build.gradle

buildscript {
    repositories {
        jcenter()
    }
    dependencies {
        classpath("net.serenity-bdd:serenity-gradle-plugin:2.4.34")
    }
}

plugins {
    id 'application'
    id 'pmd'
    id 'org.sonarqube' version '3.3'
    id 'jacoco'
    id 'org.springframework.boot' version '2.3.5.RELEASE'
    id 'uk.gov.hmcts.java' version '0.12.12'
    id 'com.gorylenko.gradle-git-properties' version '2.3.1'
    id 'com.github.ben-manes.versions' version '0.39.0'
    id 'net.ltgt.apt' version '0.21'
    id "info.solidsoft.pitest" version '1.7.0'
    id 'org.owasp.dependencycheck' version '6.2.2'
    id 'au.com.dius.pact' version '4.2.14'
}

apply plugin: 'org.springframework.boot'
apply plugin: 'io.spring.dependency-management'
apply plugin: "info.solidsoft.pitest"

gitProperties {
    gitPropertiesDir = new File("${project.rootDir}/src/main/resources/uk/gov/hmcts/reform/sscs")
    keys = ['git.commit.id', 'git.commit.time']
    dateFormat = "yyyy-MM-dd'T'HH:mmZ"
    dateFormatTimeZone = "GMT"
}


group = 'uk.gov.hmcts.reform'
version = '1.0.0'

sourceCompatibility = 11
targetCompatibility = 11

compileJava {
    options.compilerArgs << '-parameters' << '-Xlint:deprecation' << "-Xlint:unchecked"
}

compileTestJava {
    options.compilerArgs << '-Xlint:deprecation'
}

mainClassName = 'uk.gov.hmcts.reform.sscs.TribunalsCaseApiApplication'

pmd {
    toolVersion = "6.5.0"
    ignoreFailures = true
    sourceSets = [sourceSets.main, sourceSets.test]
    reportsDir = file("$project.buildDir/reports/pmd")
    ruleSetFiles = files("config/pmd/ruleset.xml")
}

sourceSets {
    integrationTest {
        java {
            compileClasspath += main.output + test.output
            runtimeClasspath += main.output + test.output
            srcDir('src/IntegrationTests/java')
        }
        resources {
            srcDir('src/IntegrationTests/resources')
        }
    }
    e2e {
        java {
            compileClasspath += main.output + test.output
            runtimeClasspath += main.output + test.output
            srcDir('src/e2e/java')
        }
    }
    contractTest {
        java {
            compileClasspath += main.output
            runtimeClasspath += main.output
            srcDir file('src/contractTest/java')
        }
        resources.srcDir file('src/contractTest/resources')
    }
}

dependencies {
    integrationTestCompile(sourceSets.test.output)
    e2eCompile(sourceSets.test.output)
}

task integration(type: Test) {
    setTestClassesDirs(sourceSets.integrationTest.output.classesDirs)
    setClasspath(sourceSets.integrationTest.runtimeClasspath)
}

task functional(type: Test) {
    useJUnitPlatform()
    group = 'Functional Tests'
    description = 'Executes non-destructive functional tests in AAT against a running CCD and notification service'
    setTestClassesDirs(sourceSets.e2e.output.classesDirs)
    setClasspath(sourceSets.e2e.runtimeClasspath)
    include "uk/gov/hmcts/reform/sscs/functional/**"
    exclude "uk/gov/hmcts/reform/sscs/smoke/**"
}

task fortifyScan(type: JavaExec)  {
    main = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
    classpath += sourceSets.test.runtimeClasspath
    jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
}

jacoco {
    toolVersion = "0.8.2"
}

jacocoTestReport {
    executionData(test, integration)
    reports {
        xml.enabled = true
        csv.enabled = false
        xml.destination file("${project.buildDir}/reports/jacoco/test/jacocoTestReport.xml")
    }
}

dependencyUpdates.resolutionStrategy = {
    componentSelection { rules ->
        rules.all {
            def isNonStable = { String version ->
                def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
                def regex = /^[0-9,.v-]+(-r)?$/
                return !stableKeyword && !(version ==~ regex)
            }
            if (isNonStable(candidate.version) && !isNonStable(currentVersion)) {
                selection.reject('Release candidate')
            }
        }
    }
}

