build.gradle

/*
 * SPDX-License-Identifier: Apache-2.0
 *
 * The OpenSearch Contributors require contributions made to
 * this file be licensed under the Apache-2.0 license or a
 * compatible open source license.
 *
 * Modifications Copyright OpenSearch Contributors. See
 * GitHub history for details.
 */


import com.diffplug.gradle.spotless.JavaExtension
import org.opensearch.gradle.info.FipsBuildParams
import org.opensearch.gradle.test.RestIntegTestTask
import groovy.json.JsonBuilder

buildscript {
    ext {
        opensearch_version = System.getProperty("opensearch.version", "3.8.0-SNAPSHOT")
        isSnapshot = "true" == System.getProperty("build.snapshot", "true")
        buildVersionQualifier = System.getProperty("build.version_qualifier", "")

        // 2.0.0-rc1-SNAPSHOT -> 2.0.0.0-rc1-SNAPSHOT
        version_tokens = opensearch_version.tokenize('-')
        opensearch_build = version_tokens[0] + '.0'

        common_utils_version = System.getProperty("common_utils.version", '3.2.0.0')

        kafka_version = '4.3.1'

        if (buildVersionQualifier) {
            opensearch_build += "-${buildVersionQualifier}"
        }
        if (isSnapshot) {
            opensearch_build += "-SNAPSHOT"
        }
    }

    repositories {
        mavenLocal()
        maven { url = "https://ci.opensearch.org/maven2/" }
        mavenCentral()
        maven { url = "https://plugins.gradle.org/m2/" }
        maven { url = "https://ci.opensearch.org/ci/dbc/snapshots/maven/" }
        maven { url = "https://artifacts.opensearch.org/snapshots/lucene/" }
        maven { url = "https://build.shibboleth.net/nexus/content/groups/public" }
    }

    dependencies {
        classpath "org.opensearch.gradle:build-tools:${opensearch_version}"
    }
}

plugins {
    id 'java'
    id 'idea'
    id 'jacoco'
    id 'maven-publish'
    id 'com.diffplug.spotless' version '6.25.0'
    id 'checkstyle'
    id 'com.netflix.nebula.ospackage' version "11.11.2"
    id "org.gradle.test-retry" version "1.6.5"
    id 'eclipse'
    id "com.github.spotbugs" version "6.5.9"
    id "com.google.osdetector" version "1.7.3"
}

allprojects {
    group = "org.opensearch"
    version = opensearch_build
}

apply plugin: 'opensearch.opensearchplugin'
apply plugin: 'opensearch.pluginzip'
apply plugin: 'opensearch.rest-test'
apply plugin: 'opensearch.testclusters'
apply from: 'gradle/formatting.gradle'

licenseFile = rootProject.file('LICENSE.txt')
noticeFile = rootProject.file('NOTICE.txt')

spotbugs {
    includeFilter = file('spotbugs-include.xml')
}

spotbugsTest {
    enabled = false
}

java.sourceCompatibility = JavaVersion.VERSION_21
java.targetCompatibility = JavaVersion.VERSION_21


compileJava {
    options.compilerArgs = [
            '-Xlint:auxiliaryclass',
            '-Xlint:cast',
            '-Xlint:classfile',
            '-Xlint:dep-ann',
            '-Xlint:divzero',
            '-Xlint:empty',
            '-Xlint:exports',
            '-Xlint:fallthrough',
            '-Xlint:finally',
            '-Xlint:module',
            '-Xlint:opens',
            '-Xlint:overloads',
            '-Xlint:overrides',
            '-Xlint:-processing',
            '-Xlint:rawtypes',
            '-Xlint:removal',
            '-Xlint:requires-automatic',
            '-Xlint:requires-transitive-automatic',
            '-Xlint:static',
            '-Xlint:unchecked',
            '-Xlint:varargs',
            '-Xlint:preview',
            '-Werror']
    options.encoding = 'UTF-8'
}

compileTestJava {
    options.compilerArgs = [
            '-Xlint:auxiliaryclass',
            '-Xlint:cast',
            '-Xlint:classfile',
            '-Xlint:dep-ann',
            '-Xlint:divzero',
            '-Xlint:empty',
            '-Xlint:exports',
            '-Xlint:fallthrough',
            '-Xlint:finally',
            '-Xlint:module',
            '-Xlint:opens',
            '-Xlint:overloads',
            '-Xlint:overrides',
            '-Xlint:-processing',
            '-Xlint:rawtypes',
            '-Xlint:removal',
            '-Xlint:requires-automatic',
            '-Xlint:requires-transitive-automatic',
            '-Xlint:static',
            '-Xlint:unchecked',
            '-Xlint:varargs',
            '-Xlint:preview',
            '-Werror']
    options.encoding = 'UTF-8'
}


