chore(sdk): sync Java SDK v12.0.0-rc.1

.env.example

@@ -0,0 +1,62 @@
+# Copy to v12/.env and fill in your own values. v12/.env is gitignored.
+# Each example reads only the keys it needs — set the ones for the example you
+# plan to run, leave the others empty.
+
+# ── APIKey ──────────────────────────────────────────────────────────────
+# Used by every example. Tenant API key from the LoginRadius admin console.
+LR_API_KEY=
+
+# ── APISecret ───────────────────────────────────────────────────────────
+# Server-side only. Required by the api-key-secret and x-loginradius-headers examples.
+LR_API_SECRET=
+
+# ── AccessToken (user-context) ──────────────────────────────────────────
+# Returned by a prior login flow. Required by the access-token example.
+LR_ACCESS_TOKEN=
+LR_OIDC_APP_NAME=
+
+# ── BearerToken ─────────────────────────────────────────────────────────
+# Required by the bearer-token example.
+LR_BEARER_TOKEN=
+
+# ── M2MBearerToken (JWT) ────────────────────────────────────────────────
+# Obtained via the OAuth M2M token endpoint. Required by the m2m-bearer-token example.
+LR_M2M_BEARER_TOKEN=
+
+# ── ClientId + ClientSecret (OAuth app) ─────────────────────────────────
+# Required by the client-id-secret example.
+LR_CLIENT_ID=
+LR_CLIENT_SECRET=
+LR_TARGET_UID=
+
+# ── X-LoginRadius-Api{Key,Secret} (header-only overrides) ───────────────
+# Required by x-loginradius-headers/ when the header value must differ from
+# the query value.
+LR_X_API_KEY=
+LR_X_API_SECRET=
+
+# ── Misc ────────────────────────────────────────────────────────────────
+# Social-provider access token (Facebook/Google/etc.) for token exchange.
+# Used by the api-key-secret and x-loginradius-headers examples.
+LR_SOCIAL_TOKEN=
+
+# ── login example ──────────────────────────────────────────────────────
+LR_EMAIL=
+
+# ── Demo server (com.loginradius.sdk.demo.DemoServer) ────────────────────
+# Reuses LR_API_KEY / LR_API_SECRET above. Optional server-selection trio —
+# leave unset to use the production API.
+LR_DOMAIN=
+LR_CUSTOM_DOMAIN=
+LR_BASE_URL=
+
+# Where email links point back to.
+#
+# LR_VERIFICATION_URL must address the demo's own verify ROUTE, not the site
+# root — LoginRadius appends ?vtoken=... to it, and the handler reads that,
+# verifies the account and redirects to / with a banner.
+LR_VERIFICATION_URL=http://localhost:8080/api/auth/verify
+LR_RESET_PASSWORD_URL=http://localhost:8080/?reset=1
+
+# Server port.
+LR_DEMO_PORT=8080

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+# GENERATED FILE — do not edit it in this repository.
+# This workflow is produced alongside the rest of this SDK and is overwritten
+# whenever the SDK is regenerated. Raise changes where the SDK is generated.
+#
+# These steps mirror this SDK's own build verification, with the pinned
+# maven:3-eclipse-temurin-17 image replaced by setup-java.
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build and test (JDK 17)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          # Matches the pom's <java.version>. Bump both together.
+          java-version: '17'
+          cache: maven
+
+      - name: Package
+        run: mvn -B -q -DskipTests package
+
+      # Deliberately not -q: a gate should show the test count, not just its
+      # exit code. A run that executed zero tests must not look like a pass.
+      - name: Test
+        run: mvn -B test
+
+      # NO spotless step, deliberately. The generator's pom configures
+      # spotless 2.43.0 with google-java-format 1.8, and spotless refuses that
+      # combination on JVM 17 outright:
+      #
+      #   You are running Spotless on JVM 17. This requires google-java-format
+      #   of at least 1.10.0 (you are using 1.8).
+      #
+      # So `mvn spotless:check` fails before it formats anything — it would make
+      # this workflow permanently red while saying nothing about the code. The
+      # SDK's own build does not run it either, so Java formatting is currently
+      # unenforced rather than enforced in one place. Fixing that means bumping
+      # google-java-format in the pom and accepting a whole-tree reformat — a
+      # separate change from wiring up CI.

