build.gradle

/*
 * SPDX-License-Identifier: Apache-2.0
 *
 * The OpenSearch Contributors require contributions made to
 * this file be licensed under the Apache-2.0 license or a
 * compatible open source license.
 *
 * Modifications Copyright OpenSearch Contributors. See
 * GitHub history for details.
 */


import com.diffplug.gradle.spotless.JavaExtension
import org.opensearch.gradle.test.RestIntegTestTask
import groovy.json.JsonBuilder

buildscript {
    ext {
        opensearch_version = System.getProperty("opensearch.version", "3.0.0-alpha1-SNAPSHOT")
        isSnapshot = "true" == System.getProperty("build.snapshot", "true")
        buildVersionQualifier = System.getProperty("build.version_qualifier", "alpha1")

        // 2.0.0-rc1-SNAPSHOT -> 2.0.0.0-rc1-SNAPSHOT
        version_tokens = opensearch_version.tokenize('-')
        opensearch_build = version_tokens[0] + '.0'

        common_utils_version = System.getProperty("common_utils.version", '3.0.0.0-alpha1-SNAPSHOT')

        kafka_version  = '3.7.1'
        open_saml_version = '5.1.3'
        open_saml_shib_version = "9.1.3"
        one_login_java_saml = '2.9.0'
        jjwt_version = '0.12.6'
        guava_version = '33.4.0-jre'
        jaxb_version = '2.3.9'
        spring_version = '6.2.4'

        if (buildVersionQualifier) {
            opensearch_build += "-${buildVersionQualifier}"
        }
        if (isSnapshot) {
            opensearch_build += "-SNAPSHOT"
        }
    }

    repositories {
        mavenLocal()
        mavenCentral()
        maven { url "https://plugins.gradle.org/m2/" }
        maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
        maven { url "https://artifacts.opensearch.org/snapshots/lucene/" }
        maven { url "https://build.shibboleth.net/nexus/content/groups/public" }
        maven { url "https://build.shibboleth.net/nexus/content/repositories/releases" }
    }

    dependencies {
        classpath "org.opensearch.gradle:build-tools:${opensearch_version}"
    }
}

plugins {
    id 'java'
    id 'idea'
    id 'jacoco'
    id 'maven-publish'
    id 'com.diffplug.spotless' version '6.25.0'
    id 'checkstyle'
    id 'com.netflix.nebula.ospackage' version "11.11.1"
    id "org.gradle.test-retry" version "1.6.2"
    id 'eclipse'
    id "com.github.spotbugs" version "5.2.5"
    id "com.google.osdetector" version "1.7.3"
}

allprojects {
    group = "org.opensearch"
    version = opensearch_build
}

apply plugin: 'opensearch.opensearchplugin'
apply plugin: 'opensearch.pluginzip'
apply plugin: 'opensearch.rest-test'
apply plugin: 'opensearch.testclusters'
apply from: 'gradle/formatting.gradle'

licenseFile = rootProject.file('LICENSE.txt')
noticeFile = rootProject.file('NOTICE.txt')

spotbugs {
    includeFilter = file('spotbugs-include.xml')
}

spotbugsTest {
    enabled = false
}

java.sourceCompatibility = JavaVersion.VERSION_21
java.targetCompatibility = JavaVersion.VERSION_21


compileJava {
    options.compilerArgs = [
            '-Xlint:auxiliaryclass',
            '-Xlint:cast',
            '-Xlint:classfile',
            '-Xlint:dep-ann',
            '-Xlint:divzero',
            '-Xlint:empty',
            '-Xlint:exports',
            '-Xlint:fallthrough',
            '-Xlint:finally',
            '-Xlint:module',
            '-Xlint:opens',
            '-Xlint:overloads',
            '-Xlint:overrides',
            '-Xlint:-processing',
            '-Xlint:rawtypes',
            '-Xlint:removal',
            '-Xlint:requires-automatic',
            '-Xlint:requires-transitive-automatic',
            '-Xlint:static',
            '-Xlint:unchecked',
            '-Xlint:varargs',
            '-Xlint:preview',
            '-Werror']
    options.encoding = 'UTF-8'
}