licenseHeaders.enabled = true

// The following check that have never be enabled in security
dependencyLicenses.enabled = false
thirdPartyAudit.enabled = false
loggerUsageCheck.enabled = false
forbiddenApisMain.enabled = false
forbiddenApisTest.enabled = false
filepermissions.enabled = false
forbiddenPatterns.enabled = false
testingConventions.enabled = false
jarHell.enabled = true
tasks.whenTaskAdded { task ->
    if (task.name.contains("forbiddenApisIntegrationTest")) {
        task.enabled = false
    }
}

def splitTestConfig = [
        ciSecurityIntegrationTest: [
                description: "Runs integration tests from all classes.",
                filters    : [
                        includeTestsMatching: [
                                "org.opensearch.security.*Integ*"
                        ],
                        excludeTestsMatching: [
                                "org.opensearch.security.sanity.tests.*"
                        ]
                ]
        ],
        crossClusterTest         : [
                description: "Runs cross-cluster tests.",
                filters    : [
                        includeTestsMatching: [
                                "org.opensearch.security.ccstest.*"
                        ]
                ]
        ],
        dlicDlsflsTest           : [
                description: "Runs Document- and Field-Level Security tests.",
                filters    : [
                        includeTestsMatching: [
                                "org.opensearch.security.dlic.dlsfls.*"
                        ]
                ]
        ],
        dlicRestApiTest          : [
                description: "Runs REST Management API tests.",
                filters    : [
                        includeTestsMatching: [
                                "org.opensearch.security.dlic.rest.*"
                        ]
                ]
        ],
        indicesTest              : [
                description: "Runs indices tests from all classes.",
                filters    : [
                        includeTestsMatching: [
                                "org.opensearch.security.*indices*"
                        ],
                        excludeTestsMatching: [
                                "org.opensearch.security.sanity.tests.*"
                        ]
                ]
        ],
        sslTest                  : [
                description: "Runs most of the SSL tests.",
                filters    : [
                        includeTestsMatching: [
                                "org.opensearch.security.ssl.*"
                        ]
                ]
        ]
] as ConfigObject

List<String> taskNames = splitTestConfig.keySet() as List

tasks.register("listTasksAsJSON") {
    // We are using `doLast` to explicitly specify when we
    // want this action to be started. Without it the output
    // is not shown at all or can be mixed with other outputs.
    doLast {
        System.out.println(new JsonBuilder(["citest"] + taskNames))
    }
}

tasks.register('copyExtraTestResources', Copy) {
    dependsOn testClasses

    into "build/testrun" // base dir for all `into` below

    from("src/test/resources") {
        into("test/src/test/resources")
    }

    taskNames.each { testName ->
        from("src/test/resources") {
            into("${testName}/src/test/resources")
        }
    }

    from("src/test/resources") {
        into "citest/src/test/resources"
    }
}

def setCommonTestConfig(Test task) {
    task.testClassesDirs = sourceSets.test.output.classesDirs
    task.classpath = sourceSets.test.runtimeClasspath

    task.maxParallelForks = 8
    task.jvmArgs += "-Xmx3072m"
    // this is needed to reflect access system env map.
    task.jvmArgs += "--add-opens=java.base/java.io=ALL-UNNAMED"
    task.jvmArgs += "--add-opens=java.base/java.util=ALL-UNNAMED"
    task.retry {
        failOnPassedAfterRetry = false
        maxRetries = 5
    }
    task.jacoco {
        excludes = [
                "com.sun.jndi.dns.*",
                "com.sun.security.sasl.gsskerb.*",
                "java.sql.*",
                "javax.script.*",
                "org.jcp.xml.dsig.internal.dom.*",
                "sun.nio.cs.ext.*",
                "sun.security.ec.*",
                "sun.security.jgss.*",
                "sun.security.pkcs11.*",
                "sun.security.smartcardio.*",
                "sun.util.resources.provider.*"
        ]
    }
    task.dependsOn copyExtraTestResources
    task.finalizedBy jacocoTestReport
}

test {
    include '**/*.class'
    filter {
        excludeTestsMatching "org.opensearch.security.sanity.tests.*"
    }
    maxParallelForks = 8
    jvmArgs += "-Xmx3072m"
    // this is needed to reflect access system env map.
    jvmArgs += "--add-opens=java.base/java.io=ALL-UNNAMED"
    jvmArgs += "--add-opens=java.base/java.util=ALL-UNNAMED"
    retry {
        failOnPassedAfterRetry = false
        maxRetries = 5
    }
    jacoco {
        excludes = [
                "com.sun.jndi.dns.*",
                "com.sun.security.sasl.gsskerb.*",
                "java.sql.*",
                "javax.script.*",
                "org.jcp.xml.dsig.internal.dom.*",
                "sun.nio.cs.ext.*",
                "sun.security.ec.*",
                "sun.security.jgss.*",
                "sun.security.pkcs11.*",
                "sun.security.smartcardio.*",
                "sun.util.resources.provider.*"
        ]
    }
    setCommonTestConfig(it)
}