// https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
dependencyCheck {
    suppressionFile = 'dependency-check-suppressions.xml'
}

repositories {

    mavenLocal()
    mavenCentral()

    jcenter()

    // jitpack should be last resort
    // see: https://github.com/jitpack/jitpack.io/issues/1939
    maven { url 'https://jitpack.io' }
    // Requires authentication, if it gets here the library cannot be found!
    maven {
        url 'https://repo.spring.io/libs-milestone'
    }
}

project.tasks['sonarqube'].dependsOn test, integration, jacocoTestReport
check.dependsOn integration
checkstyleMain.shouldRunAfter(compileJava)
test.shouldRunAfter(checkstyleTest)
integration.shouldRunAfter(checkstyleIntegrationTest)
integration.shouldRunAfter(test)

sonarqube {
    properties {
        property "sonar.projectName", "SSCS - Tribunals Case Api"
        property "sonar.projectKey", "SSCSTCA"
        property "sonar.coverage.jacoco.xmlReportPaths", "${project.buildDir}/reports/jacoco/test/jacocoTestReport.xml"
        property "sonar.exclusions", "**/CreateCaseException.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/domain/**," +
                "src/main/java/uk/gov/hmcts/reform/sscs/TribunalsCaseApiApplication.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/email/Email.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/config/*," +
                "src/main/java/uk/gov/hmcts/reform/sscs/model/**/*.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/EvidenceUploadService.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/OnlineHearingService.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/pdf/data/EvidenceDescriptionPdfData.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/pdf/StoreAppellantStatementService.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/pdf/StorePdfService.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/coversheet/PdfCoverSheet.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/controllers/CreateCaseController.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/service/pdf/data/PdfData.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/ccd/presubmit/writefinaldecision/esa/EsaWriteFinalDecisionMidEventValidationHandler.java," +
                "src/main/java/uk/gov/hmcts/reform/sscs/ccd/presubmit/writefinaldecision/uc/UcWriteFinalDecisionMidEventValidationHandler.java"
        property "sonar.host.url", "https://sonar.reform.hmcts.net/"
        property "sonar.pitest.mode", "reuseReport"
        property "sonar.pitest.reportsDirectory", "build/reports/pitest"
    }
}

configurations {
    integrationTestCompile.extendsFrom(testCompile)
    integrationTestRuntime.extendsFrom(testRuntime)
    e2eCompile.extendsFrom(testCompile)
    e2eRuntime.extendsFrom(testRuntime)
    contractTestCompile.extendsFrom(testCompile)
    contractTestRuntime.extendsFrom(testRuntime)
}


def versions = [
        reformLogging: '5.1.7',
        springfoxSwagger: '2.8.0',
        pitest: '1.4.2',
        gradlePitest: '1.3.0',
        sonarPitest: '0.5',
        pact: '4.1.7',
        junitJupiter: '5.7.2',
        lombok: '1.18.22',
        sscsCommon: '4.6.4'
]

ext["rest-assured.version"] = '4.2.0'
ext['spring-security.version']='5.3.8.RELEASE'

ext {
    springCloudVersion = 'Hoxton.SR12'
}

dependencyManagement {
    dependencies {
        dependency group: 'commons-beanutils', name: 'commons-beanutils', version: '1.9.4'
        dependency group: 'org.apache.logging.log4j', name: 'log4j-api', version: '2.14.1'
        dependency group: 'org.apache.logging.log4j', name: 'log4j-to-slf4j', version: '2.14.1'
        // resolves: CVE-2020-28052
        dependency group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
        //CVE-2021-40690
        dependency group: 'org.apache.santuario', name: 'xmlsec', version: '2.3.0'