compileTestJava {
    options.compilerArgs = [
            '-Xlint:auxiliaryclass',
            '-Xlint:cast',
            '-Xlint:classfile',
            '-Xlint:dep-ann',
            '-Xlint:divzero',
            '-Xlint:empty',
            '-Xlint:exports',
            '-Xlint:fallthrough',
            '-Xlint:finally',
            '-Xlint:module',
            '-Xlint:opens',
            '-Xlint:overloads',
            '-Xlint:overrides',
            '-Xlint:-processing',
            '-Xlint:rawtypes',
            '-Xlint:removal',
            '-Xlint:requires-automatic',
            '-Xlint:requires-transitive-automatic',
            '-Xlint:static',
            '-Xlint:unchecked',
            '-Xlint:varargs',
            '-Xlint:preview',
            '-Werror']
    options.encoding = 'UTF-8'
}


licenseHeaders.enabled = true

// The following check that have never be enabled in security
dependencyLicenses.enabled = false
thirdPartyAudit.enabled = false
loggerUsageCheck.enabled = false
forbiddenApisMain.enabled = false
forbiddenApisTest.enabled = false
filepermissions.enabled = false
forbiddenPatterns.enabled = false
testingConventions.enabled = false
jarHell.enabled = true
tasks.whenTaskAdded {task ->
    if(task.name.contains("forbiddenApisIntegrationTest")) {
        task.enabled = false
    }
}

def splitTestConfig = [
    ciSecurityIntegrationTest: [
        description: "Runs integration tests from all classes.",
        filters: [
            includeTestsMatching: [
                "org.opensearch.security.*Integ*"
            ],
            excludeTestsMatching: [
                "org.opensearch.security.sanity.tests.*"
            ]
        ]
    ],
    crossClusterTest: [
        description: "Runs cross-cluster tests.",
        filters: [
            includeTestsMatching: [
                    "org.opensearch.security.ccstest.*"
            ]
        ]
    ],
    dlicDlsflsTest: [
        description: "Runs Document- and Field-Level Security tests.",
        filters: [
            includeTestsMatching: [
                "org.opensearch.security.dlic.dlsfls.*"
            ]
        ]
    ],
    dlicRestApiTest: [
        description: "Runs REST Management API tests.",
        filters: [
            includeTestsMatching: [
                "org.opensearch.security.dlic.rest.*"
            ]
        ]
    ],
    indicesTest: [
        description: "Runs indices tests from all classes.",
        filters: [
            includeTestsMatching: [
                "org.opensearch.security.*indices*"
            ],
            excludeTestsMatching: [
                "org.opensearch.security.sanity.tests.*"
            ]
        ]
    ],
    opensslCITest: [
        description: "Runs portion of SSL tests related to OpenSSL. Explained in https://github.com/opensearch-project/security/pull/2301",
        include: '**/OpenSSL*.class'
    ],
    sslTest: [
        description: "Runs most of the SSL tests.",
        filters: [
            includeTestsMatching: [
                "org.opensearch.security.ssl.*"
            ],
            excludeTestsMatching: [
                "org.opensearch.security.ssl.OpenSSL*"
            ]
        ]
    ]
] as ConfigObject

List<String> taskNames = splitTestConfig.keySet() as List

task listTasksAsJSON {
    // We are using `doLast` to explicitly specify when we
    // want this action to be started. Without it the output
    // is not shown at all or can be mixed with other outputs.
    doLast {
        System.out.println(new JsonBuilder(["citest"] + taskNames))
    }
}

test {
    include '**/*.class'
    filter {
        excludeTestsMatching "org.opensearch.security.sanity.tests.*"
    }
    maxParallelForks = 8
    jvmArgs += "-Xmx3072m"
    if (JavaVersion.current() > JavaVersion.VERSION_1_8) {
        jvmArgs += "--add-opens=java.base/java.io=ALL-UNNAMED"
        // this is needed to reflect access system env map.
        jvmArgs += "--add-opens=java.base/java.util=ALL-UNNAMED"
    }
    retry {
        failOnPassedAfterRetry = false
        maxRetries = 5
    }
    jacoco {
        excludes = [
                "com.sun.jndi.dns.*",
                "com.sun.security.sasl.gsskerb.*",
                "java.sql.*",
                "javax.script.*",
                "org.jcp.xml.dsig.internal.dom.*",
                "sun.nio.cs.ext.*",
                "sun.security.ec.*",
                "sun.security.jgss.*",
                "sun.security.pkcs11.*",
                "sun.security.smartcardio.*",
                "sun.util.resources.provider.*"
        ]
    }
}

