pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <!--
        Spring Boot parent provides sensible defaults for plugins, dependency versions,
        and configuration. Using 4.0.x for Java 17+ compatibility and latest features.
    -->
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.0.1</version>
        <relativePath/>
    </parent>

    <groupId>com.github.jguida941</groupId>
    <artifactId>cs320-contact-service-junit</artifactId>
    <version>1.0.0-SNAPSHOT</version>
    <name>CS320 Contact Service</name>
    <description>Contact, Task, and Appointment management service with REST API</description>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <java.version>17</java.version>
        <!--
            Override JUnit version from Spring Boot parent if needed.
            Spring Boot 3.4 uses JUnit 5.10.x by default, which matches our needs.
        -->
        <junit.jupiter.version>5.10.3</junit.jupiter.version>
        <surefire.version>3.5.4</surefire.version>
        <checkstyle.plugin.version>3.6.0</checkstyle.plugin.version>
        <spotbugs.maven.plugin.version>4.9.8.1</spotbugs.maven.plugin.version>
        <jacoco.version>0.8.14</jacoco.version>
        <dependency.check.version>12.1.9</dependency.check.version>
        <dependency.check.skip>false</dependency.check.skip>
        <nvdApiDelay>8000</nvdApiDelay>
        <pitest.version>1.22.0</pitest.version>
        <pit.skip>false</pit.skip>
        <spotbugs.skip>false</spotbugs.skip>
        <!-- Integration tests require Docker/Testcontainers; skip locally by default -->
        <skipITs>true</skipITs>
    </properties>

    <dependencies>
        <!--
            Spring Boot Web starter: Brings in Spring MVC, embedded Tomcat,
            Jackson for JSON, and auto-configuration for REST endpoints.
            This is the foundation for our REST API layer.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webmvc</artifactId>
        </dependency>

        <!--
            Spring Boot Actuator: Provides production-ready features like
            health checks (/actuator/health), info endpoint (/actuator/info),
            and metrics. Essential for monitoring and deployment readiness.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

        <!--
            Spring Boot Jackson 2: In Spring Boot 4.0, Jackson 3 is the default.
            This module provides Jackson 2 compatibility for existing code.
            Deprecated - will be removed in 4.2.0.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-jackson2</artifactId>
        </dependency>

        <!--
            Micrometer Prometheus Registry: Exposes metrics in Prometheus format
            at /actuator/prometheus for scraping by monitoring systems.
            Uses the new Prometheus Java client (1.x) required by Spring Boot 3.5+.
        -->
        <dependency>
            <groupId>io.micrometer</groupId>
            <artifactId>micrometer-registry-prometheus</artifactId>
        </dependency>

        <!--
            Bean Validation (JSR-380): Enables @Valid, @NotBlank, @Size, etc.
            on DTOs. Works alongside our domain-level Validation helper so
            we have two layers of defense: API-level (annotations) and
            domain-level (Validation.java).
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

        <!--
            Spring Security: Provides authentication, authorization, and
            protection against common attacks (CSRF, session fixation, etc.).
            Phase 5 requirement for JWT-based stateless authentication.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <!--
            JJWT (Java JWT): Library for creating and validating JSON Web Tokens.
            Used for stateless authentication in the REST API. Includes:
            - jjwt-api: Core interfaces
            - jjwt-impl: Implementation (runtime)
            - jjwt-jackson: JSON processing with Jackson (runtime)
        -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>0.13.0</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>0.13.0</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <version>0.13.0</version>
            <scope>runtime</scope>
        </dependency>

        <!--
            Bucket4j: Token bucket rate limiting library for preventing API abuse.
            Used to enforce per-IP and per-user rate limits on high-risk endpoints.
        -->
        <dependency>
            <groupId>com.bucket4j</groupId>
            <artifactId>bucket4j-core</artifactId>
            <version>8.10.1</version>
        </dependency>

        <!--
            Caffeine: High-performance caching library used to bound rate limit
            bucket maps with max size and time-based expiration (prevents DoS).
        -->
        <dependency>
            <groupId>com.github.ben-manes.caffeine</groupId>
            <artifactId>caffeine</artifactId>
            <version>3.2.3</version>
        </dependency>