tasks.register("citest", Test) {
    group = "Github Actions tests"
    description = "Runs the test suite on classes not covered by rest of the task in this group."
    include '**/*.class'
    filter {
        excludeTestsMatching "org.opensearch.security.sanity.tests.*"
        splitTestConfig.each { entry ->
            entry.value.filters.each { test ->
                if (test.key == "includeTestsMatching") {
                    test.value.each {
                        excludeTestsMatching "${it}"
                    }
                } else if (test.key == "includeTest") {
                    test.value.each {
                        excludeTest "${it}"
                    }
                }
            }
        }
    }
    setCommonTestConfig(it)
}

splitTestConfig.each { testName, testCfg ->
    tasks.register("${testName}", Test) {
        group = testCfg.group ?: "Github Actions tests"
        description = testCfg.description
        include testCfg.include ?: '**/*.class'
        filter {
            testCfg.filters.each { filter, values ->
                values.each { value ->
                    "${filter}" "${value}"
                }
            }
        }
        setCommonTestConfig(it)
    }
}

tasks.test.dependsOn(copyExtraTestResources)

jacoco {
    reportsDirectory = file("$buildDir/reports/jacoco")
}

jacocoTestReport {
    getExecutionData().setFrom(fileTree(buildDir).include("/jacoco/*.exec"))
    reports {
        xml.required = true
    }
}

checkstyle {
    toolVersion = "11.0.0"
    showViolations = true
    configDirectory.set(rootProject.file("checkstyle/"))
}

tasks.withType(Checkstyle) {
    dependsOn(':precommit')
    reports {
        ignoreFailures = false
    }
}


opensearchplugin {
    name = 'opensearch-security'
    description = 'Provide access control related features for OpenSearch'
    classname = 'org.opensearch.security.OpenSearchSecurityPlugin'
    extendedPlugins = ['rule-framework', 'workload-management;optional=true', 'transport-grpc;optional=true']
}

publishing {
    publications {
        pluginZip(MavenPublication) { publication ->
            pom {
                name = "opensearch-security"
                description = "Provide access control related features for OpenSearch"
                groupId = "org.opensearch.plugin"
                licenses {
                    license {
                        name = "The Apache License, Version 2.0"
                        url = "http://www.apache.org/licenses/LICENSE-2.0.txt"
                    }
                }
                developers {
                    developer {
                        name = "OpenSearch"
                        url = "https://github.com/opensearch-project/security"
                    }
                }
            }
        }
    }
    repositories {
        maven {
            name = "Snapshots" //  optional target repository name
            url = System.getenv("MAVEN_SNAPSHOTS_S3_REPO")
            credentials(AwsCredentials) {
                accessKey = System.getenv("AWS_ACCESS_KEY_ID")
                secretKey = System.getenv("AWS_SECRET_ACCESS_KEY")
                sessionToken = System.getenv("AWS_SESSION_TOKEN")
            }
        }
    }
}


tasks.test.finalizedBy(jacocoTestReport)  // report is always generated after tests run

allprojects {
    tasks.withType(Javadoc).all { enabled = false }
}

bundlePlugin {
    from('plugin-security.policy')
    from('config') {
        into 'config'
    }
    from('tools') {
        into 'tools'
    }
}

//create source set 'integrationTest'
//add classes from the main source set to the compilation and runtime classpaths of the integrationTest
sourceSets {
    integrationTest {
        java {
            srcDir file('src/integrationTest/java')
            compileClasspath += sourceSets.main.output
            runtimeClasspath += sourceSets.main.output
        }
        resources {
            srcDir file('src/integrationTest/resources')
        }
        processIntegrationTestResources {
            duplicatesStrategy = DuplicatesStrategy.INCLUDE
        }
    }
}

configurations {
    integrationTestImplementation.extendsFrom implementation
    integrationTestRuntimeOnly.extendsFrom runtimeOnly
}

configurations {
    all {
        resolutionStrategy {
            force 'commons-codec:commons-codec:1.22.0'
            force 'commons-logging:commons-logging:1.4.0'
            force 'org.slf4j:slf4j-api:1.7.36'
            force 'org.scala-lang:scala-library:2.13.18'
            force "tools.jackson:jackson-bom:${versions.jackson3}"
            force "tools.jackson.core:jackson-core:${versions.jackson3}"
            force "tools.jackson.datatype:jackson-datatype-jdk8:${versions.jackson3}"
            force "tools.jackson.core:jackson-databind:${versions.jackson3_databind}"
            // Keeping Jackson 2.x since Kafka clients and etc still need it
            force "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
            force "com.fasterxml.jackson.datatype:jackson-datatype-jdk8:${versions.jackson}"
            force "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
            force "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
            force "io.netty:netty-buffer:${versions.netty}"
            force "io.netty:netty-codec-base:${versions.netty}"
            force "io.netty:netty-codec-http:${versions.netty}"
            force "io.netty:netty-codec-http2:${versions.netty}"
            force "io.netty:netty-codec-http3:${versions.netty}"
            force "io.netty:netty-codec-native-quic:${versions.netty}"
            force "io.netty:netty-codec-classes-quic:${versions.netty}"
            force "io.netty:netty-common:${versions.netty}"
            force "io.netty:netty-handler:${versions.netty}"
            force "io.netty:netty-resolver:${versions.netty}"
            force "io.netty:netty-transport:${versions.netty}"
            force "io.netty:netty-transport-native-unix-common:${versions.netty}"
            force "com.github.luben:zstd-jni:${versions.zstd}"
            force libs.google.guava
            force libs.lz4.java
            force libs.snappy.java