task copyExtraTestResources(dependsOn: testClasses) {

    copy {
        from 'src/test/resources'
        into 'build/testrun/test/src/test/resources'
    }

    taskNames.each { testName ->
        copy {
            from 'src/test/resources'
            into "build/testrun/${testName}/src/test/resources"
        }
    }

    copy {
        from 'src/test/resources'
        into 'build/testrun/citest/src/test/resources'
    }
}

def setCommonTestConfig(Test task) {
    task.maxParallelForks = 8
    task.jvmArgs += "-Xmx3072m"
    if (JavaVersion.current() > JavaVersion.VERSION_1_8) {
        task.jvmArgs += "--add-opens=java.base/java.io=ALL-UNNAMED"
        // this is needed to reflect access system env map.
        task.jvmArgs += "--add-opens=java.base/java.util=ALL-UNNAMED"
    }
    task.retry {
        failOnPassedAfterRetry = false
        maxRetries = 5
    }
    task.jacoco {
        excludes = [
                "com.sun.jndi.dns.*",
                "com.sun.security.sasl.gsskerb.*",
                "java.sql.*",
                "javax.script.*",
                "org.jcp.xml.dsig.internal.dom.*",
                "sun.nio.cs.ext.*",
                "sun.security.ec.*",
                "sun.security.jgss.*",
                "sun.security.pkcs11.*",
                "sun.security.smartcardio.*",
                "sun.util.resources.provider.*"
        ]
    }
    task.dependsOn copyExtraTestResources
    task.finalizedBy jacocoTestReport
}

task citest(type: Test) {
    group = "Github Actions tests"
    description = "Runs the test suite on classes not covered by rest of the task in this group."
    include '**/*.class'
    filter {
        excludeTestsMatching "org.opensearch.security.sanity.tests.*"
        excludeTestsMatching "org.opensearch.security.ssl.OpenSSL*"
        splitTestConfig.each { entry ->
            entry.value.filters.each{ test ->
                if (test.key == "includeTestsMatching") {
                    test.value.each{
                        excludeTestsMatching "${it}"
                    }
                } else if (test.key == "includeTest") {
                    test.value.each{
                        excludeTest "${it}"
                    }
                }
            }
        }
    }
    setCommonTestConfig(it)
}

splitTestConfig.each{ testName, testCfg ->
    task "${testName}"(type: Test) {
        group = testCfg.group ?: "Github Actions tests"
        description = testCfg.description
        include testCfg.include ?: '**/*.class'
        filter {
            testCfg.filters.each{ filter, values ->
                values.each{ value ->
                    "${filter}" "${value}"
                }
            }
        }
        setCommonTestConfig(it)
    }
}

tasks.test.dependsOn(copyExtraTestResources)

jacoco {
    reportsDirectory = file("$buildDir/reports/jacoco")
}

jacocoTestReport {
    getExecutionData().setFrom(fileTree(buildDir).include("/jacoco/*.exec"))
    reports {
        xml.required = true
    }
}

checkstyle {
    toolVersion "10.3.3"
    showViolations true
    configDirectory.set(rootProject.file("checkstyle/"))
}

tasks.withType(Checkstyle) {
    dependsOn(':precommit')
    reports {
        ignoreFailures = false
    }
}


opensearchplugin {
    name 'opensearch-security'
    description 'Provide access control related features for OpenSearch'
    classname 'org.opensearch.security.OpenSearchSecurityPlugin'
}

// This requires an additional Jar not published as part of build-tools
loggerUsageCheck.enabled = false

publishing {
    publications {
        pluginZip(MavenPublication) { publication ->
            pom {
                name = "opensearch-security"
                description = "Provide access control related features for OpenSearch"
                groupId = "org.opensearch.plugin"
                licenses {
                    license {
                        name = "The Apache License, Version 2.0"
                        url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
                    }
                }
                developers {
                    developer {
                        name = "OpenSearch"
                        url = "https://github.com/opensearch-project/security"
                    }
                }
            }
        }
    }
    repositories {
        maven {
            name = "Snapshots" //  optional target repository name
            url = "https://aws.oss.sonatype.org/content/repositories/snapshots"
            credentials {
                username "$System.env.SONATYPE_USERNAME"
                password "$System.env.SONATYPE_PASSWORD"
            }
        }
    }
}

