Stirling-PDF/app/core/build.gradle

apply plugin: 'org.springframework.boot'

import org.apache.tools.ant.taskdefs.condition.Os

configurations {
    developmentOnly
    runtimeClasspath {
        extendsFrom developmentOnly
    }
}

spotless {
    java {
        target 'src/**/java/**/*.java'
        targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
        suppressLintsFor { setStep('google-java-format') }

        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
    }
    yaml {
        target '**/*.yml', '**/*.yaml'
        targetExclude 'src/main/resources/static/**'
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
    }
    format 'gradle', {
        target '**/gradle/*.gradle', '**/*.gradle'
        targetExclude 'src/main/resources/static/**'
        trimTrailingWhitespace()
        leadingTabsToSpaces()
        endWithNewline()
    }
}

dependencies {
    if (!gradle.ext.disableAdditional) {
        implementation project(':proprietary')
    }

    if (gradle.ext.enableSaas) {
        implementation project(':saas')
    }

    implementation project(':common')
    implementation 'org.springframework.boot:spring-boot-starter-jetty'
    implementation 'org.eclipse.jetty.http2:jetty-http2-server'
    implementation 'org.eclipse.jetty:jetty-alpn-java-server'
    implementation ('org.telegram:telegrambots:6.9.7.1') {
        // Grizzly server + Jersey JAX-RS stack: only used for webhook mode;
        // Stirling-PDF uses long-polling mode so these are dead weight (~3 MB)
        exclude group: 'org.glassfish.jersey.inject'
        exclude group: 'org.glassfish.jersey.media'
        exclude group: 'org.glassfish.jersey.containers'
        exclude group: 'org.glassfish.jersey.core'
        exclude group: 'org.glassfish.jersey.ext'
        exclude group: 'org.glassfish.grizzly'
        exclude group: 'org.glassfish.hk2'
        exclude group: 'org.glassfish.hk2.external'
        exclude group: 'org.javassist', module: 'javassist'
        // Old javax JAX-RS Jackson bindings (not needed, project uses jakarta)
        exclude group: 'com.fasterxml.jackson.jaxrs'
        exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
    }
    implementation 'commons-io:commons-io:2.22.0'
    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
    implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
    implementation 'io.micrometer:micrometer-core'
    implementation 'com.google.zxing:core:3.5.4'
    implementation "org.commonmark:commonmark:$commonmarkVersion" // https://mvnrepository.com/artifact/org.commonmark/commonmark
    implementation "org.commonmark:commonmark-ext-gfm-tables:$commonmarkVersion"

    // General PDF dependencies
    implementation "org.apache.pdfbox:preflight:$pdfboxVersion"
    implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"

    implementation 'org.verapdf:validation-model:1.28.2'
    // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
    implementation 'org.mozilla:rhino:1.9.1'

    // veraPDF still uses javax.xml.bind, not the new jakarta namespace
    implementation 'javax.xml.bind:jaxb-api:2.3.1'
    implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
    implementation 'com.sun.xml.bind:jaxb-core:4.0.7'
    implementation 'org.apache.poi:poi-ooxml:5.5.1'

    // CVE-2022-25647: Explicit gson 2.13.2 to prevent unsafe deserialization (tabula would pull 2.8.7)
    implementation 'com.google.code.gson:gson:2.13.2'
    implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
    implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
    implementation 'org.apache.poi:poi-ooxml:5.5.1'

    // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
    // Replaces batik-all which included unused codec, svggen, transcoder, script modules
    implementation 'org.apache.xmlgraphics:batik-bridge:1.19'
    // Required by TwelveMonkeys imageio-batik SPI (SVGImageReaderSpi) during ImageIO init
    runtimeOnly 'org.apache.xmlgraphics:batik-transcoder:1.19'

    // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
    implementation 'de.rototor.pdfbox:graphics2d:3.0.5'

    // TwelveMonkeys
    runtimeOnly "com.twelvemonkeys.imageio:imageio-batik:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-bmp:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-jpeg:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-tiff:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-webp:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-hdr:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-icns:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-iff:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-pcx:$imageioVersion@
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-pict:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-pnm:$imageioVersion"
    runtimeOnly "com.twelvemonkeys.imageio:imageio-psd:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-sgi:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-tga:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-thumbsdb:$imageioVersion"
    // runtimeOnly "com.twelvemonkeys.imageio:imageio-xwd:$imageioVersion"

    developmentOnly 'org.springframework.boot:spring-boot-devtools'
}

sourceSets {
    main {
        resources {
            srcDirs += ['../configs']
        }
    }
    test {
    }