            // for spotbugs dependency conflict
            force "org.apache.commons:commons-lang3:${versions.commonslang}"
            force "org.apache.logging.log4j:log4j-api:${versions.log4j}"
            force "org.apache.logging.log4j:log4j-core:${versions.log4j}"

            // for spotless transitive dependency CVE
            force "org.eclipse.platform:org.eclipse.core.runtime:3.34.200"
            force "org.eclipse.platform:org.eclipse.equinox.common:3.20.400"
            force "org.apache.httpcomponents.client5:httpclient5:${versions.httpclient5}"
            force "org.apache.httpcomponents.core5:httpcore5:${versions.httpcore5}"
            force "org.apache.httpcomponents.core5:httpcore5-h2:${versions.httpcore5}"
            force "org.codehaus.plexus:plexus-utils:3.6.1"

            // For integrationTest
            force "org.apache.httpcomponents:httpclient:4.5.14"
            force "org.apache.httpcomponents:httpcore:4.4.16"
            force "com.google.errorprone:error_prone_annotations:${versions.error_prone_annotations}"
            force "org.checkerframework:checker-qual:3.55.1"
            force "ch.qos.logback:logback-classic:1.5.38"
            force "commons-io:commons-io:2.22.0"
            force "com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.9.1"
            force "org.hamcrest:hamcrest:2.2"
            force "org.mockito:mockito-core:5.23.0"
            force "net.bytebuddy:byte-buddy:1.18.11"
            force "org.ow2.asm:asm:${versions.asm}"

            // For org.opensearch.plugin:transport-grpc
            force "com.google.guava:failureaccess:1.0.3"
            force "org.scala-lang:scala3-library_3:3.8.4"
        }
    }
}

subprojects {
    plugins.withId('java') {
        dependencies {
            testImplementation 'org.hamcrest:hamcrest:2.2'
            testImplementation 'junit:junit:4.13.2'
            testImplementation "org.opensearch:opensearch:${opensearch_version}"
            testImplementation "org.mockito:mockito-core:5.23.0"
        }

        afterEvaluate {
            if (project.configurations.findByName('integrationTestImplementation')) {
                configurations.integrationTestImplementation.extendsFrom configurations.implementation
                configurations.integrationTestRuntimeOnly.extendsFrom configurations.runtimeOnly
            }
        }
    }
}

allprojects {
    repositories {
        mavenLocal()
        maven { url = "https://ci.opensearch.org/maven2/" }
        mavenCentral()
        maven { url = "https://plugins.gradle.org/m2/" }
        maven { url = "https://ci.opensearch.org/ci/dbc/snapshots/maven/" }
        maven { url = "https://artifacts.opensearch.org/snapshots/lucene/" }
        maven { url = "https://build.shibboleth.net/nexus/content/repositories/releases" }
        maven { url = "build.shibboleth.net/maven/releases" }
    }

