Stirling-PDF/app/proprietary/build.gradle

repositories {
    maven { url = "https://repository.jboss.org/" }
    maven { url = "https://build.shibboleth.net/maven/releases" }
}

bootRun {
    enabled = false
}
dependencies {
    implementation project(':common')
    api "com.google.guava:guava:${guavaVersion}"

    api 'org.springframework:spring-jdbc'
    api 'org.springframework:spring-webmvc'
    api 'org.springframework.session:spring-session-core'
    api "org.springframework.security:spring-security-core:$springSecuritySamlVersion"
    api "org.springframework.security:spring-security-saml2-service-provider:$springSecuritySamlVersion"
    api 'org.springframework.boot:spring-boot-starter-jetty'
    api 'org.springframework.boot:spring-boot-starter-security'
    api 'org.springframework.boot:spring-boot-starter-data-jpa'
    api 'org.springframework.boot:spring-boot-starter-security-oauth2-client'
    // MCP server (RFC 8707 audience binding + RFC 9728 metadata) - resource-server side only.
    // Brings nimbus-jose-jwt onto the proprietary classpath if not already transitive via
    // oauth2-client; on Boot 4.0.6 the delta is around 130KB because nimbus is already pulled.
    api 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
    api 'org.springframework.boot:spring-boot-starter-mail'
    api 'org.springframework.boot:spring-boot-starter-cache'
    api 'com.github.ben-manes.caffeine:caffeine'
    implementation 'org.springframework.boot:spring-boot-starter-data-redis'
    api 'io.swagger.core.v3:swagger-core-jakarta:2.2.53'
    implementation "com.bucket4j:bucket4j_jdk17-core:${bucket4jVersion}"
    // Lettuce-backed Bucket4j ProxyManager used by ValkeyRateLimitStore for cluster-wide
    // token-bucket rate limiting (parity with in-process Bucket4j semantics; no fixed-window
    // boundary doubling).
    implementation "com.bucket4j:bucket4j_jdk17-lettuce:${bucket4jVersion}"

    // https://mvnrepository.com/artifact/com.bucket4j/bucket4j_jdk17
    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"

    // PDF/UA tagging and its validation oracle.
    implementation 'org.verapdf:validation-model:1.30.2'
    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
    implementation "org.mozilla:rhino:${rhinoVersion}"
    // veraPDF still uses javax.xml.bind, not the new jakarta namespace
    implementation 'javax.xml.bind:jaxb-api:2.3.1'
    runtimeOnly 'com.sun.xml.bind:jaxb-impl:2.3.9'
    runtimeOnly 'com.sun.xml.bind:jaxb-core:4.0.9'

    implementation "com.google.code.gson:gson:${gsonVersion}"

    // jinjava/jjwt transitively request older Jackson 2 versions; declare the current
    // version directly so it is selected consistently (root build.gradle pins are the fallback).
    runtimeOnly "com.fasterxml.jackson.core:jackson-core:${jackson2Version}"
    runtimeOnly "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}"

    implementation("com.hubspot.jinjava:jinjava:${jinjavaVersion}") {
        // Compile-time-only annotation artifacts (class-retention annotations, not needed at
        // runtime) whose declared licences (LGPL / none) fail the licence compatibility check.
        exclude group: 'com.google.code.findbugs', module: 'annotations'
        exclude group: 'org.derive4j', module: 'derive4j-annotation'
        exclude group: 'com.hubspot.immutables', module: 'hubspot-style'
        exclude group: 'com.hubspot.immutables', module: 'immutable-collection-encodings'
    }

    api 'io.micrometer:micrometer-registry-prometheus'

    api "io.jsonwebtoken:jjwt-api:${jwtVersion}"
    runtimeOnly "io.jsonwebtoken:jjwt-impl:${jwtVersion}"
    runtimeOnly "io.jsonwebtoken:jjwt-jackson:${jwtVersion}"
    runtimeOnly 'com.h2database:h2:2.3.232' // Don't upgrade h2database - file format incompatible with 2.4.x, would break existing user databases
    runtimeOnly 'org.postgresql:postgresql:42.7.13'
    implementation('com.coveo:saml-client:5.0.0') {
        exclude group: 'org.opensaml', module: 'opensaml-core'
    }

    implementation "software.amazon.awssdk:s3:${awsSdkVersion}"
    implementation "software.amazon.awssdk:url-connection-client:${awsSdkVersion}"

    // Network policy sources (SFTP/FTP/SMB drop folders). All permissively licensed:
    // jsch fork BSD, commons-net Apache-2.0, smbj Apache-2.0 (BouncyCastle already on classpath).
    implementation "com.github.mwiede:jsch:${jschVersion}"
    implementation "commons-net:commons-net:${commonsNetVersion}"
    implementation "com.hierynomus:smbj:${smbjVersion}"

    // Streaming AEAD (AES-GCM-HKDF segments) for storage encryption at rest. Apache-2.0.
    implementation "com.google.crypto.tink:tink:${tinkVersion}"

    // @DataJpaTest slice (Boot 4 ships test slices as separate starters, like webmvc-test at the
    // root) so policy.source repositories can be exercised against embedded H2.
    testImplementation 'org.springframework.boot:spring-boot-starter-data-jpa-test'

    // Testcontainers: real MinIO/LocalStack (S3) and Valkey for integration tests in CI without
    // manually-started instances. Tests skip cleanly when Docker is unavailable.
    testImplementation "org.testcontainers:testcontainers:${testcontainersMinioVersion}"
    testImplementation "org.testcontainers:minio:${testcontainersMinioVersion}"
    testImplementation "org.testcontainers:localstack:${testcontainersMinioVersion}"
    testImplementation "org.testcontainers:postgresql:${testcontainersMinioVersion}"
    testImplementation "org.testcontainers:junit-jupiter:${testcontainersMinioVersion}"
}

tasks.register('prepareKotlinBuildScriptModel') {}

tasks.register('type3SignatureTool', JavaExec) {
    group = 'type3'
    description = 'Dump Type3 font signatures and glyph coverage for the Type3 library'
    classpath = sourceSets.main.runtimeClasspath
    mainClass = 'stirling.software.SPDF.service.pdfjson.type3.tool.Type3SignatureTool'
    standardInput = System.in
}