Merge branch 'trunk' into OAK-11300

Author: reschke

.commit-check.yml

@@ -1,9 +1,24 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # format as outlined in https://github.com/commit-check/commit-check/blob/main/.commit-check.yml
 # further information in https://github.com/commit-check/commit-check/blob/main/README.rst
 checks:
   - check: message
-    regex: '^OAK-\d+\s\S+.*'
-    error: "The commit message must start with 'OAK-<ID> ' followed by some descriptive text"
+    regex: '^OAK-\d+:?\s\S+.*'
+    error: "The commit message must start with 'OAK-<ID>[:] ' followed by some descriptive text"
     suggest: Please check your commit message whether it matches above regex
 
   - check: author_name

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-#   ~ Licensed to the Apache Software Foundation (ASF) under one
+#  ~ Licensed to the Apache Software Foundation (ASF) under one
 #  ~ or more contributor license agreements.  See the NOTICE file
 #  ~ distributed with this work for additional information
 #  ~ regarding copyright ownership.  The ASF licenses this file
@@ -37,7 +37,7 @@ jobs:
           cache: maven
       - name: Build
         # executing ITs requires installing artifacts to the local repository
-        run: mvn -B install -Pcoverage -PintegrationTesting -Dnsfixtures=SEGMENT_TAR,DOCUMENT_NS
+        run: mvn -B install -Pcoverage,integrationTesting,javadoc -Dnsfixtures=SEGMENT_TAR,DOCUMENT_NS
       - name: Upload build result
         uses: actions/upload-artifact@v4
         with:

.github/workflows/commit-check.yml

@@ -1,3 +1,20 @@
+#  ~ Licensed to the Apache Software Foundation (ASF) under one
+#  ~ or more contributor license agreements.  See the NOTICE file
+#  ~ distributed with this work for additional information
+#  ~ regarding copyright ownership.  The ASF licenses this file
+#  ~ to you under the Apache License, Version 2.0 (the
+#  ~ "License"); you may not use this file except in compliance
+#  ~ with the License.  You may obtain a copy of the License at
+#  ~
+#  ~   http://www.apache.org/licenses/LICENSE-2.0
+#  ~
+#  ~ Unless required by applicable law or agreed to in writing,
+#  ~ software distributed under the License is distributed on an
+#  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+#  ~ KIND, either express or implied.  See the License for the
+#  ~ specific language governing permissions and limitations
+#  ~ under the License.
+
 name: Commit Check
 
 on:

.github/workflows/stale.yml

@@ -1,4 +1,4 @@
-#   ~ Licensed to the Apache Software Foundation (ASF) under one
+#  ~ Licensed to the Apache Software Foundation (ASF) under one
 #  ~ or more contributor license agreements.  See the NOTICE file
 #  ~ distributed with this work for additional information
 #  ~ regarding copyright ownership.  The ASF licenses this file

Jenkinsfile

@@ -63,7 +63,7 @@ def buildModule(moduleSpec) {
                     // clean all modules
                     sh "${MAVEN_CMD} -T 1C clean"
                     // build and install up to desired module
-                    sh "${MAVEN_CMD} -Dbaseline.skip=true -Prat -T 1C install -DskipTests -pl :${moduleName} -am"
+                    sh "${MAVEN_CMD} -Dbaseline.skip=true -T 1C install -DskipTests -pl :${moduleName} -am"
                     try {
                         sh "${MAVEN_CMD} ${testOptions} -DtrimStackTrace=false -Dnsfixtures=SEGMENT_TAR,DOCUMENT_NS -Dmongo.db=MongoMKDB-${MONGODB_SUFFIX} clean verify -pl :${moduleName}"
                     } finally {

oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncConfig.java

@@ -19,9 +19,11 @@
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
-import org.apache.jackrabbit.guava.common.collect.ImmutableSet;
 import org.jetbrains.annotations.NotNull;
 
 /**
@@ -203,9 +205,7 @@ public Authorizable setAutoMembershipConfig(@NotNull AutoMembershipConfig autoMe
          */
         @NotNull
         public Set<String> getAutoMembership(@NotNull org.apache.jackrabbit.api.security.user.Authorizable authorizable) {
-            return ImmutableSet.<String>builder().
-                    addAll(autoMembershipConfig.getAutoMembership(authorizable)).
-                    addAll(getAutoMembership()).build();
+            return Stream.concat(autoMembershipConfig.getAutoMembership(authorizable).stream().filter(Objects::nonNull), getAutoMembership().stream().filter(Objects::nonNull)).collect(Collectors.toUnmodifiableSet());
         }
 