    afterEvaluate {
        if (project.configurations.findByName('integrationTestImplementation')) {
            dependencies {
                integrationTestImplementation 'junit:junit:4.13.2'
                integrationTestImplementation("org.opensearch.plugin:reindex-client:${opensearch_version}") {
                    exclude(group: 'org.slf4j', module: 'slf4j-api')
                }
                integrationTestImplementation "org.opensearch:protobufs:${versions.opensearchprotobufs}"
                integrationTestImplementation "io.grpc:grpc-stub:${versions.grpc}"
                integrationTestImplementation "io.grpc:grpc-netty-shaded:${versions.grpc}"
                integrationTestImplementation "org.opensearch.plugin:transport-grpc:${opensearch_version}"
                integrationTestImplementation "org.opensearch.plugin:percolator-client:${opensearch_version}"
                integrationTestImplementation 'commons-io:commons-io:2.22.0'
                integrationTestImplementation "org.apache.logging.log4j:log4j-core:${versions.log4j}"
                integrationTestImplementation "org.apache.logging.log4j:log4j-jul:${versions.log4j}"
                integrationTestImplementation 'org.hamcrest:hamcrest:2.2'
                integrationTestImplementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
                integrationTestImplementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}"
                integrationTestImplementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"
                integrationTestImplementation('org.awaitility:awaitility:4.3.0') {
                    exclude(group: 'org.hamcrest', module: 'hamcrest')
                }
                integrationTestImplementation 'com.unboundid:unboundid-ldapsdk:4.0.14'
                integrationTestImplementation "org.opensearch.plugin:mapper-size:${opensearch_version}"
                integrationTestImplementation "org.apache.httpcomponents:httpclient-cache:4.5.14"
                integrationTestImplementation "org.apache.httpcomponents:httpclient:4.5.14"
                integrationTestImplementation "org.apache.httpcomponents:fluent-hc:4.5.14"
                integrationTestImplementation "org.apache.httpcomponents:httpcore:4.4.16"
                integrationTestImplementation "org.apache.httpcomponents:httpasyncclient:4.1.5"
                integrationTestImplementation "org.mockito:mockito-core:5.23.0"
                integrationTestImplementation "org.opensearch:opensearch:${opensearch_version}"
                integrationTestImplementation "org.opensearch.plugin:transport-netty4-client:${opensearch_version}"
                integrationTestImplementation "org.opensearch.plugin:aggs-matrix-stats-client:${opensearch_version}"
                integrationTestImplementation "org.opensearch.plugin:parent-join-client:${opensearch_version}"
                integrationTestImplementation "com.password4j:password4j:${versions.password4j}"
                integrationTestImplementation libs.google.guava
                integrationTestImplementation "org.apache.commons:commons-lang3:${versions.commonslang}"
                integrationTestImplementation "tools.jackson.core:jackson-databind:${versions.jackson3_databind}"
                integrationTestImplementation 'org.greenrobot:eventbus-java:3.3.1'
                integrationTestImplementation "org.apache.commons:commons-collections4:${versions.commonscollections4}"
                integrationTestImplementation('io.github.vishwakarma:zjsonpatch:0.6.2') {
                    exclude(group: 'com.fasterxml.jackson.core')
                    exclude(group: 'org.apache.commons', module: 'commons-collections4')
                }
                integrationTestImplementation 'org.slf4j:slf4j-api:2.0.12'
                integrationTestImplementation 'com.selectivem.collections:special-collections-complete:1.4.0'

                integrationTestImplementation('com.jayway.jsonpath:json-path:2.10.0') {
                    exclude(group: 'net.minidev', module: 'json-smart')
                }
                integrationTestImplementation "io.projectreactor.netty:reactor-netty-core:${versions.reactor_netty}"
                integrationTestImplementation "io.projectreactor.netty:reactor-netty-http:${versions.reactor_netty}"
            }
        }
    }
}

//add new task that runs integration tests
tasks.register("integrationTest", Test) {
    filter {
        excludeTestsMatching 'org.opensearch.sample.*Resource*'
    }
    doFirst {
        // Only run resources tests on resource-test CI environments or locally
        if (System.getenv('CI_ENVIRONMENT') != 'resource-test' && System.getenv('CI_ENVIRONMENT') != null) {
            exclude '**/ResourceFocusedTests.class'
        }
        if (System.getenv('DISABLE_RETRY') != 'true') {
            retry {
                failOnPassedAfterRetry = false
                maxRetries = 2
                maxFailures = 10
            }
        }
    }
    description = 'Run integration tests.'
    group = 'verification'
    systemProperty "java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager"
    testClassesDirs = sourceSets.integrationTest.output.classesDirs
    classpath = sourceSets.integrationTest.runtimeClasspath
    //run the integrationTest task after the test task
    shouldRunAfter test
    jacoco {
        excludes = [
                "com.sun.jndi.dns.*",
                "com.sun.security.sasl.gsskerb.*",
                "java.sql.*",
                "javax.script.*",
                "org.jcp.xml.dsig.internal.dom.*",
                "sun.nio.cs.ext.*",
                "sun.security.ec.*",
                "sun.security.jgss.*",
                "sun.security.pkcs11.*",
                "sun.security.smartcardio.*",
                "sun.util.resources.provider.*"
        ]
    }
}

tasks.named("integrationTest") {
    minHeapSize = "512m"
    maxHeapSize = "2g"
}

tasks.integrationTest.finalizedBy(jacocoTestReport) // report is always generated after integration tests run

//run the integrationTest task before the check task
check.dependsOn integrationTest


dependencies {
    implementation project(path: ":${rootProject.name}-spi", configuration: 'shadow')
    implementation "org.opensearch.plugin:transport-netty4-client:${opensearch_version}"
    implementation "org.opensearch.client:opensearch-rest-high-level-client:${opensearch_version}"
    implementation "org.apache.httpcomponents.client5:httpclient5-cache:${versions.httpclient5}"
    implementation "org.apache.httpcomponents:httpclient:${versions.httpclient}"
    implementation "org.apache.httpcomponents:httpcore:${versions.httpcore}"
    implementation "org.apache.httpcomponents:httpasyncclient:${versions.httpasyncclient}"
    implementation libs.google.guava
    implementation 'org.greenrobot:eventbus-java:3.3.1'
    implementation 'commons-cli:commons-cli:1.11.0'
    // When building with crypto.standard=FIPS-140-3 (set in gradle.properties), bcFips jars are provided by OpenSearch
    if (FipsBuildParams.isInFipsMode()) {
        compileOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
        compileOnly "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}"
        compileOnly "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"
    } else {
        implementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
        implementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}"
        implementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"
    }
    implementation 'org.ldaptive:ldaptive:1.2.3'
    implementation 'com.nimbusds:nimbus-jose-jwt:10.9.1'
    implementation 'com.rfksystems:blake2b:2.0.0'
    implementation "com.password4j:password4j:${versions.password4j}"
    implementation "com.github.seancfoley:ipaddress:5.6.2"
    compileOnly "org.opensearch.plugin:workload-management-wlm-spi:${opensearch_version}"
    compileOnly "org.opensearch.plugin:autotagging-commons-spi:${opensearch_version}"
    compileOnly "org.opensearch.plugin:transport-grpc-spi:${opensearch_version}"
    compileOnly "io.grpc:grpc-api:${versions.grpc}"