        // resolves: CVE-2019-10101, CVE-2019-10102, CVE-2019-10103, CVE-2020-15824
        dependencySet(group: 'org.jetbrains.kotlin', version: '1.5.31') {
            entry 'kotlin-stdlib'
            entry 'kotlin-stdlib-common'
            entry 'kotlin-stdlib-jdk8'
            entry 'kotlin-stdlib-jdk7'
            entry 'kotlin-reflect'
        }
        // CVE-2020-13934, CVE-2020-13935, CVE-2020-17527, CVE-2020-17527,
        dependencySet(group: 'org.apache.tomcat.embed', version: '9.0.54') {
            entry 'tomcat-embed-core'
            entry 'tomcat-embed-el'
            entry 'tomcat-annotations-api'
            entry 'tomcat-embed-websocket'
        }

        // CVE-2020-17521
        dependencySet(group: 'org.codehaus.groovy', version: '3.0.9') {
            entry 'groovy'
            entry 'groovy-json'
            entry 'groovy-xml'
        }

        //CVE-2021-22112
        dependencySet(group: 'org.springframework.security', version: '5.4.7') {
            entry 'spring-security-crypto'
            entry 'spring-security-config'
            entry 'spring-security-core'
            entry 'spring-security-web'
        }

        //CVE-2021-27807
        dependencySet(group: 'org.apache.pdfbox', version: '2.0.24') {
            entry 'pdfbox-tools'
            entry 'preflight'
        }

        dependencySet(group: 'org.apache.xmlgraphics', version: '1.14') {
            entry 'batik-all'
        }

        //CVE-2021-27807
        dependencySet(group: 'org.apache.pdfbox', version: '2.0.24') {
            entry 'pdfbox'
            entry 'pdfbox-tools'
            entry 'preflight'
        }

        //CVE-2021-22118
        dependencySet(group: 'org.springframework', version: '5.2.15.RELEASE') {
            entry 'spring-aop'
            entry 'spring-aspects'
            entry 'spring-beans'
            entry 'spring-context'
            entry 'spring-context-support'
            entry 'spring-core'
            entry 'spring-expression'
            entry 'spring-jcl'
            entry 'spring-jdbc'
            entry 'spring-orm'
            entry 'spring-tx'
            entry 'spring-web'
            entry 'spring-webmvc'
        }

        //CVE-2021-27568
        dependencySet(group: 'net.minidev', version: '2.4.7') {
            entry 'json-smart'
            entry 'accessors-smart'
        }

        //CVE-2021-30468
        dependencySet(group: 'org.apache.cxf', version: '3.4.5') {
            entry 'cxf-core'
            entry 'cxf-rt-frontend-jaxrs'
            entry 'cxf-rt-rs-client'
            entry 'cxf-rt-security'
            entry 'cxf-rt-transports-http'
        }

        //CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090
        dependencySet(group: 'org.apache.commons', version: '1.21') {
            entry 'commons-compress'
        }

        imports {
            mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
        }
    }
}

configurations.all {
    resolutionStrategy {
        eachDependency { DependencyResolveDetails details ->
            if (details.requested.group in ['com.fasterxml.jackson.module', 'com.fasterxml.jackson.datatype']) {
                details.useVersion '2.11.0'
            }
        }
    }
}

dependencies {
    compile group: 'org.springframework.boot', name: 'spring-boot-starter'
    compile group: 'org.springframework.boot', name: 'spring-boot-starter-web'
    compile group: 'org.springframework.boot', name: 'spring-boot-starter-actuator'
    compile group: 'org.springframework.boot', name: 'spring-boot-starter-aop'
    compile group: 'org.springframework.boot', name: 'spring-boot-starter-validation'

    compile group: 'org.springframework.cloud', name: 'spring-cloud-starter-openfeign'
    compile group: 'org.springframework.retry', name: 'spring-retry', version: '1.3.1'
    compile group: 'com.google.guava', name: 'guava', version: '31.0.1-jre'
    compile group: 'org.elasticsearch', name: 'elasticsearch', version: '7.15.1'

    compile group: 'uk.gov.hmcts.reform', name: 'service-auth-provider-client', version: '4.0.0'