}


// Disable regular jar
jar {
    enabled = false
}

// Configure and enable bootJar for this project
bootJar {
    enabled = true
    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
    zip64 = true

    // Don't include all dependencies directly like the old jar task did
    // from {
    //     configurations.runtimeClasspath.collect { it.isDirectory() ? it : zipTree(it) }
    // }

    // Exclude signature files to prevent "Invalid signature file digest" errors
    exclude 'META-INF/*.SF'
    exclude 'META-INF/*.DSA'
    exclude 'META-INF/*.RSA'
    exclude 'META-INF/*.EC'

    manifest {
        attributes(
            'Implementation-Title': 'Stirling-PDF',
            'Implementation-Version': project.version,
            'Enable-Native-Access': 'ALL-UNNAMED'
        )
    }
}

// Configure main class for Spring Boot
springBoot {
    mainClass = 'stirling.software.SPDF.SPDFApplication'
}

// Frontend build tasks - only enabled with -PbuildWithFrontend=true
def buildWithFrontend = project.hasProperty('buildWithFrontend') && project.property('buildWithFrontend') == 'true'
def buildPrototypes = project.hasProperty('prototypesMode') && project.property('prototypesMode') == 'true'
// Workspace root holds package.json and node_modules (shared across editor /
// future portal). Editor-specific paths (src, public, dist, tauri) live one
// level deeper under frontend/editor/.

// Vite mode: -PprototypesMode > -PfrontendMode > enableSaas > disableAdditional > proprietary.
def frontendModeOverride = project.findProperty('frontendMode')?.toString()?.toLowerCase()
def frontendMode
if (buildPrototypes) {
    frontendMode = 'prototypes'
} else if (frontendModeOverride) {
    frontendMode = frontendModeOverride
} else if (gradle.ext.enableSaas) {
    frontendMode = 'saas'
} else if (gradle.ext.disableAdditional) {
    frontendMode = 'core'
} else {
    frontendMode = 'proprietary'
}
def frontendBuildTask = "frontend:build:${frontendMode}"

// Workspace root holds package.json and node_modules (shared across editor /
// future portal). Editor-specific paths (src, public, dist, tauri) live one
// level deeper under frontend/editor/. When the portal lands as an embedded
// app, add a sibling frontendPortalDir / frontendPortalDistDir alongside.
def frontendDir = file('../../frontend')
def frontendEditorDir = file('../../frontend/editor')
def frontendEditorDistDir = file('../../frontend/editor/dist')
def resourcesStaticDir = file('src/main/resources/static')
def generatedFrontendPaths = [
    'assets',
    'index.html',
    'index.html.gz',
    'index.html.br',
    'sw.js',
    'sw.js.gz',
    'sw.js.br',
    'manifest.json.gz',
    'manifest.json.br',
    'site.webmanifest.gz',
    'site.webmanifest.br',
    'browserconfig.xml.gz',
    'browserconfig.xml.br',
    'manifest-classic.json',
    'manifest-classic.json.gz',
    'manifest-classic.json.br',
    'locales',
    'Login',
    'classic-logo',
    'modern-logo',
    'og_images',
    'samples',
    'pdfium',
    'vendor',
    'pdfjs'
]

tasks.register('npmInstall', Exec) {
    doNotTrackState("node_modules contains symlinks that Gradle cannot snapshot on Windows/WSL")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Install frontend dependencies'
    workingDir frontendDir
    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ? ['cmd', '/c', 'npm', 'ci', '--prefer-offline'] : ['npm', 'ci', '--prefer-offline']
    inputs.file(new File(frontendDir, 'package.json'))
    inputs.file(new File(frontendDir, 'package-lock.json'))
    outputs.dir(new File(frontendDir, 'node_modules'))

    // Show live output
    standardOutput = System.out
    errorOutput = System.err

    // Skip if node_modules exists and is up-to-date
    onlyIf {
        def nodeModules = new File(frontendDir, 'node_modules')
        if (!nodeModules.exists()) {
            println "node_modules not found, will install..."
            return true
        }

