<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
  -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>tck</artifactId>
        <groupId>org.apache.tomee</groupId>
        <version>11.0.0-M1</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
    <artifactId>security-standalone</artifactId>
    <packaging>pom</packaging>
    <name>TomEE :: TCK :: Jakarta Security</name>

    <properties>
        <security-tck.version>4.0.0</security-tck.version>
        <security-tck.url>https://download.eclipse.org/jakartaee/security/4.0/jakarta-security-tck-${security-tck.version}.zip</security-tck.url>
        <tck.dir>${project.build.directory}/security-tck-${security-tck.version}/tck</tck.dir>
    </properties>

    <profiles>
        <profile>
            <id>tck-security</id>
            <build>
                <plugins>
                    <!-- Step 1: Download and unpack the Security TCK -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>download-tck</id>
                                <phase>generate-test-resources</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <get skipexisting="true" src="${security-tck.url}" dest="${project.build.directory}/jakarta-security-tck-${security-tck.version}.zip" />
                                        <unzip src="${project.build.directory}/jakarta-security-tck-${security-tck.version}.zip" dest="${project.build.directory}" />

                                        <!-- Overlay TomEE arquillian.xml into TCK common resources -->
                                        <copy file="${project.basedir}/src/test/resources/arquillian.xml" tofile="${tck.dir}/common/src/main/resources/arquillian.xml" overwrite="true" />

                                        <!--
                                          Load the TomEE Remote profile fragment from src/test/resources
                                          (Ant property references inside the file are expanded against
                                          this Maven module) and inject it into the TCK parent pom.xml
                                          right before </profiles>.
                                        -->
                                        <loadfile property="tomee.remote.profile" srcFile="${project.basedir}/src/test/resources/tomee-remote-profile.xml" encoding="UTF-8">
                                            <filterchain>
                                                <expandproperties />
                                            </filterchain>
                                        </loadfile>
                                        <replace file="${tck.dir}/pom.xml" token="&lt;/profiles&gt;" value="${line.separator}${tomee.remote.profile}${line.separator}    &lt;/profiles&gt;" />

                                        <!-- Remove security-signaturetest from reactor (uses GlassFish-only properties) -->
                                        <replace file="${tck.dir}/pom.xml" token="&lt;module&gt;security-signaturetest&lt;/module&gt;" value="&lt;!-- module&gt;security-signaturetest&lt;/module --&gt;" />

                                        <!-- Deactivate GlassFish profile default activation -->
                                        <replace file="${tck.dir}/pom.xml" token="&lt;activeByDefault&gt;true&lt;/activeByDefault&gt;" value="&lt;activeByDefault&gt;false&lt;/activeByDefault&gt;" />

                                        <!-- Replace old arquillian-protocol-servlet with Jakarta variant -->
                                        <replace file="${tck.dir}/pom.xml" token="&lt;artifactId&gt;arquillian-protocol-servlet&lt;/artifactId&gt;" value="&lt;artifactId&gt;arquillian-protocol-servlet-jakarta&lt;/artifactId&gt;${line.separator}            &lt;version&gt;${version.arquillian-protocol-servlet-jakarta}&lt;/version&gt;" />

                                        <!--
                                          Seed the shared truststore that app-openid2/3's
                                          keytool-maven-plugin will append to. Starts from the JDK's
                                          default cacerts so Maven metadata fetches against public
                                          HTTPS repos still validate alongside the localhost cert.
                                        -->
                                        <mkdir dir="${project.build.directory}/glassfish8/glassfish/domains/domain1/config" />
                                        <delete file="${project.build.directory}/glassfish8/glassfish/domains/domain1/config/cacerts.jks" quiet="true" />
                                        <copy file="${java.home}/lib/security/cacerts" tofile="${project.build.directory}/glassfish8/glassfish/domains/domain1/config/cacerts.jks" />

                                        <!--
                                          Regenerate the OpenID module HTTPS certs.
                                          The TCK ships self-signed certs that expired in March 2023; we mint
                                          fresh 10-year certs so standard JSSE validation passes without any
                                          trust-all fallback.
                                        -->
                                        <exec executable="bash" failonerror="true">
                                            <arg value="-c" />
                                            <arg value="set -euo pipefail; for d in &quot;${tck.dir}&quot;/app-openid*/; do if [ -f &quot;$d/localhost-rsa.jks&quot; ]; then rm -f &quot;$d/localhost-rsa.jks&quot; &quot;$d/tomcat.cert&quot;; keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -validity 3650 -dname 'CN=localhost, OU=jakarta, O=eclipse, L=amsterdam, ST=holland, C=nl' -storetype PKCS12 -storepass changeit -keypass changeit -keystore &quot;$d/localhost-rsa.jks&quot;; keytool -exportcert -alias tomcat -storepass changeit -keystore &quot;$d/localhost-rsa.jks&quot; -file &quot;$d/tomcat.cert&quot;; fi; done" />
                                        </exec>