repositories {
    mavenLocal()
    mavenCentral()
    maven { url "https://plugins.gradle.org/m2/" }
    maven { url "https://aws.oss.sonatype.org/content/repositories/snapshots" }
    maven { url "https://artifacts.opensearch.org/snapshots/lucene/" }
    maven { url "https://build.shibboleth.net/nexus/content/repositories/releases" }
}

tasks.test.finalizedBy(jacocoTestReport)  // report is always generated after tests run

allprojects {
    tasks.withType(Javadoc).all { enabled = false }
}

bundlePlugin {
    from('plugin-security.policy')
    from('config') {
        into 'config'
    }
    from('tools') {
        into 'tools'
    }
}

configurations {
    all {
        resolutionStrategy {
            force 'commons-codec:commons-codec:1.18.0'
            force 'org.slf4j:slf4j-api:1.7.36'
            force 'org.scala-lang:scala-library:2.13.16'
            force "com.fasterxml.jackson:jackson-bom:${versions.jackson}"
            force "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
            force "com.fasterxml.jackson.datatype:jackson-datatype-jdk8:${versions.jackson}"
            force "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
            force "io.netty:netty-buffer:${versions.netty}"
            force "io.netty:netty-common:${versions.netty}"
            force "io.netty:netty-handler:${versions.netty}"
            force "io.netty:netty-transport:${versions.netty}"
            force "io.netty:netty-transport-native-unix-common:${versions.netty}"
            force "com.github.luben:zstd-jni:${versions.zstd}"
            force "org.xerial.snappy:snappy-java:1.1.10.7"
            force "com.google.guava:guava:${guava_version}"

            // for spotbugs dependency conflict
            force "org.apache.commons:commons-lang3:${versions.commonslang}"

            // for spotless transitive dependency CVE
            force "org.eclipse.platform:org.eclipse.core.runtime:3.33.0"
            force "org.eclipse.platform:org.eclipse.equinox.common:3.20.0"

            // For integrationTest
            force "org.apache.httpcomponents:httpclient:4.5.14"
            force "org.apache.httpcomponents:httpcore:4.4.16"
            force "com.google.errorprone:error_prone_annotations:2.36.0"
            force "org.checkerframework:checker-qual:3.49.1"
            force "ch.qos.logback:logback-classic:1.5.17"
            force "commons-io:commons-io:2.18.0"
        }
    }

    integrationTestImplementation.extendsFrom implementation
    integrationTestRuntimeOnly.extendsFrom runtimeOnly
}

//create source set 'integrationTest'
//add classes from the main source set to the compilation and runtime classpaths of the integrationTest
sourceSets {
    integrationTest {
        java {
            srcDir file ('src/integrationTest/java')
            compileClasspath += sourceSets.main.output
            runtimeClasspath += sourceSets.main.output
        }
        resources {
            srcDir file('src/integrationTest/resources')
        }
        processIntegrationTestResources {
            duplicatesStrategy(DuplicatesStrategy.INCLUDE)
        }
    }
}

//add new task that runs integration tests
task integrationTest(type: Test) {
    doFirst {
        // Only run resources tests on resource-test CI environments or locally
        if (System.getenv('CI_ENVIRONMENT') != 'resource-test' && System.getenv('CI_ENVIRONMENT') != null) {
            exclude '**/ResourceFocusedTests.class'
        }
        if (System.getenv('DISABLE_RETRY') != 'true') {
            retry {
                failOnPassedAfterRetry = false
                maxRetries = 2
                maxFailures = 10
            }
        }
    }
    description = 'Run integration tests.'
    group = 'verification'
    systemProperty "java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager"
    testClassesDirs = sourceSets.integrationTest.output.classesDirs
    classpath = sourceSets.integrationTest.runtimeClasspath
    //run the integrationTest task after the test task
    shouldRunAfter test
    jacoco {
        excludes = [
                "com.sun.jndi.dns.*",
                "com.sun.security.sasl.gsskerb.*",
                "java.sql.*",
                "javax.script.*",
                "org.jcp.xml.dsig.internal.dom.*",
                "sun.nio.cs.ext.*",
                "sun.security.ec.*",
                "sun.security.jgss.*",
                "sun.security.pkcs11.*",
                "sun.security.smartcardio.*",
                "sun.util.resources.provider.*"
        ]
    }
}

tasks.named("integrationTest") {
    minHeapSize = "512m"
    maxHeapSize = "2g"
}

tasks.integrationTest.finalizedBy(jacocoTestReport) // report is always generated after integration tests run

