<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ This file is part of Dependency-Track.
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~   http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  ~
  ~ SPDX-License-Identifier: Apache-2.0
  ~ Copyright (c) Steve Springett. All Rights Reserved.
  -->

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">

    <listener>
        <listener-class>org.dependencytrack.RequirementsVerifier</listener-class>
    </listener>
    <listener>
        <listener-class>alpine.server.metrics.MetricsInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>alpine.server.persistence.PersistenceInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.upgrade.UpgradeInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>alpine.server.persistence.PersistenceManagerFactory</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.health.HealthCheckInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.persistence.DefaultObjectGenerator</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.event.EventSubsystemInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.notification.NotificationSubsystemInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.search.IndexSubsystemInitializer</listener-class>
    </listener>
    <listener>
        <listener-class>org.dependencytrack.persistence.H2WebConsoleInitializer</listener-class>
    </listener>

    <filter>
        <filter-name>WhitelistUrlFilter</filter-name>
        <filter-class>alpine.server.filters.WhitelistUrlFilter</filter-class>
        <init-param>
            <param-name>allowUrls</param-name>
            <param-value>/index.html,/css,/fonts,/img,/js,/static,/favicon.ico,/api,/health,/metrics,/mirror,/.well-known</param-value>
        </init-param>
        <init-param>
            <param-name>forwardTo</param-name>
            <param-value>/index.html</param-value>
        </init-param>
        <init-param>
            <param-name>forwardExcludes</param-name>
            <param-value>/api,/health,/metrics,/mirror</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>WhitelistUrlFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>ClickjackingFilter</filter-name>
        <filter-class>alpine.server.filters.ClickjackingFilter</filter-class>
        <init-param>
            <param-name>mode</param-name>
            <param-value>DENY</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>ClickjackingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>CspFilter</filter-name>
        <filter-class>alpine.server.filters.ContentSecurityPolicyFilter</filter-class>
        <init-param>
            <param-name>script-src</param-name>
            <param-value>'self' 'unsafe-inline'</param-value>
        </init-param>
        <init-param>
            <param-name>style-src</param-name>
            <param-value>'self' 'unsafe-inline'</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CspFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <servlet>
        <servlet-name>DependencyTrack</servlet-name>
        <servlet-class>alpine.server.AlpineServlet</servlet-class>
        <init-param>
            <param-name>jersey.config.server.provider.packages</param-name>
            <param-value>io.swagger.jaxrs.listing,alpine.server.filters,alpine.server.resources,org.dependencytrack.resources,org.dependencytrack.filters</param-value>
        </init-param>
        <init-param>
            <param-name>jersey.config.server.provider.classnames</param-name>
            <param-value>org.glassfish.jersey.media.multipart.MultiPartFeature</param-value>
        </init-param>
        <init-param>
            <param-name>jersey.config.beanValidation.enableOutputValidationErrorEntity.server</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>swagger.pretty.print</param-name>
            <param-value>true</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>DependencyTrack</servlet-name>
        <url-pattern>/api/*</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>Health</servlet-name>
        <servlet-class>alpine.server.servlets.HealthServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Health</servlet-name>
        <url-pattern>/health/*</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>Metrics</servlet-name>
        <servlet-class>alpine.server.servlets.MetricsServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Metrics</servlet-name>
        <url-pattern>/metrics</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>NVD Mirror</servlet-name>
        <servlet-class>org.dependencytrack.servlets.NvdMirrorServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>NVD Mirror</servlet-name>
        <url-pattern>/mirror/nvd/*</url-pattern>
    </servlet-mapping>

    <error-page>
        <exception-type>java.lang.Exception</exception-type>
        <location>/WEB-INF/fragments/error.jsp</location>
    </error-page>

    <session-config>
        <session-timeout>1</session-timeout>
        <cookie-config>
            <name>DEPENDENCY-TRACK_JSESSIONID</name>
            <http-only>true</http-only>
            <!-- <secure>true</secure> -->
            <max-age>0</max-age>
        </cookie-config>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>

</web-app>