        <!--
            Spring Data JPA: Provides Hibernate + repository support so we can
            persist domain aggregates in Postgres while keeping services simple.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>

        <!--
            Spring Boot Flyway Starter: Provides auto-configuration for Flyway
            database migrations. In Spring Boot 4.0, this starter is required
            (previously flyway-core alone was sufficient).
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-flyway</artifactId>
        </dependency>
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-database-postgresql</artifactId>
        </dependency>
        <!--
            PostgreSQL JDBC driver used by dev/prod profiles.
            Scope runtime so it isn't required for compilation.
        -->
        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
            <scope>runtime</scope>
        </dependency>

        <!--
            SpringDoc OpenAPI: Auto-generates OpenAPI 3.0 specification from
            Spring MVC controllers. Provides Swagger UI at /swagger-ui.html
            and OpenAPI JSON at /v3/api-docs. Required for Phase 2 API docs.
        -->
        <dependency>
            <groupId>org.springdoc</groupId>
            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
            <version>3.0.0</version>
        </dependency>

        <!--
            Override commons-lang3 version from Spring Boot parent to fix CVE-2025-48924.
            Spring Boot 3.4.12 uses 3.17.0 which is vulnerable.
        -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.20.0</version>
        </dependency>

        <!--
            Force commons-compress to 1.28.0 to remediate CVE-2024-25710/CVE-2024-26308
            flagged by OWASP Dependency-Check (transitive dependency via SpringDoc).
        -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-compress</artifactId>
            <version>1.28.0</version>
        </dependency>

        <!--
            Logstash Logback Encoder: Provides structured JSON logging for production.
            Enables correlation IDs, custom fields, and easy integration with ELK/observability platforms.
            Includes StructuredArguments for programmatic field injection.
        -->
        <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>9.0</version>
        </dependency>

        <!--
            SpotBugs annotations for static analysis.
            Scope is provided since these are compile-time only.
        -->
        <dependency>
            <groupId>com.github.spotbugs</groupId>
            <artifactId>spotbugs-annotations</artifactId>
            <version>4.9.8</version>
            <scope>provided</scope>
        </dependency>

        <!-- ==================== Test Dependencies ==================== -->

        <!--
            Spring Boot Test starter: Brings in JUnit 5, Mockito, AssertJ,
            Spring Test, and MockMvc for testing REST controllers.
            Replaces our standalone JUnit/AssertJ dependencies.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <!--
            Spring Boot 4.0 modularized test starters - required for test annotations.
            See: https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.0-Migration-Guide
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webmvc-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa-test</artifactId>
            <scope>test</scope>
        </dependency>

        <!--
            Spring Security Test: Provides @WithMockUser, SecurityMockMvcRequestPostProcessors,
            and other utilities for testing secured endpoints.
        -->
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>

        <!-- H2 in-memory database used by fast test slices/profile -->
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <scope>runtime</scope>
        </dependency>