    // Action privileges: check tables and compact collections
    implementation 'com.selectivem.collections:special-collections-complete:1.4.0'

    //JWT
    implementation libs.bundles.jjwt
    implementation "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
    implementation "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"

    // JSON patch
    implementation 'io.github.vishwakarma:zjsonpatch:0.6.2'
    implementation "org.apache.commons:commons-collections4:${versions.commonscollections4}"

    implementation "org.apache.kafka:kafka-clients:${kafka_version}"

    runtimeOnly 'net.minidev:accessors-smart:2.6.0'

    runtimeOnly 'com.sun.activation:jakarta.activation:1.2.2'
    runtimeOnly 'com.eclipsesource.minimal-json:minimal-json:0.9.5'
    runtimeOnly 'commons-codec:commons-codec:1.22.0'
    runtimeOnly 'org.cryptacular:cryptacular:1.3.0'
    compileOnly "com.google.errorprone:error_prone_annotations:${versions.error_prone_annotations}"
    runtimeOnly 'com.sun.istack:istack-commons-runtime:4.2.0'
    runtimeOnly 'jakarta.xml.bind:jakarta.xml.bind-api:4.0.5'
    runtimeOnly "org.ow2.asm:asm:${versions.asm}"

    testImplementation 'org.apache.camel:camel-xmlsecurity:3.22.4'

    //Onelogin OpenSaml
    implementation libs.bundles.onelogin.saml
    //OpenSAML
    runtimeOnly "io.dropwizard.metrics:metrics-core:4.2.39"
    implementation project(path: ':libs:opensaml', configuration: 'shadow')

    implementation "com.nulab-inc:zxcvbn:1.9.0"

    implementation 'org.apache.commons:commons-text:1.15.0'

    compileOnly 'com.google.code.findbugs:jsr305:3.0.2'

    runtimeOnly libs.bundles.archivers

    runtimeOnly 'org.slf4j:slf4j-api:1.7.36'

    runtimeOnly libs.bundles.jaxb

    runtimeOnly "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
    runtimeOnly 'org.codehaus.woodstox:stax2-api:4.3.0'
    runtimeOnly 'com.fasterxml.woodstox:woodstox-core:6.7.0'
    runtimeOnly 'org.apache.ws.xmlschema:xmlschema-core:2.3.2'
    runtimeOnly 'org.apache.santuario:xmlsec:2.3.5'
    runtimeOnly "com.github.luben:zstd-jni:${versions.zstd}"
    testRuntimeOnly 'com.google.guava:failureaccess:1.0.3'
    testRuntimeOnly 'org.checkerframework:checker-qual:3.55.1'


    testImplementation libs.opensaml.messaging.impl

    testImplementation "jakarta.servlet:jakarta.servlet-api:6.1.0"
    implementation "org.apache.commons:commons-lang3:${versions.commonslang}"
    testImplementation "org.opensearch:common-utils:${common_utils_version}"
    testImplementation "org.opensearch.plugin:reindex-client:${opensearch_version}"
    testImplementation "org.opensearch:opensearch-ssl-config:${opensearch_version}"
    testImplementation "org.opensearch.plugin:percolator-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:lang-mustache-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:parent-join-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:aggs-matrix-stats-client:${opensearch_version}"
    testImplementation "org.opensearch.plugin:search-pipeline-common:${opensearch_version}"
    testImplementation "org.apache.logging.log4j:log4j-core:${versions.log4j}"
    testImplementation 'com.unboundid:unboundid-ldapsdk:4.0.14'
    testImplementation 'com.github.stephenc.jcip:jcip-annotations:1.0-1'
    testImplementation 'com.unboundid:unboundid-ldapsdk:4.0.14'
    testImplementation 'org.apache.httpcomponents:fluent-hc:4.5.14'
    testImplementation "org.apache.httpcomponents.client5:httpclient5-fluent:${versions.httpclient5}"
    testImplementation "com.google.re2j:re2j:1.8"
    testImplementation "org.apache.kafka:kafka_2.13:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-server:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-server-common:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-server-common:${kafka_version}:test"
    testImplementation "org.apache.kafka:kafka-group-coordinator:${kafka_version}"
    testImplementation "org.apache.kafka:kafka_2.13:${kafka_version}:test"
    testImplementation "org.apache.kafka:kafka-clients:${kafka_version}:test"
    testImplementation "org.apache.kafka:test-common:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-coordinator-common:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-group-coordinator-api:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-share-coordinator:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-test-common-runtime:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-test-common-internal-api:${kafka_version}"
    testImplementation "org.apache.kafka:kafka-transaction-coordinator:${kafka_version}"
    testImplementation 'commons-validator:commons-validator:1.10.1'
    testImplementation 'org.junit.jupiter:junit-jupiter:5.14.4'
    testImplementation 'org.junit.jupiter:junit-jupiter-api:5.14.4'
    testImplementation('org.awaitility:awaitility:4.3.0') {
        exclude(group: 'org.hamcrest', module: 'hamcrest')
    }
    testImplementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
    testImplementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}"
    testImplementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"
    // JUnit build requirement
    testCompileOnly 'org.apiguardian:apiguardian-api:1.1.2'

