/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * License); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an AS IS BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

apply plugin: 'org.apache.beam.module'
apply plugin: 'application'
mainClassName = "org.apache.beam.sdk.expansion.service.ExpansionService"

applyJavaNature(
  automaticModuleName: 'org.apache.beam.sdk.io.expansion.service',
  exportJavadoc: false,
  validateShadowJar: false,
  shadowClosure: {},
  // iceberg requires Java11+ and delta lake requires Java17+
  requireJavaVersion: JavaVersion.VERSION_17
)

// We don't want to use the latest version for the entire beam sdk since beam Java users can override it themselves.
// We set this for python and cross-lang since it cannot be overwritten and version 3.4.0>= is required in order to
// take advantage of OAuth authentication with all providers.
configurations.runtimeClasspath {
  // Pin kafka-clients version due to <3.4.0 missing auth callback classes.
  resolutionStrategy.force 'org.apache.kafka:kafka-clients:3.9.0'
  // force parquet-avro:1.15.2 to fix CVE-2025-46762
  resolutionStrategy.force 'org.apache.parquet:parquet-avro:1.15.2'

  // Pin Jetty version due to hadoop 3.4.1 using 9.4.53.v20231009, which had
  // two direct vulnerabilities.  There is one dependency vulnerability left
  // in 9.4.57.v20241919.  Higher major versions are not allowed due to
  // incompability with hadoop 3.4.1.
  resolutionStrategy.eachDependency { details ->
    if (details.requested.group.startsWith('org.eclipse.jetty')) {
      details.useVersion('9.4.57.v20241219')
    }
  }

  // Pin logback to 1.5.27 to resolve CVE-2026-1225
  resolutionStrategy.force "ch.qos.logback:logback-classic:1.5.27"
  resolutionStrategy.force "ch.qos.logback:logback-core:1.5.27"

  // Pin zookeeper to 3.8.6 to fix CVE in transitive 3.8.4 from hadoop/hbase
  resolutionStrategy.force 'org.apache.zookeeper:zookeeper:3.8.6'

  // Pin nimbus-jose-jwt to 9.37.4 to fix CVE-2025-53864 (transitive via hadoop-auth)
  resolutionStrategy.force 'com.nimbusds:nimbus-jose-jwt:9.37.4'

  // [iceberg]
  // TODO(https://github.com/apache/beam/issues/38515):
  //  Remove below pins when parquet-hadoop upgrades to hadoop-common:3.4.2
  resolutionStrategy.force 'org.apache.hadoop:hadoop-common:3.3.6'
  resolutionStrategy.force 'org.apache.hadoop:hadoop-client:3.3.6'
  resolutionStrategy.force 'org.apache.hadoop:hadoop-hdfs:3.3.6'
  resolutionStrategy.force 'org.apache.hadoop:hadoop-hdfs-client:3.3.6'
}

shadowJar {
  manifest {
    attributes(["Multi-Release": true])
  }
  mergeServiceFiles()
}

description = "Apache Beam :: SDKs :: Java :: IO :: Expansion Service"
ext.summary = "Expansion service serving several Java IOs"

dependencies {
  implementation project(":sdks:java:expansion-service")
  permitUnusedDeclared project(":sdks:java:expansion-service") // BEAM-11761
  implementation project(":sdks:java:managed")
  permitUnusedDeclared project(":sdks:java:managed") // BEAM-11761
  implementation project(":sdks:java:io:kafka")
  permitUnusedDeclared project(":sdks:java:io:kafka") // BEAM-11761
  implementation project(":sdks:java:io:kafka:upgrade")
  permitUnusedDeclared project(":sdks:java:io:kafka:upgrade") // BEAM-11761
  implementation project(":sdks:java:extensions:kafka-factories")
  permitUnusedDeclared project(":sdks:java:extensions:kafka-factories")
  runtimeOnly project(":sdks:java:io:amazon-web-services2") // FileSystem may be used by Iceberg AddFiles

  runtimeOnly project(":sdks:java:io:iceberg")
  runtimeOnly project(":sdks:java:io:iceberg:hive")
  runtimeOnly project(path: ":sdks:java:io:iceberg:bqms", configuration: "shadow")
  runtimeOnly library.java.bigdataoss_util_hadoop

  runtimeOnly project(":sdks:java:io:datadog")
  runtimeOnly project(":sdks:java:io:mongodb")
  runtimeOnly library.java.kafka_clients
  runtimeOnly library.java.slf4j_jdk14

  // Force log4j-core version in shadow jar to fix CVE-2026-34477 in the shaded jar
  // `org.apache.beam:beam-sdks-java-io-expansion-service`
  // Currently, it has a transitive dependency of `org.apache.iceberg:iceberg-aws-bundle:1.10.0`,
  // which includes a vulnerable log4j-core (2.20.0).
  runtimeOnly library.java.log4j2_core
}

task runExpansionService (type: JavaExec) {
  mainClass = "org.apache.beam.sdk.expansion.service.ExpansionService"
  classpath = sourceSets.test.runtimeClasspath
  args = [project.findProperty("constructionService.port") ?: "8097"]
}