    // Safe to remove once Spring update their dependencies - see CVE-2019-14439 and add 'com.fasterxml.jackson.core' configurations.all above
    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.11.3'

    compile group: 'net.objectlab.kit', name: 'datecalc-jdk8', version: '1.4.4'

    compile group: 'io.springfox', name: 'springfox-swagger2', version: versions.springfoxSwagger
    compile group: 'io.springfox', name: 'springfox-swagger-ui', version: versions.springfoxSwagger

    compile group: 'io.github.openfeign', name: 'feign-httpclient', version: '11.7'
    compile group: 'com.squareup.okhttp3', name: 'okhttp', version: '4.9.2'

    compile group: 'uk.gov.hmcts.reform.auth', name: 'auth-checker-lib', version: '2.1.4'
    compile group: 'uk.gov.hmcts.reform', name: 'properties-volume-spring-boot-starter', version: '0.1.0'
    compile group: 'com.github.hmcts', name: 'java-logging', version: versions.reformLogging
    compile group: 'uk.gov.hmcts.reform', name: 'doc-assembly-client', version: '1.07'
    compile("com.github.hmcts:ccd-case-document-am-client:1.7.2")
    //remove when secure doc store is live
    compile group: 'uk.gov.hmcts.reform', name: 'document-management-client', version: '7.0.0'

    compile group: 'com.github.hmcts', name: 'sscs-common', version: versions.sscsCommon
    compile group: 'com.github.hmcts', name: 'sscs-pdf-email-common', version: '1.4.49'


    compile group:'org.overviewproject', name: 'mime-types', version: '1.0.2'

    compile 'javax.xml.bind:jaxb-api:2.3.1'
    testCompile group: 'io.rest-assured', name: 'rest-assured'
    testCompile 'com.github.hmcts:fortify-client:1.2.1:all'

    compile "org.projectlombok:lombok:$versions.lombok"
    annotationProcessor "org.projectlombok:lombok:$versions.lombok"

    testCompile group: 'org.springframework.boot', name: 'spring-boot-starter-test'
    testCompile group: 'org.mockito', name: 'mockito-core', version: '4.0.0'
    testCompile group: 'net.javacrumbs.json-unit', name: 'json-unit', version: '2.28.0'
    testCompile group: 'org.mockito', name: 'mockito-junit-jupiter', version: '4.0.0'
    testCompile group: 'org.powermock', name: 'powermock-api-mockito2', version: '2.0.9'
    testCompile group: 'net.javacrumbs.json-unit', name: 'json-unit-fluent', version: '2.28.0'
    testCompile group: 'io.github.artsok', name: 'rerunner-jupiter', version: '2.1.6'

    testCompile 'pl.pragmatists:JUnitParams:1.1.1'

    testCompileOnly "org.projectlombok:lombok:$versions.lombok"
    testAnnotationProcessor "org.projectlombok:lombok:$versions.lombok"
    e2eCompile "org.projectlombok:lombok:$versions.lombok"
    e2eAnnotationProcessor "org.projectlombok:lombok:$versions.lombok"

    testCompile "org.junit.jupiter:junit-jupiter-api:$versions.junitJupiter"
    testRuntime "org.junit.jupiter:junit-jupiter-engine:$versions.junitJupiter"
    testImplementation "org.junit.jupiter:junit-jupiter-api:$versions.junitJupiter"

    e2eRuntime "org.junit.platform:junit-platform-commons:1.8.1"

    compile group: 'org.pitest', name: 'pitest', version: versions.pitest
    compile group:'info.solidsoft.gradle.pitest', name: 'gradle-pitest-plugin', version: versions.gradlePitest
    compile group:'org.codehaus.sonar-plugins', name:'sonar-pitest-plugin', version: versions.sonarPitest

    //pact contract testing
    contractTestCompile group: 'au.com.dius.pact.consumer', name: 'junit5', version: versions.pact
    contractTestCompile group: 'au.com.dius.pact.consumer', name: 'java8', version: versions.pact
    contractTestCompile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.11.0'

    contractTestRuntime group: 'au.com.dius.pact.consumer', name: 'junit5', version: versions.pact
    contractTestRuntime group: 'au.com.dius.pact.consumer', name: 'java8',  version: versions.pact
    contractTestRuntime group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.11.0'

