Stirling-PDF/app/core/build.gradle

apply plugin: 'org.springframework.boot'

import org.apache.tools.ant.taskdefs.condition.Os

configurations {
    developmentOnly
    runtimeClasspath {
        extendsFrom developmentOnly
    }
}

spotless {
    java {
        target 'src/**/java/**/*.java'
        targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
        suppressLintsFor { setStep('google-java-format') }

        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
    }
    yaml {
        target '**/*.yml', '**/*.yaml'
        targetExclude 'src/main/resources/static/**'
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
    }
    format 'gradle', {
        target '**/gradle/*.gradle', '**/*.gradle'
        targetExclude 'src/main/resources/static/**'
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
    }
}

dependencies {
    if (System.getenv('DISABLE_ADDITIONAL_FEATURES') != 'true'
        || (project.hasProperty('DISABLE_ADDITIONAL_FEATURES')
        && System.getProperty('DISABLE_ADDITIONAL_FEATURES') != 'true')) {
        implementation project(':proprietary')
    }

    implementation project(':common')
    implementation 'org.springframework.boot:spring-boot-starter-jetty'
    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
    implementation 'org.eclipse.jetty:jetty-alpn-java-server'
    implementation ('org.telegram:telegrambots:6.9.7.1') {
        // Grizzly server + Jersey JAX-RS stack: only used for webhook mode;
        // Stirling-PDF uses long-polling mode so these are dead weight (~3 MB)
        exclude group: 'org.glassfish.jersey.inject'
        exclude group: 'org.glassfish.jersey.media'
        exclude group: 'org.glassfish.jersey.containers'
        exclude group: 'org.glassfish.jersey.core'
        exclude group: 'org.glassfish.jersey.ext'
        exclude group: 'org.glassfish.grizzly'
        exclude group: 'org.glassfish.hk2'
        exclude group: 'org.glassfish.hk2.external'
        exclude group: 'org.javassist', module: 'javassist'
        // Old javax JAX-RS Jackson bindings (not needed, project uses jakarta)
        exclude group: 'com.fasterxml.jackson.jaxrs'
        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
    }
    implementation 'commons-io:commons-io:2.21.0'
    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
    implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
    implementation 'io.micrometer:micrometer-core'
    implementation 'com.google.zxing:core:3.5.4'
    implementation "org.commonmark:commonmark:$commonmarkVersion" // https://mvnrepository.com/artifact/org.commonmark/commonmark
    implementation "org.commonmark:commonmark-ext-gfm-tables:$commonmarkVersion"

    // General PDF dependencies
    implementation "org.apache.pdfbox:preflight:$pdfboxVersion"
    implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"

    implementation 'org.verapdf:validation-model:1.28.2'
    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
    implementation 'org.mozilla:rhino:1.9.1'

    // veraPDF still uses javax.xml.bind, not the new jakarta namespace
    implementation 'javax.xml.bind:jaxb-api:2.3.1'
    implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
    implementation 'com.sun.xml.bind:jaxb-core:4.0.7'
    implementation 'org.apache.poi:poi-ooxml:5.5.1'

    // https://mvnrepository.com/artifact/technology.tabula/tabula
    implementation ('technology.tabula:tabula:1.0.5')  {
        exclude group: 'org.slf4j', module: 'slf4j-simple'
        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
        exclude group: 'com.google.code.gson', module: 'gson'
    }
    // CVE-2022-25647: Explicit gson 2.13.2 to prevent unsafe deserialization (tabula would pull 2.8.7)
    implementation 'com.google.code.gson:gson:2.13.2'
    implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
    implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
    implementation 'org.apache.poi:poi-ooxml:5.5.1'

    // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
    // Replaces batik-all which included unused codec, svggen, transcoder, script modules
    implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
    // Required by TwelveMonkeys imageio-batik SPI (SVGImageReaderSpi) during ImageIO init
    runtimeOnly 'org.apache.xmlgraphics:batik-transcoder:1.19'

    // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
    implementation 'de.rototor.pdfbox:graphics2d:3.0.5'

    // TwelveMonkeys
    runtimeOnly "com.twelvemonkeys.imageio:imageio-batik:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-bmp:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-jpeg:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-tiff:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-webp:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-hdr:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-icns:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-iff:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-pcx:$imageioVersion@
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-pict:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-pnm:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-psd:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-sgi:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-tga:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-thumbsdb:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-xwd:$imageioVersion"

    developmentOnly 'org.springframework.boot:spring-boot-devtools'
}

sourceSets {
    main {
        resources {
            srcDirs += ['../configs']
        }
    }
    test {
    }

}


// Disable regular jar
jar {
    enabled = false
}

// Configure and enable bootJar for this project
bootJar {
    enabled = true
    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
    zip64 = true

    // Don't include all dependencies directly like the old jar task did
    // from {
    //     configurations.runtimeClasspath.collect { it.isDirectory() ? it : zipTree(it) }
    // }