        // if required devDependency is missing, reinstall
        def iconifyPkg = new File(frontendDir, 'node_modules/@iconify-json/material-symbols/package.json')
        if (!iconifyPkg.exists()) {
            println "@iconify-json/material-symbols missing, will reinstall..."
            return true
        }

        def packageJson = new File(frontendDir, 'package.json')
        def packageLock = new File(frontendDir, 'package-lock.json')
        def isOutdated = nodeModules.lastModified() < packageJson.lastModified() ||
                        nodeModules.lastModified() < packageLock.lastModified()
        if (isOutdated) {
            println "package.json or package-lock.json changed, will reinstall..."
        } else {
            println "node_modules is up-to-date, skipping npm install"
        }
        return isOutdated
    }

    doFirst {
        println "Installing npm dependencies in ${frontendDir}..."
    }
}

tasks.register('npmBuild', Exec) {
    doNotTrackState("Frontend build depends on untracked npmInstall task")
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Build editor frontend application'
    workingDir file('../..')
    commandLine = ['task', frontendBuildTask]
    inputs.dir(new File(frontendEditorDir, 'src'))
    inputs.dir(new File(frontendEditorDir, 'public'))
    inputs.file(new File(frontendDir, 'package.json'))
    outputs.dir(frontendEditorDistDir)

    // Show live output
    standardOutput = System.out
    errorOutput = System.err

    // Override VITE_API_BASE_URL to use relative paths for production builds
    // This ensures JARs work regardless of how they're deployed (direct, proxied, etc.)
    environment 'VITE_API_BASE_URL', '/'

    doFirst {
        println "Building editor frontend application for production (mode=${frontendMode}, VITE_API_BASE_URL=/)"
    }
}

tasks.register('copyFrontendAssets', Copy) {
    enabled = buildWithFrontend
    group = 'frontend'
    description = 'Copy editor frontend build to static resources'
    dependsOn npmBuild
    dependsOn cleanFrontendAssets
    from(frontendEditorDistDir) {
        // Exclude files that conflict with backend static resources
        exclude 'robots.txt'  // Backend already has this
        exclude 'favicon.ico' // Backend already has this
    }
    into resourcesStaticDir
    duplicatesStrategy = DuplicatesStrategy.INCLUDE  // Let frontend overwrite when needed
    doFirst {
        println "Copying frontend build from ${frontendEditorDistDir} to ${resourcesStaticDir}..."
        println "Backend static resources will be preserved"
    }
    doLast {
        println "Frontend assets copied successfully!"
    }
}

tasks.register('cleanFrontendAssets', Delete) {
    group = 'frontend'
    description = 'Remove previously generated frontend assets from static resources'
    delete generatedFrontendPaths.collect { new File(resourcesStaticDir, it) }
    // Prerendered per-route SPA pages (e.g. compress.html) carry per-tool OG tags and are
    // copied from the frontend build. Remove stale ones so renamed/removed tools don't linger.
    // api-landing.html and mobile-upload.html are real backend source files, not generated artifacts.
    delete fileTree(dir: resourcesStaticDir, includes: ['*.html'], excludes: ['api-landing.html', 'mobile-upload.html'])
    // Nested prerendered route pages (e.g. settings/people.html)
    delete new File(resourcesStaticDir, 'settings')
}

tasks.register('copyApiLandingPage', Copy) {
    group = 'frontend'
    description = 'Copy API landing page to index.html for backend-only mode'
    from(new File(resourcesStaticDir, 'api-landing.html'))
    into(resourcesStaticDir)
    rename('api-landing.html', 'index.html')
    dependsOn cleanFrontendAssets
    doFirst {
        println "Copying API landing page to index.html for backend-only mode..."
    }
}

// Ensure copyFrontendAssets runs after spotless tasks
tasks.named('copyFrontendAssets').configure {
    mustRunAfter tasks.matching { it.name.startsWith('spotless') }
}

if (buildWithFrontend) {
    println "Editor frontend build enabled - JAR will include React frontend (mode=${frontendMode})"
    processResources.dependsOn copyFrontendAssets
} else {
    println "Frontend build disabled - JAR will be backend-only with API landing page"
    // When not building the UI, ensure any stale frontend assets are removed and use API landing page
    processResources.dependsOn copyApiLandingPage
}

bootJar.dependsOn ':common:jar'
if (!gradle.ext.disableAdditional) {
    bootJar.dependsOn ':proprietary:jar'
}
if (gradle.ext.enableSaas) {
    bootJar.dependsOn ':saas:jar'
}