Merge pull request #181 from catenax-ng/main

Update API documentation
eclipse-tractusx · Oct 6, 2023 · 9068817 · 9068817
2 parents 3c80da2 + ce424ee
commit 9068817
Show file tree

Hide file tree

Showing 24 changed files with 199 additions and 200 deletions.
diff --git a/.github/configs/codeql-config.yml b/.github/configs/codeql-config.yml
@@ -1,6 +1,9 @@
 name: "IRS CodeQL config"
 
-# Exclude "Unused classes and interfaces"
 query-filters:
+  # Exclude "Unused classes and interfaces"
   - exclude:
       id: java/unused-reference-type
+  # Exclude "Log Injection". This is a false positive, since IRS uses a log configuration which encodes all log messages in "irs-api/src/main/resources/log4j2.xml"
+  - exclude:
+      id: java/log-injection
diff --git a/.github/workflows/kics.yml b/.github/workflows/kics.yml
@@ -33,7 +33,7 @@ jobs:
           path: "."
           # Exclude paths or files from scan
           # full-irs is a demonstration and not intended to run in a production environment, it can be excluded
-          exclude_paths: local/deployment/docker-compose.yml,docs/src/api/irs-v1.0.yaml,local/testing/api-tests/irs-api-tests.tavern.yaml,charts/irs-environments/local/*,local/deployment/full-irs
+          exclude_paths: local/deployment/docker-compose.yml,docs/src/api/irs-api.yaml,local/testing/api-tests/irs-api-tests.tavern.yaml,charts/irs-environments/local/*,local/deployment/full-irs
           # Fail on HIGH severity results
           fail_on: high
           # when provided with a directory on output_path
@@ -51,7 +51,8 @@ jobs:
           # Exclude accepted results from the build
           exclude_results: "03df1ef13c69b0ada26fc5bbf35eabca288c5c3c93c0f5d918e41f4951ca8795,8bdf179adec9aee0035149315b63a3f8afd684076358433767758a4a9aeac922" # application-local.yml - local env minio password
           # Exclude accepted queries from the build
-          #exclude_queries: ""
+          # Exclude 8d29754a-2a18-460d-a1ba-9509f8d359da - IAM Access Analyzer Not Enabled. This is a false positive for AWS configs which are not used
+          exclude_queries: "8d29754a-2a18-460d-a1ba-9509f8d359da"
           # No secret scanning
           disable_secrets: true
 

diff --git a/.github/workflows/publish-documentation.yaml b/.github/workflows/publish-documentation.yaml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Build API documentation with Maven
         run: |
-          mvn clean package -pl irs-common,irs-models,irs-policy-store,irs-testing,irs-ess,irs-edc-client,irs-registry-client,irs-api -DskipTests --batch-mode
+          mvn clean package -pl irs-common,irs-models,irs-policy-store,irs-testing,irs-edc-client,irs-registry-client,irs-api -DskipTests --batch-mode
           cp irs-api/target/generated-sources/openapi/index.html docs/src/docs/api-specification/index.html
 
       - name: Build with Maven

diff --git a/.github/workflows/swagger-editor-validate.yml b/.github/workflows/swagger-editor-validate.yml
@@ -19,4 +19,4 @@ jobs:
       - name: Validate OpenAPI definition
         uses: char0n/swagger-editor-validate@v1
         with:
-          definition-file: docs/src/api/irs-v1.0.yaml
+          definition-file: docs/src/api/irs-api.yaml
diff --git a/DEPENDENCIES b/DEPENDENCIES
diff --git a/Dockerfile b/Dockerfile
@@ -20,7 +20,7 @@
 # * SPDX-License-Identifier: Apache-2.0
 
 # Dependencies
-FROM maven:3-openjdk-17-slim AS maven
+FROM maven:3-openjdk-18-slim AS maven
 ARG BUILD_TARGET=irs-api
 
 WORKDIR /build

diff --git a/docs/pom.xml b/docs/pom.xml
@@ -17,9 +17,9 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.source>11</maven.compiler.source>
         <maven.compiler.target>11</maven.compiler.target>
-        <asciidoctor.maven.plugin.version>2.2.2</asciidoctor.maven.plugin.version>
+        <asciidoctor.maven.plugin.version>2.2.4</asciidoctor.maven.plugin.version>
         <asciidoctorj.version>2.5.7</asciidoctorj.version>
-        <asciidoctorj.diagram.version>2.2.3</asciidoctorj.diagram.version>
+        <asciidoctorj.diagram.version>2.2.13</asciidoctorj.diagram.version>
         <jruby.version>9.4.2.0</jruby.version>
     </properties>
 