                                        <!--
                                          Avoid keytool alias collisions when sequential OpenID modules import
                                          into the same cacerts.jks. Derive a unique alias per app-openidN dir
                                          (app-openid has no keytool step, so it is skipped).
                                        -->
                                        <exec executable="bash" failonerror="true">
                                            <arg value="-c" />
                                            <arg value="set -euo pipefail; for p in &quot;${tck.dir}&quot;/app-openid*/pom.xml; do name=$(basename &quot;$(dirname &quot;$p&quot;)&quot;); suffix=${name#app-openid}; if [ -n &quot;$suffix&quot; ]; then sed -i.bak -e &quot;s|&lt;alias&gt;tomcat&lt;/alias&gt;|&lt;alias&gt;tomcat-openid${suffix}&lt;/alias&gt;|&quot; &quot;$p&quot;; rm -f &quot;$p.bak&quot;; fi; done" />
                                        </exec>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>

                    <!-- Step 2: Install TCK parent pom and common module to local repo -->
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <version>3.6.3</version>
                        <executions>
                            <!-- Install parent pom first (needed by all modules) -->
                            <execution>
                                <id>install-tck-parent</id>
                                <phase>pre-integration-test</phase>
                                <goals>
                                    <goal>exec</goal>
                                </goals>
                                <configuration>
                                    <executable>mvn</executable>
                                    <workingDirectory>${tck.dir}</workingDirectory>
                                    <arguments>
                                        <argument>install</argument>
                                        <argument>-N</argument>
                                        <argument>-Ptomee-remote</argument>
                                    </arguments>
                                </configuration>
                            </execution>
                            <!-- Then install common module (shared test utilities) -->
                            <execution>
                                <id>install-tck-common</id>
                                <phase>pre-integration-test</phase>
                                <goals>
                                    <goal>exec</goal>
                                </goals>
                                <configuration>
                                    <executable>mvn</executable>
                                    <workingDirectory>${tck.dir}/common</workingDirectory>
                                    <arguments>
                                        <argument>install</argument>
                                        <argument>-Ptomee-remote</argument>
                                        <argument>-DskipTests</argument>
                                    </arguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>

                    <!-- Step 3: Run TCK test modules via invoker -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-invoker-plugin</artifactId>
                        <version>3.10.1</version>
                        <configuration>
                            <projectsDirectory>${tck.dir}</projectsDirectory>
                            <localRepositoryPath>${settings.localRepository}</localRepositoryPath>
                            <streamLogs>true</streamLogs>
                            <showErrors>true</showErrors>
                            <!-- Don't fail the build on TCK test failures - we want the full baseline -->
                            <ignoreFailures>true</ignoreFailures>
                        </configuration>
                        <executions>
                            <execution>
                                <id>run-security-tck</id>
                                <phase>integration-test</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <goals>
                                        <goal>verify</goal>
                                    </goals>
                                    <profiles>
                                        <profile>tomee-remote</profile>
                                    </profiles>
                                    <pomIncludes>
                                        <!-- SecurityContext tests -->
                                        <pomInclude>app-securitycontext/pom.xml</pomInclude>
                                        <pomInclude>app-securitycontext-auth/pom.xml</pomInclude>
                                        <pomInclude>app-securitycontext-customprincipal/pom.xml</pomInclude>
                                        <!-- Identity store tests -->
                                        <pomInclude>app-mem/pom.xml</pomInclude>
                                        <pomInclude>app-db/pom.xml</pomInclude>
                                        <pomInclude>app-ldap/pom.xml</pomInclude>
                                        <pomInclude>app-ldap2/pom.xml</pomInclude>
                                        <pomInclude>app-ldap3/pom.xml</pomInclude>
                                        <pomInclude>app-custom/pom.xml</pomInclude>
                                        <pomInclude>app-multiple-store/pom.xml</pomInclude>
                                        <pomInclude>app-multiple-store-backup/pom.xml</pomInclude>
                                        <!-- Auth mechanism tests -->
                                        <pomInclude>app-mem-basic/pom.xml</pomInclude>
                                        <pomInclude>app-mem-basic-decorate/pom.xml</pomInclude>
                                        <pomInclude>app-mem-form/pom.xml</pomInclude>
                                        <pomInclude>app-mem-customform/pom.xml</pomInclude>
                                        <!-- OpenID Connect tests -->
                                        <pomInclude>app-openid/pom.xml</pomInclude>
                                        <pomInclude>app-openid2/pom.xml</pomInclude>
                                        <pomInclude>app-openid3/pom.xml</pomInclude>
                                        <!-- Service tests -->
                                        <pomInclude>app-custom-session/pom.xml</pomInclude>
                                        <pomInclude>app-custom-rememberme/pom.xml</pomInclude>
                                        <!-- Handler tests -->
                                        <pomInclude>app-custom-identity-store-handler/pom.xml</pomInclude>
                                        <pomInclude>app-custom-authentication-mechanism-handler/pom.xml</pomInclude>
                                        <pomInclude>app-custom-authentication-mechanism-handler2/pom.xml</pomInclude>
                                        <!-- JAX-RS security -->
                                        <pomInclude>app-jaxrs/pom.xml</pomInclude>
                                        <!-- JACC policy tests -->
                                        <pomInclude>app-mem-policy/pom.xml</pomInclude>
                                        <pomInclude>app-mem-policy2/pom.xml</pomInclude>
                                    </pomIncludes>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>