//run the integrationTest task before the check task
check.dependsOn integrationTest

dependencies {
    implementation "org.opensearch.plugin:transport-netty4-client:${opensearch_version}"
    implementation "org.opensearch.client:opensearch-rest-high-level-client:${opensearch_version}"
    implementation "org.apache.httpcomponents.client5:httpclient5-cache:${versions.httpclient5}"
    implementation "org.apache.httpcomponents:httpclient:${versions.httpclient}"
    implementation "org.apache.httpcomponents:httpcore:${versions.httpcore}"
    implementation "org.apache.httpcomponents:httpasyncclient:${versions.httpasyncclient}"
    implementation "com.google.guava:guava:${guava_version}"
    implementation 'org.greenrobot:eventbus-java:3.3.1'
    implementation 'commons-cli:commons-cli:1.9.0'
    implementation "org.bouncycastle:bcprov-jdk18on:${versions.bouncycastle}"
    implementation 'org.ldaptive:ldaptive:1.2.3'
    implementation 'com.nimbusds:nimbus-jose-jwt:9.48'
    implementation 'com.rfksystems:blake2b:2.0.0'
    implementation 'com.password4j:password4j:1.8.2'
    implementation "com.github.seancfoley:ipaddress:5.5.1"

    // Action privileges: check tables and compact collections
    implementation 'com.selectivem.collections:special-collections-complete:1.4.0'

    //JWT
    implementation "io.jsonwebtoken:jjwt-api:${jjwt_version}"
    implementation "io.jsonwebtoken:jjwt-impl:${jjwt_version}"
    implementation "io.jsonwebtoken:jjwt-jackson:${jjwt_version}"
    // JSON patch
    implementation 'com.flipkart.zjsonpatch:zjsonpatch:0.4.16'
    implementation 'org.apache.commons:commons-collections4:4.4'

    //Password generation
    implementation 'org.passay:passay:1.6.6'

    implementation "org.apache.kafka:kafka-clients:${kafka_version}"

    runtimeOnly 'net.minidev:accessors-smart:2.5.2'

    runtimeOnly 'com.sun.activation:jakarta.activation:1.2.2'
    runtimeOnly 'com.eclipsesource.minimal-json:minimal-json:0.9.5'
    runtimeOnly 'commons-codec:commons-codec:1.18.0'
    runtimeOnly 'org.cryptacular:cryptacular:1.2.7'
    compileOnly 'com.google.errorprone:error_prone_annotations:2.36.0'
    runtimeOnly 'com.sun.istack:istack-commons-runtime:4.2.0'
    runtimeOnly 'jakarta.xml.bind:jakarta.xml.bind-api:4.0.2'
    runtimeOnly 'org.ow2.asm:asm:9.7.1'

    testImplementation 'org.apache.camel:camel-xmlsecurity:3.22.4'

    //Onelogin OpenSaml
    implementation "com.onelogin:java-saml:${one_login_java_saml}"
    implementation "com.onelogin:java-saml-core:${one_login_java_saml}"
    //OpenSAML
    runtimeOnly "io.dropwizard.metrics:metrics-core:4.2.30"
    implementation "net.shibboleth:shib-support:${open_saml_shib_version}"
    implementation "net.shibboleth:shib-security:${open_saml_shib_version}"
    implementation "net.shibboleth:shib-networking:${open_saml_shib_version}"
    implementation "org.opensaml:opensaml-core-api:${open_saml_version}"
    implementation "org.opensaml:opensaml-core-impl:${open_saml_version}"
    implementation "org.opensaml:opensaml-security-api:${open_saml_version}"
    implementation "org.opensaml:opensaml-security-impl:${open_saml_version}"
    implementation "org.opensaml:opensaml-xmlsec-api:${open_saml_version}"
    implementation "org.opensaml:opensaml-xmlsec-impl:${open_saml_version}"

    implementation "org.opensaml:opensaml-saml-api:${open_saml_version}"
    implementation ("org.opensaml:opensaml-saml-impl:${open_saml_version}") {
        exclude(group: 'org.apache.velocity', module: 'velocity')
    }
    implementation "org.opensaml:opensaml-messaging-api:${open_saml_version}"
    runtimeOnly "org.opensaml:opensaml-profile-api:${open_saml_version}"
    runtimeOnly "org.opensaml:opensaml-soap-api:${open_saml_version}"
    runtimeOnly "org.opensaml:opensaml-soap-impl:${open_saml_version}"
    implementation "org.opensaml:opensaml-storage-api:${open_saml_version}"