diff --git a/docs/src/api/irs-v1.0.yaml → docs/src/api/irs-api.yaml b/docs/src/api/irs-v1.0.yaml → docs/src/api/irs-api.yaml
@@ -3,7 +3,7 @@ info:
   description: The API of the Item Relationship Service (IRS) for retrieving item
     graphs along the value chain of CATENA-X partners.
   title: IRS API
-  version: "2.0"
+  version: "2.1.0"
 servers:
   - url: http://localhost:8080
 security:
@@ -2284,6 +2284,7 @@ components:
           type: array
           items:
             type: string
+            pattern: "(BPN)[LSA][\\w\\d]{10}[\\w\\d]{2}"
           maxItems: 2147483647
       required:
         - incidentBPNSs

diff --git a/irs-api/pom.xml b/irs-api/pom.xml
@@ -45,34 +45,24 @@
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio</artifactId>
-            <version>8.5.4</version>
+            <version>${minio.version}</version>
             <exclusions>
-                <exclusion>
-                    <groupId>com.fasterxml.jackson.core</groupId>
-                    <artifactId>jackson-databind</artifactId>
-                </exclusion>
                 <exclusion>
                     <groupId>org.bouncycastle</groupId>
                     <artifactId>bcprov-jdk15on</artifactId>
                 </exclusion>
             </exclusions>
         </dependency>
-        <!-- Update snappy-java manually to avoid vulnerability CVE-2023-34455; can be removed after Minio updates their dependency -->
+        <!-- Update snappy-java manually to avoid vulnerability CVE-2023-43642; can be removed after Minio updates their dependency -->
         <dependency>
             <groupId>org.xerial.snappy</groupId>
             <artifactId>snappy-java</artifactId>
-            <version>1.1.10.1</version>
-        </dependency>
-        <!-- Update jackson-databind manually to avoid vulnerability CVE-2022-42004; can be removed after Minio updates their dependency -->
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-            <version>2.14.2</version>
+            <version>1.1.10.5</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
             <artifactId>okhttp</artifactId>
-            <version>4.10.0</version>
+            <version>${okhttp.version}</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
@@ -92,13 +82,7 @@
         <dependency>
             <groupId>org.yaml</groupId>
             <artifactId>snakeyaml</artifactId>
-            <version>2.0</version>
-        </dependency>
-        <!-- Update as spring still uses older snakeyaml 1.33; can be removed with above snakeyaml override  -->
-        <dependency>
-            <groupId>com.fasterxml.jackson.dataformat</groupId>
-            <artifactId>jackson-dataformat-yaml</artifactId>
-            <version>2.14.2</version>
+            <version>${snakeyaml.version}</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
@@ -131,12 +115,6 @@
                 </exclusion>
             </exclusions>
         </dependency>
-        <!-- Update json-smart manually to avoid vulnerability CVE-2023-1370; can be removed after Spring updates their dependency -->
-        <dependency>
-            <groupId>net.minidev</groupId>
-            <artifactId>json-smart</artifactId>
-            <version>2.4.10</version>
-        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-security</artifactId>
@@ -152,12 +130,12 @@
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.11.0</version>
+            <version>${commons-io.version}</version>
         </dependency>
         <dependency>
             <groupId>org.springdoc</groupId>
             <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-            <version>2.0.2</version>
+            <version>${springdoc.version}</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
@@ -184,7 +162,7 @@
         <dependency>
             <groupId>net.jimblackler</groupId>
             <artifactId>jsonschemafriend</artifactId>
-            <version>0.12.0</version>
+            <version>${jsonschemafriend.version}</version>
             <exclusions>
                 <exclusion>
                     <groupId>org.jsoup</groupId>
@@ -195,12 +173,12 @@
         <dependency>
             <groupId>org.jsoup</groupId>
             <artifactId>jsoup</artifactId>
-            <version>1.15.4</version>
+            <version>${jsoup.version}</version>
         </dependency>
         <dependency>
             <groupId>org.graalvm.sdk</groupId>
             <artifactId>graal-sdk</artifactId>
-            <version>23.0.1</version>
+            <version>${graal-sdk.version}</version>
         </dependency>
 
         <dependency>
@@ -223,30 +201,29 @@
         <dependency>
             <groupId>org.awaitility</groupId>
             <artifactId>awaitility</artifactId>
-            <version>4.2.0</version>
+            <version>${awaitility.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
-            <groupId>io.swagger</groupId>
+            <groupId>io.swagger.core.v3</groupId>
             <artifactId>swagger-annotations</artifactId>
-            <version>1.6.8</version>
-            <scope>compile</scope>
+            <version>${swagger-annotations.version}</version>
         </dependency>
         <dependency>
             <groupId>io.github.resilience4j</groupId>
             <artifactId>resilience4j-spring-boot3</artifactId>
             <version>${resilience4j.version}</version>
         </dependency>
         <dependency>
-            <groupId>com.github.tomakehurst</groupId>
+            <groupId>org.wiremock</groupId>
             <artifactId>wiremock-standalone</artifactId>
-            <version>2.27.2</version>
+            <version>${wiremock-standalone.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>commons-validator</groupId>
             <artifactId>commons-validator</artifactId>
-            <version>1.7</version>
+            <version>${commons-validator.version}</version>
         </dependency>
     </dependencies>
 
