<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>com.assisi</groupId>
    <artifactId>assisi-service-parent</artifactId>
    <!-- 1.0.3, the version both shipped services already pin. assisi-outbox still sits on
         1.0.0; there is no reason for a brand-new library to start on a stale parent. -->
    <version>1.0.3</version>
    <relativePath/>
  </parent>

  <artifactId>assisi-authz-core</artifactId>
  <version>1.0.0</version>
  <packaging>jar</packaging>

  <description>
    Shared permission EVALUATION for assisi (CONVENTIONS Appendix L). Ships the evaluator,
    its Valkey read path, the @RequiresPermission annotation and its interceptor, and a
    shared audit-actor utility.

    Exists so the Gateway and every backend service answer "does this caller hold this
    permission" IDENTICALLY. Two independent implementations of that question is a security
    defect waiting to happen: the Gateway allows a call the service would have denied, or the
    reverse, and the difference is invisible until it is exploited.

    Ships NO policy definitions, NO database, and NO entities.
  </description>

  <!-- Resolves the parent from the org-level Forgejo Maven registry. 01-06 verified this block
       in the POM being resolved IS sufficient for that POM's own parent, and the registry reads
       anonymously, so no credential and no settings.xml entry is needed.
       NOTE (03-01): the registry is UNREACHABLE at authoring time — the Forgejo host has been
       down since 2026-09-02. The parent resolves from the local ~/.m2 cache instead. This block
       is correct and will work when the host returns; it is not evidence that it was used. -->
  <repositories>
    <repository>
      <id>forgejo</id>
      <url>https://git.databasedetective.pro/api/packages/database-detective/maven</url>
    </repository>
  </repositories>

  <distributionManagement>
    <repository>
      <id>forgejo</id>
      <url>https://git.databasedetective.pro/api/packages/database-detective/maven</url>
    </repository>
  </distributionManagement>

  <dependencies>
    <!-- Valkey access, exactly what both existing services declare. Versionless: the parent's
         Boot BOM manages both. -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-data-redis</artifactId>
    </dependency>

    <!-- AOP for the @RequiresPermission interceptor. Boot 4 renamed this from
         spring-boot-starter-aop to spring-boot-starter-aspectj; the old name is unmanaged by the
         BOM and fails the build with a missing-version error. Declared in Task 1 even though Task 2
         is what uses it, so Task 2 introduces no new dependency. -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-aspectj</artifactId>
    </dependency>

    <!-- Autoconfiguration metadata only; no starter, no transitive web stack. -->
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-autoconfigure</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>

    <!-- Testcontainers CORE plus a plain GenericContainer against valkey/valkey:9.1.
         NOT testcontainers-redis or com.redis:testcontainers-redis — both are wrong for
         Valkey, as auth-service's own pom comment already documents. -->
    <dependency>
      <groupId>org.testcontainers</groupId>
      <artifactId>testcontainers-junit-jupiter</artifactId>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>com.tngtech.archunit</groupId>
      <artifactId>archunit-junit5</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>
</project>