        <!-- Testcontainers + Spring Boot integration for Postgres-backed tests -->
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>postgresql</artifactId>
            <version>1.21.4</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>1.21.4</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-testcontainers</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${surefire.version}</version>
                <configuration>
                    <useModulePath>false</useModulePath>
                    <!-- Prevent fork bombing: use single JVM to avoid resource exhaustion -->
                    <forkCount>1</forkCount>
                    <reuseForks>true</reuseForks>
                    <!-- Sequential execution to ensure @Isolated tests don't collide -->
                    <excludedGroups>legacy-singleton</excludedGroups>
                    <excludes>
                        <exclude>**/*IT.java</exclude>
                    </excludes>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <version>${surefire.version}</version>
                <configuration>
                    <skipITs>${skipITs}</skipITs>
                    <useModulePath>false</useModulePath>
                    <parallel>classes</parallel>
                    <useUnlimitedThreads>true</useUnlimitedThreads>
                    <includes>
                        <include>**/*IT.java</include>
                    </includes>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>${checkstyle.plugin.version}</version>
                <executions>
                    <execution>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <configLocation>config/checkstyle/checkstyle.xml</configLocation>
                    <consoleOutput>true</consoleOutput>
                    <failsOnError>true</failsOnError>
                </configuration>
            </plugin>
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs.maven.plugin.version}</version>
                <configuration>
                    <effort>max</effort>
                    <threshold>Low</threshold>
                    <failOnError>true</failOnError>
                    <skip>${spotbugs.skip}</skip>
                    <htmlOutput>true</htmlOutput>
                    <xmlOutput>true</xmlOutput>
                    <excludeFilterFile>config/spotbugs-exclude.xml</excludeFilterFile>
                </configuration>
                <executions>
                    <execution>
                        <phase>verify</phase>
                        <goals>
                            <goal>spotbugs</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco.version}</version>
                <configuration>
                    <!-- Allow profiles (e.g., skip-testcontainers) to disable JaCoCo gates via jacoco.skip -->
                    <skip>${jacoco.skip}</skip>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <rule>
                                    <element>BUNDLE</element>
                                    <limits>
                                        <limit>
                                            <counter>INSTRUCTION</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>0.80</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                            <excludes>
                                <!-- Exclude container-only support classes from coverage checks (reduces noise on skip-testcontainers runs) -->
                                <exclude>contactapp/support/PostgresContainerSupport*.class</exclude>
                            </excludes>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>${dependency.check.version}</version>
                <executions>
                    <execution>
                        <phase>verify</phase>
                        <goals>
                            <goal>aggregate</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <failBuildOnCVSS>7.0</failBuildOnCVSS>
                    <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
                    <nvdApiDelay>${nvdApiDelay}</nvdApiDelay>
                    <dataDirectory>${project.basedir}/.owasp-cache</dataDirectory>
                    <nvdValidForHours>168</nvdValidForHours>
                    <suppressionFiles>
                        <suppressionFile>config/owasp-suppressions.xml</suppressionFile>
                    </suppressionFiles>
                    <failOnError>false</failOnError>
                    <skip>${dependency.check.skip}</skip>
                    <skipTestScope>false</skipTestScope>
                    <formats>HTML,JSON</formats>
                    <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                    <nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
                    <nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.pitest</groupId>
                <artifactId>pitest-maven</artifactId>
                <version>${pitest.version}</version>
                <dependencies>
                    <dependency>
                        <groupId>org.pitest</groupId>
                        <artifactId>pitest-junit5-plugin</artifactId>
                        <version>1.2.3</version>
                    </dependency>
                </dependencies>
                <executions>
                    <execution>
                        <phase>verify</phase>
                        <goals>
                            <goal>mutationCoverage</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <targetClasses>
                        <param>contactapp.*</param>
                    </targetClasses>
                    <targetTests>
                        <param>contactapp.*Test</param>
                    </targetTests>
                    <mutationThreshold>70</mutationThreshold>
                    <threads>2</threads>
                    <timeoutFactor>1.5</timeoutFactor>
                    <timestampedReports>false</timestampedReports>
                    <outputFormats>
                        <param>XML</param>
                        <param>HTML</param>
                    </outputFormats>
                    <features>
                        <feature>+CLASSLIMIT(limit[1000])</feature>
                    </features>
                    <skip>${pit.skip}</skip>
                </configuration>
            </plugin>