    implementation "com.nulab-inc:zxcvbn:1.9.0"

    runtimeOnly 'com.google.guava:failureaccess:1.0.2'
    runtimeOnly 'org.apache.commons:commons-text:1.13.0'
    runtimeOnly "org.glassfish.jaxb:jaxb-runtime:${jaxb_version}"
    runtimeOnly 'com.google.j2objc:j2objc-annotations:2.8'
    compileOnly 'com.google.code.findbugs:jsr305:3.0.2'
    runtimeOnly 'org.lz4:lz4-java:1.8.0'
    runtimeOnly 'org.slf4j:slf4j-api:1.7.36'
    runtimeOnly "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
    runtimeOnly 'org.xerial.snappy:snappy-java:1.1.10.7'
    runtimeOnly 'org.codehaus.woodstox:stax2-api:4.2.2'
    runtimeOnly "org.glassfish.jaxb:txw2:${jaxb_version}"
    runtimeOnly 'com.fasterxml.woodstox:woodstox-core:6.7.0'
    runtimeOnly 'org.apache.ws.xmlschema:xmlschema-core:2.3.1'
    runtimeOnly 'org.apache.santuario:xmlsec:2.3.5'
    runtimeOnly "com.github.luben:zstd-jni:${versions.zstd}"
    runtimeOnly 'org.checkerframework:checker-qual:3.49.1'
    runtimeOnly "org.bouncycastle:bcpkix-jdk18on:${versions.bouncycastle}"
    runtimeOnly 'org.scala-lang.modules:scala-java8-compat_3:1.0.2'


    testImplementation "org.opensaml:opensaml-messaging-impl:${open_saml_version}"
    testImplementation "jakarta.servlet:jakarta.servlet-api:6.1.0"
    implementation "org.apache.commons:commons-lang3:${versions.commonslang}"
    testImplementation "org.opensearch:common-utils:${common_utils_version}"
    testImplementation "org.opensearch.plugin:reindex-client:${opensearch_version}"
    testImplementation "org.opensearch:opensearch-ssl-config:${opensearch_version}"
    testImplementation "org.opensearch.plugin:percolator-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:lang-mustache-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:parent-join-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:aggs-matrix-stats-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:search-pipeline-common:${opensearch_version}"
    testImplementation "org.apache.logging.log4j:log4j-core:${versions.log4j}"
    testImplementation 'com.unboundid:unboundid-ldapsdk:4.0.14'
    testImplementation 'com.github.stephenc.jcip:jcip-annotations:1.0-1'
    testImplementation 'com.unboundid:unboundid-ldapsdk:4.0.14'
    testImplementation 'org.apache.httpcomponents:fluent-hc:4.5.14'
    testImplementation "org.apache.httpcomponents.client5:httpclient5-fluent:${versions.httpclient5}"
    testImplementation "org.apache.kafka:kafka_2.13:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-server:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-server-common:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-server-common:${kafka_version}:test"
    testImplementation "org.apache.kafka:kafka-group-coordinator:${kafka_version}"
    testImplementation "org.apache.kafka:kafka_2.13:${kafka_version}:test"
    testImplementation "org.apache.kafka:kafka-clients:${kafka_version}:test"
    testImplementation 'commons-validator:commons-validator:1.9.0'
    testImplementation 'org.springframework.kafka:spring-kafka-test:3.3.3'
    testImplementation "org.springframework:spring-beans:${spring_version}"
    testImplementation 'org.junit.jupiter:junit-jupiter:5.12.1'
    testImplementation 'org.junit.jupiter:junit-jupiter-api:5.12.1'
    testImplementation('org.awaitility:awaitility:4.3.0') {
        exclude(group: 'org.hamcrest', module: 'hamcrest')
    }
    testImplementation "org.bouncycastle:bcpkix-jdk18on:${versions.bouncycastle}"
    testImplementation "org.bouncycastle:bcutil-jdk18on:${versions.bouncycastle}"

