rewrite.logging.InvalidExceptionUsageRecipe</recipe>
                                <!-- Replaces the parent's UpgradeToJava21 (which downgrades the release to 21) -->
                                <recipe>org.openrewrite.java.migrate.UpgradeToJava25</recipe>
                                <recipe>org.openrewrite.java.migrate.RemoveSecurityManager</recipe>
                                <recipe>org.openrewrite.java.migrate.util.JavaUtilAPIs</recipe>
                                <recipe>org.openrewrite.java.OrderImports</recipe>
                                <recipe>org.openrewrite.java.RemoveUnusedImports</recipe>
                                <recipe>org.openrewrite.java.ShortenFullyQualifiedTypeReferences</recipe>
                                <recipe>org.openrewrite.java.testing.junit5.JUnit5BestPractices</recipe>
                                <recipe>org.openrewrite.java.testing.junit5.RemoveTryCatchFailBlocks</recipe>
                                <recipe>org.openrewrite.staticanalysis.EqualsAvoidsNull</recipe>
                                <recipe>org.openrewrite.staticanalysis.NoPrimitiveWrappersForToStringOrCompareTo</recipe>
                                <recipe>org.openrewrite.staticanalysis.SimplifyBooleanExpression</recipe>
                                <recipe>org.openrewrite.staticanalysis.UnnecessaryParentheses</recipe>
                            </activeRecipes>
                        </configuration>
                    </plugin>
                    <plugin>
                        <!--
                            Pins the license header's copyright year to 2026.

                            DO NOT DELETE when bumping cui-java-parent. The parent's
                            pre-commit profile carries the comment "No <year> override:
                            mycila license-maven-plugin defaults to the current year" and
                            omits <year> on that basis. That comment is FALSE: mycila
                            resolves ${year} from the project's <inceptionYear>, not from
                            the system clock, and no <inceptionYear> is declared anywhere
                            in this project or its parent chain (cui-java-parent ->
                            cui-java-bom -> cui-parent-pom). With neither a <year> override
                            nor an <inceptionYear>, the year does not track the current
                            year; it regresses to the stale 2022 value, which is how
                            every header in this repository came to read 2022.

                            Only <year> is overridden here; owner (CUI-OpenSource-Software)
                            and email (info@cuioss.de) continue to be inherited from the
                            parent, since Maven merges child <properties> into the parent's
                            plugin configuration rather than replacing the whole block.
                        -->
                        <groupId>com.mycila</groupId>
                        <artifactId>license-maven-plugin</artifactId>
                        <configuration>
                            <properties>
                                <year>2026</year>
                            </properties>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>