            <!--
                Frontend Maven Plugin: Builds the React UI during prepare-package phase.
                This keeps 'mvn test' fast (no UI build) while 'mvn package' produces
                a single JAR with both backend and static frontend assets.
                See ADR-0028 for design rationale.
            -->
            <plugin>
                <groupId>com.github.eirslett</groupId>
                <artifactId>frontend-maven-plugin</artifactId>
                <version>2.0.0</version>
                <configuration>
                    <workingDirectory>ui/contact-app</workingDirectory>
                    <nodeVersion>v22.16.0</nodeVersion>
                </configuration>
                <executions>
                    <execution>
                        <id>install-node-npm</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>install-node-and-npm</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>npm-install</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>npm</goal>
                        </goals>
                        <configuration>
                            <arguments>ci</arguments>
                        </configuration>
                    </execution>
                    <execution>
                        <id>npm-build</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>npm</goal>
                        </goals>
                        <configuration>
                            <arguments>run build</arguments>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
                Maven Resources Plugin: Copies built UI assets to static/ so Spring Boot
                serves them at the root path. Runs after npm build in prepare-package.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <executions>
                    <execution>
                        <id>copy-frontend</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>copy-resources</goal>
                        </goals>
                        <configuration>
                            <outputDirectory>${project.build.outputDirectory}/static</outputDirectory>
                            <resources>
                                <resource>
                                    <directory>ui/contact-app/dist</directory>
                                </resource>
                            </resources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
                Spring Boot Maven Plugin: Enables 'mvn spring-boot:run' for local dev
                and packages the app as an executable JAR with embedded Tomcat.
                Repackage goal runs during package phase to create the fat JAR.
            -->
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <id>legacy-singleton</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-surefire-plugin</artifactId>
                        <configuration>
                            <groups>legacy-singleton</groups>
                            <includes>
                                <include>**/service/*Test.java</include>
                            </includes>
                            <excludes>
                                <exclude>**/*IT.java</exclude>
                            </excludes>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
            <properties>
                <skipITs>true</skipITs>
            </properties>
        </profile>
        <!--
            Profile to skip Testcontainers-based tests on platforms without Docker support.
            Activated by passing -DskipTestcontainersTests=true (used on Windows CI runners).
        -->
        <profile>
            <id>skip-testcontainers</id>
            <activation>
                <property>
                    <name>skipTestcontainersTests</name>
                    <value>true</value>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.jacoco</groupId>
                        <artifactId>jacoco-maven-plugin</artifactId>
                        <configuration>
                            <!-- Run a reduced JaCoCo check on Windows/H2 by excluding container-only code paths -->
                            <skip>false</skip>
                        </configuration>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>prepare-agent</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>report</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>report</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>check</id>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                                <configuration>
                                    <rules>
                                        <rule>
                                            <element>BUNDLE</element>
                                            <limits>
                                                <limit>
                                                    <counter>INSTRUCTION</counter>
                                                    <value>COVEREDRATIO</value>
                                                    <!-- Reduced threshold for Windows/no-Docker runs that skip integration tests -->
                                                    <minimum>0.75</minimum>
                                                </limit>
                                            </limits>
                                        </rule>
                                    </rules>
                                    <excludes>
                                        <exclude>contactapp/support/PostgresContainerSupport*.class</exclude>
                                        <exclude>contactapp/api/**</exclude>
                                        <exclude>contactapp/config/**</exclude>
                                        <exclude>contactapp/Application*.class</exclude>
                                    </excludes>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-surefire-plugin</artifactId>
                        <configuration>
                            <excludes>
                                <!-- Skip PostgresContainerSupport-based suites when Docker is unavailable -->
                                <exclude>**/ApplicationTest.java</exclude>
                                <exclude>**/ActuatorEndpointsTest.java</exclude>
                                <exclude>**/*ControllerTest.java</exclude>
                                <exclude>**/SecurityConfigIntegrationTest.java</exclude>
                                <exclude>**/ServiceBeanTest.java</exclude>
                                <exclude>**/*IT.java</exclude>
                            </excludes>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
            <properties>
                <!-- H2 in-memory datasource for non-container runs -->
                <spring.datasource.url>jdbc:h2:mem:contacts;MODE=PostgreSQL;DATABASE_TO_LOWER=TRUE;DB_CLOSE_DELAY=-1</spring.datasource.url>
                <spring.datasource.driver-class-name>org.h2.Driver</spring.datasource.driver-class-name>
                <spring.datasource.username>sa</spring.datasource.username>
                <spring.datasource.password></spring.datasource.password>
                <!-- Skip the global Jacoco gate; use the profile-scoped reduced gate above -->
                <jacoco.skip>true</jacoco.skip>
                <!-- Disable Flyway against H2 for this profile if desired -->
                <!-- <spring.flyway.enabled>false</spring.flyway.enabled> -->
            </properties>
        </profile>
    </profiles>
</project>