    testImplementation libs.springframework.beans

    testRuntimeOnly(libs.springframework.core) {
        exclude(group: 'org.springframework', module: 'spring-jcl')
    }

    testRuntimeOnly 'org.scala-lang:scala-library:2.13.18'
    testRuntimeOnly 'com.typesafe.scala-logging:scala-logging_3:3.9.6'
    testRuntimeOnly 'com.yammer.metrics:metrics-core:2.2.0'
    testRuntimeOnly "org.apache.kafka:kafka-metadata:${kafka_version}"
    testRuntimeOnly "org.apache.kafka:kafka-storage:${kafka_version}"

    implementation "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson_annotations}"
    implementation "tools.jackson.core:jackson-databind:${versions.jackson3_databind}"

    compileOnly "org.opensearch:opensearch:${opensearch_version}"

    //spotless
    implementation('com.google.googlejavaformat:google-java-format:1.35.0') {
        exclude group: 'com.google.guava'
    }
}

jar {
    from('NOTICE.txt', 'THIRD-PARTY.txt', 'LICENSE')
}

tasks.register('testsJar', Jar) {
    archiveClassifier = 'tests'
    from(sourceSets.test.output)
}

tasks.register("bundleSecurityAdminStandalone", Zip) {
    dependsOn(jar)
    archiveClassifier = 'securityadmin-standalone'
    from(configurations.runtimeClasspath) {
        into 'deps/'
    }
    from(project.jar) {
        into 'deps/'
    }
    from('tools') {
        into 'tools/'
    }
    from('config') {
        into 'deps/securityconfig'
    }
}

tasks.register("bundleSecurityAdminStandaloneTarGz", Tar) {
    dependsOn(jar)
    archiveClassifier = 'securityadmin-standalone'
    archiveExtension = 'tar.gz'
    compression = Compression.GZIP
    from(configurations.runtimeClasspath) {
        into 'deps/'
    }
    from(project.jar) {
        into 'deps/'
    }
    from('tools') {
        into 'tools/'
    }
    from('config') {
        into 'deps/securityconfig'
    }
}

buildRpm {
    arch = 'NOARCH'
    addParentDirs = false
    archiveFileName = "${packageName}-${version}.rpm"
}

buildDeb {
    arch = 'all'
    archiveFileName = "${packageName}-${version}.deb"
}

publishing {
    publications {
        maven(MavenPublication) {
            from(components.java)
            artifact(testsJar)
        }
    }
}

tasks.register("integTestRemote", RestIntegTestTask) {

    systemProperty "tests.security.manager", "false"
    systemProperty "user", System.getProperty("user")
    systemProperty "password", System.getProperty("password")
    systemProperty "https", System.getProperty("https")
    systemProperty "security.enabled", "true"

    filter {
        setIncludePatterns("org.opensearch.security.sanity.tests.*IT")
    }
}

integTestRemote.enabled = System.getProperty("tests.rest.cluster") != null

tasks.integTestRemote.finalizedBy(jacocoTestReport) // report is always generated after integration tests run

// should be updated appropriately, when we add integTests in future
integTest.enabled = false

// This is afterEvaluate because the bundlePlugin ZIP task is updated afterEvaluate and changes the ZIP name to match the plugin name
afterEvaluate {
    ospackage {
        packageName = "${name}"
        release = isSnapshot ? "0.1" : '1'
        version = "${project.version}" - "-SNAPSHOT"

        into '/usr/share/opensearch/plugins'
        from(zipTree(bundlePlugin.archiveFile)) {
            into opensearchplugin.name
        }

        user = "root"
        permissionGroup = "root"
        fileMode = 0644
        dirMode = 0755

        requires('opensearch', versions.opensearch, EQUAL)
        packager = 'Amazon'
        vendor = 'Amazon'
        os = 'LINUX'
        prefix '/usr'

        license = 'ASL-2.0'
        maintainer = 'OpenSearch <opensearch@amazon.com>'
        url = 'https://opensearch.org/downloads.html'
        summary = '''
         Security plugin for OpenSearch.
         Reference documentation can be found at https://opensearch.org/docs/latest/.
    '''.stripIndent().replace('\n', ' ').trim()
    }