@@ -274,15 +251,15 @@
                 <groupId>org.openapitools</groupId>
                 <artifactId>openapi-generator-maven-plugin</artifactId>
                 <!-- RELEASE_VERSION -->
-                <version>6.5.0</version>
+                <version>${openapi-generator-maven-plugin.version}</version>
                 <!-- /RELEASE_VERSION -->
                 <executions>
                     <execution>
                         <goals>
                             <goal>generate</goal>
                         </goals>
                         <configuration>
-                            <inputSpec>${project.basedir}/../docs/src/api/irs-v1.0.yaml</inputSpec>
+                            <inputSpec>${project.basedir}/../docs/src/api/irs-api.yaml</inputSpec>
                             <generatorName>html</generatorName>
                         </configuration>
                     </execution>

diff --git a/irs-api/src/main/java/org/eclipse/tractusx/irs/IrsApplication.java b/irs-api/src/main/java/org/eclipse/tractusx/irs/IrsApplication.java
@@ -55,7 +55,7 @@ public class IrsApplication {
     /**
      * The IRS API version.
      */
-    public static final String API_VERSION = "2.0";
+    public static final String API_VERSION = "2.1.0";
 
     /**
      * The URL prefix for IRS API URLs.

diff --git a/irs-api/src/test/java/org/eclipse/tractusx/irs/IrsApplicationTests.java b/irs-api/src/test/java/org/eclipse/tractusx/irs/IrsApplicationTests.java
@@ -78,7 +78,7 @@ class IrsApplicationTests {
     @Test
     void generatedOpenApiMatchesContract() throws Exception {
         final String generatedYaml = this.restTemplate.getForObject("http://localhost:" + port + "/api/api-docs.yaml", String.class);
-        final InputStream fixedYaml = Files.newInputStream(Path.of("../docs/src/api/irs-v1.0.yaml"));
+        final InputStream fixedYaml = Files.newInputStream(Path.of("../docs/src/api/irs-api.yaml"));
 
         final ObjectMapper mapper = new ObjectMapper(new YAMLFactory());
         final Map<String, Object> fixedYamlMap = mapper.readerForMapOf(Object.class).readValue(fixedYaml);

diff --git a/irs-common/pom.xml b/irs-common/pom.xml
@@ -23,17 +23,10 @@
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>
             <optional>true</optional>
-            <version>1.18.26</version>
-        </dependency>
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-            <version>2.14.2</version>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.12.0</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
@@ -67,7 +60,7 @@
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio</artifactId>
-            <version>8.5.4</version>
+            <version>${minio.version}</version>
             <exclusions>
                 <exclusion>
                     <groupId>com.fasterxml.jackson.core</groupId>
@@ -82,7 +75,7 @@
         <dependency>
             <groupId>com.squareup.okio</groupId>
             <artifactId>okio-jvm</artifactId>
-            <version>3.5.0</version>
+            <version>${okio-jvm.version}</version>
         </dependency>
 
         <dependency>

diff --git a/irs-cucumber-tests/pom.xml b/irs-cucumber-tests/pom.xml
@@ -14,23 +14,19 @@
 
     <name>IRS Cucumber</name>
 
-    <properties>
-        <cucumber.version>7.11.1</cucumber.version>
-    </properties>
-
     <dependencyManagement>
         <dependencies>
             <dependency>
                 <groupId>io.cucumber</groupId>
                 <artifactId>cucumber-bom</artifactId>
-                <version>${cucumber.version}</version>
+                <version>${cucumber-bom.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>org.junit</groupId>
                 <artifactId>junit-bom</artifactId>
-                <version>5.9.2</version>
+                <version>${junit-bom.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -90,18 +86,18 @@
         <dependency>
             <groupId>org.yaml</groupId>
             <artifactId>snakeyaml</artifactId>
-            <version>2.0</version>
+            <version>${snakeyaml.version}</version>
         </dependency>
         <dependency>
             <groupId>io.rest-assured</groupId>
             <artifactId>rest-assured</artifactId>
-            <version>5.2.1</version>
+            <version>${rest-assured.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.awaitility</groupId>
             <artifactId>awaitility</artifactId>
-            <version>4.2.0</version>
+            <version>${awaitility.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -117,7 +113,6 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.11.0</version>
                 <configuration>
                     <encoding>${project.build.sourceEncoding}</encoding>
                     <source>${maven.compiler.source}</source>
@@ -127,7 +122,6 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.0.0-M8</version>
                 <configuration>
                     <properties>
                         <configurationParameters>