Description

<dependency>
    <groupId>de.cuioss.sheriff.token</groupId>
    <artifactId>token-sheriff-client</artifactId>
    <version>0.9.4</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>de.cuioss.sheriff.token</groupId>
        <artifactId>token-sheriff-parent</artifactId>
        <version>0.9.4</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

    <artifactId>token-sheriff-client</artifactId>
    <packaging>jar</packaging>
    <name>Token-Sheriff Client</name>
    <description>Framework-agnostic OIDC/OAuth client engine for Token-Sheriff. Builds on the commons transport
        base layer (shipped in token-sheriff-validation) to add the client-side flows — token retrieval,
        userinfo, revocation, introspection, end-session and PAR. Pure Java, no framework dependency.
    </description>

    <properties>
        <maven.jar.plugin.automatic.module.name>de.cuioss.sheriff.token.client</maven.jar.plugin.automatic.module.name>
        <version.lombok>1.18.46</version.lombok>
        <version.dsl.json>2.0.2</version.dsl.json>
        <version.archunit>1.4.2</version.archunit>
        <!-- Explicit Failsafe version: token-sheriff-client inherits no maven-failsafe-plugin
             pluginManagement from cui-java-parent or token-sheriff-parent, so the IT tier
             binding below must pin its own version. Kept aligned with the effective Surefire
             version so the *Test unit tier and *IT integration tier run the same generation. -->
        <version.maven.failsafe>3.5.6</version.maven.failsafe>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>de.cuioss.sheriff.token</groupId>
                <artifactId>token-sheriff-bom</artifactId>
                <version>${project.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- The client validates the tokens it retrieves, so it depends on validation, which also
             carries the commons base layer (transport, error model, events, metrics) transitively. -->
        <dependency>
            <groupId>de.cuioss.sheriff.token</groupId>
            <artifactId>token-sheriff-validation</artifactId>
            <version>${project.version}</version>
        </dependency>
        <dependency>
            <groupId>de.cuioss</groupId>
            <artifactId>cui-java-tools</artifactId>
        </dependency>
        <!-- HTTP transport primitive: the client composes cui-http HttpHandler for outbound OIDC
             back-channel calls (discovery, token, userinfo, revocation, PAR, end-session), reusing the
             same TLS/SSRF-hardened handler commons uses — it adds no new transport control of its own. -->
        <dependency>
            <groupId>de.cuioss</groupId>
            <artifactId>cui-http</artifactId>
        </dependency>
        <!-- Lombok for immutable value objects (@Value/@Builder). -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
        </dependency>
        <!-- DSL-JSON for secure, compile-time, native-friendly parsing of the OIDC discovery document,
             mirroring the WellKnownResult mapping in commons.transport. -->
        <dependency>
            <groupId>com.dslplatform</groupId>
            <artifactId>dsl-json</artifactId>
            <version>${version.dsl.json}</version>
        </dependency>
        <!-- JSpecify nullability annotations (transitive from validation; declared for direct use). -->
        <dependency>
            <groupId>org.jspecify</groupId>
            <artifactId>jspecify</artifactId>
        </dependency>

        <!-- Unit testing -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-params</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- MockWebServer harness for unit-level OIDC dispatcher tests. -->
        <dependency>
            <groupId>de.cuioss.test</groupId>
            <artifactId>cui-test-mockwebserver-junit5</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Value-object contract tests. -->
        <dependency>
            <groupId>de.cuioss.test</groupId>
            <artifactId>cui-test-value-objects</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Test data generators. -->
        <dependency>
            <groupId>de.cuioss.test</groupId>
            <artifactId>cui-test-generator</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- JUL log assertions for LogRecord coverage. -->
        <dependency>
            <groupId>de.cuioss.test</groupId>
            <artifactId>cui-test-juli-logger</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Reuse the validation OP-endpoint dispatchers and adversarial utilities (test-jar). -->
        <dependency>
            <groupId>de.cuioss.sheriff.token</groupId>
            <artifactId>token-sheriff-validation</artifactId>
            <version>${project.version}</version>
            <classifier>generators</classifier>
            <scope>test</scope>
        </dependency>
        <!-- Curated http.security attack databases (OWASP/CVE/ModSecurity corpora) for the fail-closed
             adversarial callback/step-up tests. Version is BOM-managed alongside the main cui-http jar. -->
        <dependency>
            <groupId>de.cuioss</groupId>
            <artifactId>cui-http</artifactId>
            <version>${version.cui.http}</version>
            <classifier>generators</classifier>
            <scope>test</scope>
        </dependency>
        <!-- JJWT: the validation test utilities (TestTokenHolder) sign test tokens with JJWT. -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- jakarta.json implementation for the validation pipeline at test runtime. -->
        <dependency>
            <groupId>org.eclipse.parsson</groupId>
            <artifactId>parsson</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- ArchUnit: enforce the client engine boundary (no CDI/MicroProfile/JAX-RS; client → validation only). -->
        <dependency>
            <groupId>com.tngtech.archunit</groupId>
            <artifactId>archunit-junit5</artifactId>
            <version>${version.archunit}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <!-- Run the Lombok and DSL-JSON annotation processors together. -->
                    <annotationProcessorPaths>
                        <path>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                            <version>${version.lombok}</version>
                        </path>
                        <path>
                            <groupId>com.dslplatform</groupId>
                            <artifactId>dsl-json</artifactId>
                            <version>${version.dsl.json}</version>
                        </path>
                    </annotationProcessorPaths>
                    <release>21</release>
                </configuration>
            </plugin>
            <!-- Bind Failsafe so the wired-flow integration tier (WiredFlowNegativePathIT, which uses
                 MockWebServer — no external infra) actually runs under `mvn verify`. The *IT class was
                 previously compiled but never executed because no Failsafe binding existed here. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <version>${version.maven.failsafe}</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- Exclude the DSL-JSON annotation processor's generated converters from coverage measurement.
                 The processor emits _<Type>_DslJsonConverter classes straight into target/classes with no
                 counterpart under src/main/java, so their branches measure the DSL-JSON code generator rather
                 than project code. The pattern is anchored to the processor's fixed _<Type>_DslJsonConverter
                 naming so it cannot silently swallow hand-written classes. The configuration sits at plugin
                 level so it applies to both the report and check goals inherited from the cuioss parent. -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>**/_*_DslJsonConverter*.class</exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>