    buildRpm {
        arch = 'NOARCH'
        dependsOn 'assemble'
        finalizedBy 'renameRpm'
        tasks.register("renameRpm", Copy) {
            from("$layout.buildDirectory/distributions")
            into("$layout.buildDirectory/distributions")
            rename "$archiveFileName", "${packageName}-${version}.rpm"
            doLast { delete file("$layout.buildDirectory/distributions/$archiveFileName") }
        }
    }

    buildDeb {
        arch = 'all'
        dependsOn 'assemble'
        finalizedBy 'renameDeb'
        tasks.register("renameDeb", Copy) {
            from("$layout.buildDirectory/distributions")
            into("$layout.buildDirectory/distributions")
            rename "$archiveFileName", "${packageName}-${version}.deb"
            doLast { delete file("$layout.buildDirectory/distributions/$archiveFileName") }
        }
    }

    tasks.register("buildPackages", GradleBuild) {
        tasks = ['build', 'buildRpm', 'buildDeb']
    }
}

// updateVersion: Task to auto increment to the next development iteration
tasks.register("updateVersion") {
    onlyIf { System.getProperty('newVersion') }
    doLast {
        ext.newVersion = System.getProperty('newVersion')
        println "Setting version to ${newVersion}."
        // String tokenization to support -SNAPSHOT
        ant.replaceregexp(match: opensearch_version.tokenize('-')[0], replace: newVersion.tokenize('-')[0], flags: 'g', byline: true) {
            fileset(dir: projectDir) {
                // Include the required files that needs to be updated with new Version
                include(name: "bwc-test/build.gradle")
                include(name: ".github/workflows/plugin_install.yml")
            }
        }
        ant.replaceregexp(file: 'build.gradle', match: '"opensearch.version", "\\d.*"', replace: '"opensearch.version", "' + newVersion.tokenize('-')[0] + '-SNAPSHOT"', flags: 'g', byline: true)
    }
}

run {
    useCluster project.testClusters.integTest
    testClusters.integTest.plugin(project.tasks.bundlePlugin.archiveFile)

    // Set JVM arguments for memory
    testClusters.integTest.nodes.each { node ->
        node.jvmArgs(
                '-Xms2g',  // Initial heap size
                '-Xmx2g',   // Maximum heap size
        )
    }

    // Configure security for run task
    afterEvaluate {
      testClusters.integTest.nodes.each  { node ->
        // Add certificate files
        node.extraConfigFile("kirk.pem", file("bwc-test/src/test/resources/security/kirk.pem"))
        node.extraConfigFile("kirk-key.pem", file("bwc-test/src/test/resources/security/kirk-key.pem"))
        node.extraConfigFile("esnode.pem", file("bwc-test/src/test/resources/security/esnode.pem"))
        node.extraConfigFile("esnode-key.pem", file("bwc-test/src/test/resources/security/esnode-key.pem"))
        node.extraConfigFile("root-ca.pem", file("bwc-test/src/test/resources/security/root-ca.pem"))

        // Security settings
        node.setting("plugins.security.ssl.transport.pemcert_filepath", "esnode.pem")
        node.setting("plugins.security.ssl.transport.pemkey_filepath", "esnode-key.pem")
        node.setting("plugins.security.ssl.transport.pemtrustedcas_filepath", "root-ca.pem")
        node.setting("plugins.security.ssl.transport.enforce_hostname_verification", "false")
        node.setting("plugins.security.ssl.http.enabled", "true")
        node.setting("plugins.security.ssl.http.pemcert_filepath", "esnode.pem")
        node.setting("plugins.security.ssl.http.pemkey_filepath", "esnode-key.pem")
        node.setting("plugins.security.ssl.http.pemtrustedcas_filepath", "root-ca.pem")
        node.setting("plugins.security.allow_unsafe_democertificates", "true")
        node.setting("plugins.security.allow_default_init_securityindex", "true")
        node.setting("plugins.security.authcz.admin_dn", "\n - CN=kirk,OU=client,O=client,L=test,C=de")
        node.setting("plugins.security.audit.type", "internal_opensearch")
        node.setting("plugins.security.enable_snapshot_restore_privilege", "true")
        node.setting("plugins.security.check_snapshot_restore_write_privileges", "true")
        node.setting("plugins.security.restapi.roles_enabled", "[\"all_access\", \"security_rest_api_access\"]")
        node.setting("plugins.security.system_indices.enabled", "true")

        var creds = node.getCredentials()
        if (creds.isEmpty()) {
            creds.add(Map.of('username', 'admin', 'password', 'admin'))
        } else {
            creds.get(0).putAll(Map.of('username', 'admin', 'password', 'admin'))
        }
      }
    }

    doFirst {
        // There seems to be an issue when running multi node run or integ tasks with unicast_hosts
        // not being written, the waitForAllConditions ensures it's written
        getClusters().forEach { cluster ->
            cluster.setSecure(true)
            cluster.waitForAllConditions()
        }
    }
}