| POM: |
Show
hide
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>de.cuioss.sheriff.token</groupId>
<artifactId>token-sheriff-parent</artifactId>
<version>0.9.4</version>
<relativePath>../pom.xml</relativePath>
</parent>
<artifactId>token-sheriff-client</artifactId>
<packaging>jar</packaging>
<name>Token-Sheriff Client</name>
<description>Framework-agnostic OIDC/OAuth client engine for Token-Sheriff. Builds on the commons transport
base layer (shipped in token-sheriff-validation) to add the client-side flows — token retrieval,
userinfo, revocation, introspection, end-session and PAR. Pure Java, no framework dependency.
</description>
<properties>
<maven.jar.plugin.automatic.module.name>de.cuioss.sheriff.token.client</maven.jar.plugin.automatic.module.name>
<version.lombok>1.18.46</version.lombok>
<version.dsl.json>2.0.2</version.dsl.json>
<version.archunit>1.4.2</version.archunit>
<!-- Explicit Failsafe version: token-sheriff-client inherits no maven-failsafe-plugin
pluginManagement from cui-java-parent or token-sheriff-parent, so the IT tier
binding below must pin its own version. Kept aligned with the effective Surefire
version so the *Test unit tier and *IT integration tier run the same generation. -->
<version.maven.failsafe>3.5.6</version.maven.failsafe>
</properties>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>de.cuioss.sheriff.token</groupId>
<artifactId>token-sheriff-bom</artifactId>
<version>${project.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<!-- The client validates the tokens it retrieves, so it depends on validation, which also
carries the commons base layer (transport, error model, events, metrics) transitively. -->
<dependency>
<groupId>de.cuioss.sheriff.token</groupId>
<artifactId>token-sheriff-validation</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>de.cuioss</groupId>
<artifactId>cui-java-tools</artifactId>
</dependency>
<!-- HTTP transport primitive: the client composes cui-http HttpHandler for outbound OIDC
back-channel calls (discovery, token, userinfo, revocation, PAR, end-session), reusing the
same TLS/SSRF-hardened handler commons uses — it adds no new transport control of its own. -->
<dependency>
<groupId>de.cuioss</groupId>
<artifactId>cui-http</artifactId>
</dependency>
<!-- Lombok for immutable value objects (@Value/@Builder). -->
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</dependency>
<!-- DSL-JSON for secure, compile-time, native-friendly parsing of the OIDC discovery document,
mirroring the WellKnownResult mapping in commons.transport. -->
<dependency>
<groupId>com.dslplatform</groupId>
<artifactId>dsl-json</artifactId>
<version>${version.dsl.json}</version>
</dependency>
<!-- JSpecify nullability annotations (transitive from validation; declared for direct use). -->
<dependency>
<groupId>org.jspecify</groupId>
<artifactId>jspecify</artifactId>
</dependency>
<!-- Unit testing -->
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-params</artifactId>
<scope>test</scope>
</dependency>
<!-- MockWebServer harness for unit-level OIDC dispatcher tests. -->
<dependency>
<groupId>de.cuioss.test</groupId>
<artifactId>cui-test-mockwebserver-junit5</artifactId>
<scope>test</scope>
</dependency>
<!-- Value-object contract tests. -->
<dependency>
<groupId>de.cuioss.test</groupId>
<artifactId>cui-test-value-objects</artifactId>
<scope>test</scope>
</dependency>
<!-- Test data generators. -->
<dependency>
<groupId>de.cuioss.test</groupId>
<artifactId>cui-test-generator</artifactId>
<scope>test</scope>
</dependency>
<!-- JUL log assertions for LogRecord coverage. -->
<dependency>
<groupId>de.cuioss.test</groupId>
<artifactId>cui-test-juli-logger</artifactId>
<scope>test</scope>
</dependency>
<!-- Reuse the validation OP-endpoint dispatchers and adversarial utilities (test-jar). -->
<dependency>
<groupId>de.cuioss.sheriff.token</groupId>
<artifactId>token-sheriff-validation</artifactId>
<version>${project.version}</version>
<classifier>generators</classifier>
<scope>test</scope>
</dependency>
<!-- Curated http.security attack databases (OWASP/CVE/ModSecurity corpora) for the fail-closed
adversarial callback/step-up tests. Version is BOM-managed alongside the main cui-http jar. -->
<dependency>
<groupId>de.cuioss</groupId>
<artifactId>cui-http</artifactId>
<version>${version.cui.http}</version>
<classifier>generators</classifier>
<scope>test</scope>
</dependency>
<!-- JJWT: the validation test utilities (TestTokenHolder) sign test tokens with JJWT. -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<scope>test</scope>
</dependency>
<!-- jakarta.json implementation for the validation pipeline at test runtime. -->
<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
<scope>test</scope>
</dependency>
<!-- ArchUnit: enforce the client engine boundary (no CDI/MicroProfile/JAX-RS; client → validation only). -->
<dependency>
<groupId>com.tngtech.archunit</groupId>
<artifactId>archunit-junit5</artifactId>
<version>${version.archunit}</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<!-- Run the Lombok and DSL-JSON annotation processors together. -->
<annotationProcessorPaths>
<path>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<version>${version.lombok}</version>
</path>
<path>
<groupId>com.dslplatform</groupId>
<artifactId>dsl-json</artifactId>
<version>${version.dsl.json}</version>
</path>
</annotationProcessorPaths>
<release>21</release>
</configuration>
</plugin>
<!-- Bind Failsafe so the wired-flow integration tier (WiredFlowNegativePathIT, which uses
MockWebServer — no external infra) actually runs under `mvn verify`. The *IT class was
previously compiled but never executed because no Failsafe binding existed here. -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-failsafe-plugin</artifactId>
<version>${version.maven.failsafe}</version>
<executions>
<execution>
<goals>
<goal>integration-test</goal>
<goal>verify</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Exclude the DSL-JSON annotation processor's generated converters from coverage measurement.
The processor emits _<Type>_DslJsonConverter classes straight into target/classes with no
counterpart under src/main/java, so their branches measure the DSL-JSON code generator rather
than project code. The pattern is anchored to the processor's fixed _<Type>_DslJsonConverter
naming so it cannot silently swallow hand-written classes. The configuration sits at plugin
level so it applies to both the report and check goals inherited from the cuioss parent. -->
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<configuration>
<excludes>
<exclude>**/_*_DslJsonConverter*.class</exclude>
</excludes>
</configuration>
</plugin>
</plugins>
</build>
</project>
|