    // Only osx-x86_64, osx-aarch_64, linux-x86_64, linux-aarch_64, windows-x86_64 are available
    if (osdetector.classifier in ["osx-x86_64", "osx-aarch_64", "linux-x86_64", "linux-aarch_64", "windows-x86_64"]) {
        testImplementation "io.netty:netty-tcnative-classes:2.0.66.Final"
        testImplementation "io.netty:netty-tcnative-boringssl-static:2.0.66.Final:${osdetector.classifier}"
    }
    // JUnit build requirement
    testCompileOnly 'org.apiguardian:apiguardian-api:1.1.2'
    // Kafka test execution
    testRuntimeOnly 'org.springframework.retry:spring-retry:1.3.4'
    testRuntimeOnly ("org.springframework:spring-core:${spring_version}") {
        exclude(group:'org.springframework', module: 'spring-jcl' )
    }
    testRuntimeOnly 'org.scala-lang:scala-library:2.13.16'
    testRuntimeOnly 'com.typesafe.scala-logging:scala-logging_3:3.9.5'
    testRuntimeOnly('org.apache.zookeeper:zookeeper:3.9.3') {
        exclude(group:'ch.qos.logback', module: 'logback-classic' )
        exclude(group:'ch.qos.logback', module: 'logback-core' )
    }
    testRuntimeOnly 'com.yammer.metrics:metrics-core:2.2.0'
    testRuntimeOnly "org.apache.kafka:kafka-metadata:${kafka_version}"
    testRuntimeOnly "org.apache.kafka:kafka-storage:${kafka_version}"

    implementation "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
    implementation "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"

    compileOnly "org.opensearch:opensearch:${opensearch_version}"

    //integration test framework:
    integrationTestImplementation('com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.8.2') {
        exclude(group: 'junit', module: 'junit')
    }
    integrationTestImplementation 'junit:junit:4.13.2'
    integrationTestImplementation "org.opensearch.plugin:reindex-client:${opensearch_version}"
    integrationTestImplementation "org.opensearch.plugin:percolator-client:${opensearch_version}"
    integrationTestImplementation 'commons-io:commons-io:2.18.0'
    integrationTestImplementation "org.apache.logging.log4j:log4j-core:${versions.log4j}"
    integrationTestImplementation "org.apache.logging.log4j:log4j-jul:${versions.log4j}"
    integrationTestImplementation 'org.hamcrest:hamcrest:2.2'
    integrationTestImplementation "org.bouncycastle:bcpkix-jdk18on:${versions.bouncycastle}"
    integrationTestImplementation "org.bouncycastle:bcutil-jdk18on:${versions.bouncycastle}"
    integrationTestImplementation('org.awaitility:awaitility:4.3.0') {
        exclude(group: 'org.hamcrest', module: 'hamcrest')
    }
    integrationTestImplementation 'com.unboundid:unboundid-ldapsdk:4.0.14'
    integrationTestImplementation "org.opensearch.plugin:mapper-size:${opensearch_version}"
    integrationTestImplementation "org.apache.httpcomponents:httpclient-cache:4.5.14"
    integrationTestImplementation "org.apache.httpcomponents:httpclient:4.5.14"
    integrationTestImplementation "org.apache.httpcomponents:fluent-hc:4.5.14"
    integrationTestImplementation "org.apache.httpcomponents:httpcore:4.4.16"
    integrationTestImplementation "org.apache.httpcomponents:httpasyncclient:4.1.5"
    integrationTestImplementation "org.mockito:mockito-core:5.16.1"

    //spotless
    implementation('com.google.googlejavaformat:google-java-format:1.25.2') {
        exclude group: 'com.google.guava'
    }
}

jar {
    libsDirName = '.'
    into '', {
        from 'NOTICE.txt', "THIRD-PARTY.txt", "LICENSE"
    }
    processResources {
        exclude("KEYS")
    }
}

tasks.register('testsJar', Jar) {
    archiveClassifier = 'tests'
    from(sourceSets.test.output)
}

testsJar {
    libsDirName = '.'
}

task bundleSecurityAdminStandalone(dependsOn: jar, type: Zip) {
    archiveClassifier = 'securityadmin-standalone'
    from(configurations.runtimeClasspath) {
        into 'deps/'
    }
    from(project.jar) {
        into 'deps/'
    }
    from('tools') {
        into 'tools/'
    }
    from('config') {
        into 'deps/securityconfig'
    }
}