    contractTestCompile group: 'org.springframework.boot', name: 'spring-boot-starter-test'
    contractTestCompile group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: versions.junitJupiter
    contractTestRuntime group: 'org.junit.jupiter', name: 'junit-jupiter-engine', version: versions.junitJupiter

    contractTestImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: versions.junitJupiter
    contractTestRuntime "org.junit.platform:junit-platform-commons:1.8.1"

    contractTestCompile(group: 'org.yaml', name: 'snakeyaml', version: '1.29') {
        force = true
    }

    contractTestCompile sourceSets.main.runtimeClasspath
    contractTestCompile sourceSets.test.runtimeClasspath
}
// this is required to force Java running on the Azure Windows Server OS into using
// UTF-8 as the default character set instead of windows-1252 which causes issues
applicationDefaultJvmArgs = ["-Dfile.encoding=UTF-8"]

bootJar {
    archiveName 'tribunals-case-api.jar'
    manifest {
        attributes 'Implementation-Title': project.name,
                'Implementation-Version': project.version
    }
}

jacocoTestReport {
    executionData(test, integration)
    reports {
        xml.enabled = true
        csv.enabled = false
    }
}

pitest {
    targetClasses = ['uk.gov.hmcts.reform.sscs.service.*']
    excludedClasses = ['uk.gov.hmcts.reform.sscs.config.*',
                       'uk.gov.hmcts.reform.sscs.builder.*',
                       'uk.gov.hmcts.reform.sscs.domain.*',
                       'uk.gov.hmcts.reform.sscs.exception.*',
                       'uk.gov.hmcts.reform.sscs.healthcheck.*',
                       'uk.gov.hmcts.reform.sscs.model.*',
                       'uk.gov.hmcts.reform.sscs.transform.*',
                       'uk.gov.hmcts.reform.sscs.TribunalsCaseApiApplication']
    excludedMethods = ['equals', 'hashcode']
    jvmArgs = ['-Xms1G','-Xmx3G']
    enableDefaultIncrementalAnalysis = true
    historyInputLocation = 'build/reports/pitest/fastermutationtesting'
    historyOutputLocation = 'build/reports/pitest/fastermutationtestingoutput'
    threads = 20
    verbose = true
    outputFormats = ['XML', 'HTML']
    timestampedReports = false
    mutationThreshold = 50
}

task smoke(type: Test) {
    group = 'verification'
    description = 'Executes non-destructive smoke tests against a running Tribual Case API'
    setTestClassesDirs(sourceSets.e2e.output.classesDirs)
    setClasspath(sourceSets.e2e.runtimeClasspath)
    include "uk/gov/hmcts/reform/sscs/smoke/**"
    exclude "uk/gov/hmcts/reform/sscs/functional/**"
}

task contract(type: Test, description: 'Runs the pact contract tests.', group: 'Verification') {
    description = "Runs the consumer Pact tests"
    useJUnitPlatform()
    testClassesDirs = sourceSets.contractTest.output.classesDirs
    classpath = sourceSets.contractTest.runtimeClasspath
}



project.ext {
    pacticipant = 'sscs_tribunalsCaseApi'
    pacticipantVersion = getCheckedOutGitCommitHash()
}

task runAndPublishConsumerPactTests(type: Test){
    logger.lifecycle("Runs pact Tests")
    testClassesDirs = sourceSets.contractTest.output.classesDirs
    classpath = sourceSets.contractTest.runtimeClasspath

}

task getSscsCommonVersion{
    doLast {
        print versions.sscsCommon
    }
}

runAndPublishConsumerPactTests.dependsOn contract

runAndPublishConsumerPactTests.finalizedBy pactPublish

pact {
    broker {
        pactBrokerUrl = System.getenv("PACT_BROKER_FULL_URL") ?: 'http://localhost:80'
    }
    publish {
        pactDirectory = 'pacts'
        tags = [System.getenv("PACT_BRANCH_NAME") ?:'Dev']
        version = project.pacticipantVersion
    }
}


static def getCheckedOutGitCommitHash() {
    'git rev-parse --verify --short HEAD'.execute().text.trim()
}


run {
    def debug = System.getProperty("debug")
    if (debug == 'true') {
        jvmArgs = ['-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5006']
    }
}