         /**

oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/jmx/Delegatee.java

@@ -23,6 +23,7 @@
 import org.apache.jackrabbit.oak.api.ContentRepository;
 import org.apache.jackrabbit.oak.api.ContentSession;
 import org.apache.jackrabbit.oak.api.Root;
+import org.apache.jackrabbit.oak.commons.jdkcompat.Java23Subject;
 import org.apache.jackrabbit.oak.namepath.NamePathMapper;
 import org.apache.jackrabbit.oak.plugins.value.jcr.ValueFactoryImpl;
 import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
@@ -46,7 +47,6 @@
 import org.slf4j.LoggerFactory;
 
 import javax.jcr.RepositoryException;
-import javax.security.auth.Subject;
 import java.io.IOException;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
@@ -107,7 +107,7 @@ static Delegatee createInstance(@NotNull final ContentRepository repository,
                                     int batchSize) {
         ContentSession systemSession;
         try {
-            systemSession = Subject.doAs(SystemSubject.INSTANCE, (PrivilegedExceptionAction<ContentSession>) () -> repository.login(null, null));
+            systemSession = Java23Subject.doAs(SystemSubject.INSTANCE, (PrivilegedExceptionAction<ContentSession>) () -> repository.login(null, null));
         } catch (PrivilegedActionException e) {
             throw new SyncRuntimeException(ERROR_CREATE_DELEGATEE, e);
         }

oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/AutoMembershipPrincipals.java

@@ -19,7 +19,6 @@
 import org.apache.jackrabbit.api.security.user.Authorizable;
 import org.apache.jackrabbit.api.security.user.Group;
 import org.apache.jackrabbit.api.security.user.UserManager;
-import org.apache.jackrabbit.guava.common.collect.ImmutableSet;
 import org.apache.jackrabbit.guava.common.collect.Iterators;
 import org.apache.jackrabbit.oak.spi.security.authentication.external.basic.AutoMembershipConfig;
 import org.apache.jackrabbit.oak.spi.security.principal.GroupPrincipals;
@@ -220,7 +219,7 @@ private Map<Principal, Group> collectGlobalAutoMembershipPrincipals(@NotNull Str
                 }
             }
             // only cache the principal instance but not the group (tree might become disconnected)
-            principalMap.put(idpName, ImmutableSet.copyOf(map.keySet()));
+            principalMap.put(idpName, Set.copyOf(map.keySet()));
         } else {
             // resolve Group objects from cached principals
             principalMap.get(idpName).forEach(groupPrincipal -> {

oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalAuthorizableActionProvider.java

@@ -16,11 +16,11 @@
  */
 package org.apache.jackrabbit.oak.spi.security.authentication.external.impl.principal;
 
-import org.apache.jackrabbit.guava.common.collect.ImmutableSet;
 import org.apache.jackrabbit.api.security.user.Authorizable;
 import org.apache.jackrabbit.api.security.user.Group;
 import org.apache.jackrabbit.oak.api.Root;
 import org.apache.jackrabbit.oak.commons.PropertiesUtil;
+import org.apache.jackrabbit.oak.commons.collections.CollectionUtils;
 import org.apache.jackrabbit.oak.namepath.NamePathMapper;
 import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
 import org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityRef;
@@ -199,7 +199,7 @@ private Map<String, Set<String>> getAutomembership(boolean memberIsGroup) {
 
         private static void updateAutoMembershipMap(@NotNull Map<String, Set<String>> map, @NotNull String syncHandlerName, 
                                                     @NotNull String idpName, @NotNull String[] membership) {
-            Set<String> userMembership = ImmutableSet.copyOf(membership);
+            Set<String> userMembership = CollectionUtils.toSet(membership);
             Set<String> previous = map.put(idpName, userMembership);
             if (previous != null) {
                 String msg = previous.equals(userMembership) ? "Duplicate" : "Colliding";

oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java

@@ -45,7 +45,6 @@
 import org.apache.jackrabbit.api.security.user.Group;
 import org.apache.jackrabbit.api.security.user.UserManager;
 import org.apache.jackrabbit.commons.iterator.AbstractLazyIterator;
-import org.apache.jackrabbit.guava.common.collect.ImmutableSet;
 import org.apache.jackrabbit.guava.common.collect.Iterables;
 import org.apache.jackrabbit.guava.common.collect.Iterators;
 import org.apache.jackrabbit.oak.api.PropertyState;
@@ -56,6 +55,7 @@
 import org.apache.jackrabbit.oak.api.Root;
 import org.apache.jackrabbit.oak.api.Tree;
 import org.apache.jackrabbit.oak.api.Type;
+import org.apache.jackrabbit.oak.commons.collections.CollectionUtils;
 import org.apache.jackrabbit.oak.namepath.NamePathMapper;
 import org.apache.jackrabbit.oak.plugins.memory.PropertyValues;
 import org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityRef;
@@ -326,7 +326,7 @@ public boolean isMember(@NotNull Group group, @NotNull Authorizable authorizable
                 return Collections.emptyIterator();
             }
 
-            Set<Value> valueSet = ImmutableSet.copyOf(vs);
+            Set<Value> valueSet = CollectionUtils.toSet(vs);
             Iterator<Group> declared = Iterators.filter(Iterators.transform(valueSet.iterator(), value -> {
                 try {
                     String groupPrincipalName = value.getString();