task bundleSecurityAdminStandaloneTarGz(dependsOn: jar, type: Tar) {
    archiveClassifier = 'securityadmin-standalone'
    archiveExtension = 'tar.gz'
    compression = Compression.GZIP
    from(configurations.runtimeClasspath) {
        into 'deps/'
    }
    from(project.jar) {
        into 'deps/'
    }
    from('tools') {
        into 'tools/'
    }
    from('config') {
        into 'deps/securityconfig'
    }
}

buildRpm {
    arch = 'NOARCH'
    addParentDirs = false
    archiveFileName = "${packageName}-${version}.rpm"
}

buildDeb {
    arch = 'all'
    archiveFileName = "${packageName}-${version}.deb"
}

publishing {
    publications {
        maven(MavenPublication) {
            from(components.java)
            artifact(testsJar)
        }
    }
}

task integTestRemote(type: RestIntegTestTask) {

    systemProperty "tests.security.manager", "false"
    systemProperty "user", System.getProperty("user")
    systemProperty "password", System.getProperty("password")
    systemProperty "https", System.getProperty("https")
    systemProperty "security.enabled", "true"

    filter {
        setIncludePatterns("org.opensearch.security.sanity.tests.*IT")
    }
}

integTestRemote.enabled = System.getProperty("tests.rest.cluster") != null

tasks.integTestRemote.finalizedBy(jacocoTestReport) // report is always generated after integration tests run

// should be updated appropriately, when we add integTests in future
integTest.enabled = false

// This is afterEvaluate because the bundlePlugin ZIP task is updated afterEvaluate and changes the ZIP name to match the plugin name
afterEvaluate {
    ospackage {
        packageName = "${name}"
        release = isSnapshot ? "0.1" : '1'
        version = "${project.version}" - "-SNAPSHOT"

        into '/usr/share/opensearch/plugins'
        from(zipTree(bundlePlugin.archivePath)) {
            into opensearchplugin.name
        }

        user 'root'
        permissionGroup 'root'
        fileMode 0644
        dirMode 0755

        requires('opensearch', versions.opensearch, EQUAL)
        packager = 'Amazon'
        vendor = 'Amazon'
        os = 'LINUX'
        prefix '/usr'

        license 'ASL-2.0'
        maintainer 'OpenSearch <opensearch@amazon.com>'
        url 'https://opensearch.org/downloads.html'
        summary '''
         Security plugin for OpenSearch.
         Reference documentation can be found at https://opensearch.org/docs/latest/.
    '''.stripIndent().replace('\n', ' ').trim()
    }

    buildRpm {
        arch = 'NOARCH'
        dependsOn 'assemble'
        finalizedBy 'renameRpm'
        task renameRpm(type: Copy) {
            from("$buildDir/distributions")
            into("$buildDir/distributions")
            rename "$archiveFileName", "${packageName}-${version}.rpm"
            doLast { delete file("$buildDir/distributions/$archiveFileName") }
        }
    }

    buildDeb {
        arch = 'all'
        dependsOn 'assemble'
        finalizedBy 'renameDeb'
        task renameDeb(type: Copy) {
            from("$buildDir/distributions")
            into("$buildDir/distributions")
            rename "$archiveFileName", "${packageName}-${version}.deb"
            doLast { delete file("$buildDir/distributions/$archiveFileName") }
        }
    }

    task buildPackages(type: GradleBuild) {
        tasks = ['build', 'buildRpm', 'buildDeb']
    }
}

// updateVersion: Task to auto increment to the next development iteration
task updateVersion {
    onlyIf { System.getProperty('newVersion') }
    doLast {
        ext.newVersion = System.getProperty('newVersion')
        println "Setting version to ${newVersion}."
        // String tokenization to support -SNAPSHOT
        ant.replaceregexp(match: opensearch_version.tokenize('-')[0], replace: newVersion.tokenize('-')[0], flags:'g', byline:true) {
            fileset(dir: projectDir) {
                // Include the required files that needs to be updated with new Version
                include(name: "bwc-test/build.gradle")
                include(name: ".github/workflows/plugin_install.yml")
            }
        }
        ant.replaceregexp(file:'build.gradle', match: '"opensearch.version", "\\d.*"', replace: '"opensearch.version", "' + newVersion.tokenize('-')[0] + '-SNAPSHOT"', flags:'g', byline:true)
    }
}