    // Exclude signature files to prevent "Invalid signature file digest" errors
    exclude 'META-INF/*.SF'
    exclude 'META-INF/*.DSA'
    exclude 'META-INF/*.RSA'
    exclude 'META-INF/*.EC'

    manifest {
        attributes(
            'Implementation-Title': 'Stirling-PDF',
            'Implementation-Version': project.version
        )
    }
}

// Configure main class for Spring Boot
springBoot {
    mainClass = 'stirling.software.SPDF.SPDFApplication'
}

// Frontend build tasks - only enabled with -PbuildWithFrontend=true
def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
def frontendDir = file('../../frontend')
def frontendDistDir = file('../../frontend/dist')
def resourcesStaticDir = file('src/main/resources/static')
def generatedFrontendPaths = [
    'assets',
    'index.html',
    'locales',
    'Login',
    'classic-logo',
    'modern-logo',
    'og_images',
    'samples',
    'manifest-classic.json'
]

tasks.register('npmInstall', Exec) {
    doNotTrackState("node_modules contains symlinks that Gradle cannot snapshot on Windows/WSL")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Install frontend dependencies'
    workingDir frontendDir
    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
    inputs.file(new File(frontendDir, 'package.json'))
    inputs.file(new File(frontendDir, 'package-lock.json'))
    outputs.dir(new File(frontendDir, 'node_modules'))

    // Show live output
    standardOutput = System.out
    errorOutput = System.err

    // Skip if node_modules exists and is up-to-date
    onlyIf {
        def nodeModules = new File(frontendDir, 'node_modules')
        if (!nodeModules.exists()) {
            println "node_modules not found, will install..."
            return true
        }

        // if required devDependency is missing, reinstall
        def iconifyPkg = new File(frontendDir, 'node_modules/@iconify-json/material-symbols/package.json')
        if (!iconifyPkg.exists()) {
            println "@iconify-json/material-symbols missing, will reinstall..."
            return true
        }

        def packageJson = new File(frontendDir, 'package.json')
        def packageLock = new File(frontendDir, 'package-lock.json')
        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
                        nodeModules.lastModified() < packageLock.lastModified()
        if (isOutdated) {
            println "package.json or package-lock.json changed, will reinstall..."
        } else {
            println "node_modules is up-to-date, skipping npm install"
        }
        return isOutdated
    }

    doFirst {
        println "Installing npm dependencies in ${frontendDir}..."
    }
}

tasks.register('npmBuild', Exec) {
    doNotTrackState("Frontend build depends on untracked npmInstall task")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Build frontend application'
    workingDir file('../..')
    commandLine = ['task', 'frontend:build']
    inputs.dir(new File(frontendDir, 'src'))
    inputs.dir(new File(frontendDir, 'public'))
    inputs.file(new File(frontendDir, 'package.json'))
    outputs.dir(frontendDistDir)

    // Show live output
    standardOutput = System.out
    errorOutput = System.err

    // Override VITE_API_BASE_URL to use relative paths for production builds
    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
    environment 'VITE_API_BASE_URL', '/'

    doFirst {
        println "Building frontend application for production (VITE_API_BASE_URL=/)"
    }
}

tasks.register('copyFrontendAssets', Copy) {
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Copy frontend build to static resources'
    dependsOn npmBuild
    from(frontendDistDir) {
        // Exclude files that conflict with backend static resources
        exclude 'robots.txt'  // Backend already has this
        exclude 'favicon.ico' // Backend already has this
    }
    into resourcesStaticDir
    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
    doFirst {
        println "Copying frontend build from ${frontendDistDir} to ${resourcesStaticDir}..."
        println "Backend static resources will be preserved"
    }
    doLast {
        println "Frontend assets copied successfully!"
    }
}

tasks.register('cleanFrontendAssets', Delete) {
    group = 'frontend'
    description = 'Remove previously generated frontend assets from static resources'
    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
}

tasks.register('copyApiLandingPage', Copy) {
    group = 'frontend'
    description = 'Copy API landing page to index.html for backend-only mode'
    from(new File(resourcesStaticDir, 'api-landing.html'))
    into(resourcesStaticDir)
    rename('api-landing.html', 'index.html')
    dependsOn cleanFrontendAssets
    doFirst {
        println "Copying API landing page to index.html for backend-only mode..."
    }
}

// Ensure copyFrontendAssets runs after spotless tasks
tasks.named('copyFrontendAssets').configure {
    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
}

if (buildWithFrontend) {
    println "Frontend build enabled - JAR will include React frontend"
    processResources.dependsOn copyFrontendAssets
} else {
    println "Frontend build disabled - JAR will be backend-only with API landing page"
    // When not building the UI, ensure any stale frontend assets are removed and use API landing page
    processResources.dependsOn copyApiLandingPage
}

bootJar.dependsOn ':common:jar'
bootJar.dependsOn ':proprietary:jar'