.github/workflows/release.yml

@@ -0,0 +1,140 @@
+# GENERATED FILE — do not edit it in this repository.
+# This workflow is produced alongside the rest of this SDK and is overwritten
+# whenever the SDK is regenerated. Raise changes where the SDK is generated.
+#
+# Replaces the previous maven-publish.yml, which deployed on every push to
+# master, built --file LoginRadius-JavaSDK/pom.xml (the pom is at the root now),
+# ran JDK 16 against a Java-17 pom, and never passed
+# -Psign-artifacts — so Central would have rejected the artifacts anyway.
+#
+# Two gates stand in front of a release, and both are deliberate:
+#   1. the 'release' GitHub Environment, which should have required reviewers;
+#   2. autoPublish=false on central-publishing-maven-plugin, so the bundle is
+#      uploaded and validated but a human presses Publish in the Central
+#      Portal. A version on Central can never be replaced.
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to publish (e.g. v12.0.0-rc.1)'
+        required: true
+        type: string
+      dry_run:
+        description: 'Build and sign only — do not upload to Central'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish com.loginradius.sdk:java-sdk to Maven Central
+    runs-on: ubuntu-latest
+    # Requires a human approval on the 'release' environment. The GPG key and
+    # Central token belong on that environment, not on the repository, so no
+    # other workflow can reach them.
+    environment: release
+    permissions:
+      contents: write   # create the GitHub Release
+    steps:
+      - name: Resolve tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "name=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "name=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.tag.outputs.name }}
+          fetch-depth: 0
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+          # Writes a settings.xml whose <server> id matches
+          # <publishingServerId>central</publishingServerId> in the pom, and
+          # imports the signing key. The values below are ENV VAR NAMES, not
+          # the secrets themselves — that is this action's contract.
+          server-id: central
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_CENTRAL_TOKEN
+          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+
+      # The pom <version>, the tag and the generated SDK version are three
+      # independent facts until something compares them.
+      - name: Tag matches the pom and the SDK version
+        run: |
+          expected='12.0.0-rc.1'
+          pom="$(mvn -B -q -DforceStdout help:evaluate -Dexpression=project.version)"
+          tag='${{ steps.tag.outputs.name }}'
+          if [ "${pom}" != "${expected}" ]; then
+            echo "::error::pom version ${pom} does not match the generated SDK version ${expected}"
+            exit 1
+          fi
+          if [ "${tag}" != "v${expected}" ]; then
+            echo "::error::tag ${tag} does not match the generated SDK version v${expected}"
+            exit 1
+          fi
+
+      - name: Test
+        run: mvn -B test
+
+      # -Psign-artifacts carries BOTH halves of publishing: maven-gpg-plugin
+      # (Central rejects unsigned artifacts) and central-publishing-maven-plugin
+      # (Central Portal takes an uploaded bundle, not a deploy to a URL).
+      # Without the profile this is a no-op deploy that silently publishes
+      # nothing, which is what the workflow this replaces did.
+      - name: Verify and sign
+        env:
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+        run: mvn -B -Psign-artifacts verify
+
+      - name: Upload the bundle to Central
+        if: ${{ github.event_name == 'push' || inputs.dry_run == false }}
+        env:
+          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+          MAVEN_OPTS: ${{ secrets.MAVEN_OPTS }}
+        # Stops at 'validated'. Finish the release by pressing Publish at
+        # https://central.sonatype.com/publishing/deployments
+        run: mvn -B -Psign-artifacts deploy -DskipTests
+
+      - name: Upload the artifacts to this run
+        uses: actions/upload-artifact@v4
+        with:
+          name: maven-artifacts
+          path: |
+            target/*.jar
+            target/*.asc
+          if-no-files-found: error
+
+      - name: Create the GitHub Release
+        if: ${{ github.event_name == 'push' || inputs.dry_run == false }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.tag.outputs.name }}
+        run: |
+          if gh release view "${TAG}" >/dev/null 2>&1; then
+            echo "release ${TAG} already exists — nothing to do"
+            exit 0
+          fi
+          PRERELEASE='--prerelease'
+          gh release create "${TAG}" --verify-tag --title "${TAG}" \
+            --notes-file CHANGELOG.md ${PRERELEASE}

.gitignore

@@ -1,28 +1,21 @@
-# Make sure to ignore Eclipse files
-.classpath
-.project
-.settings
-.html
+*.class
 
-# Macisms
-.DS_Store
-# Where maven compiles by default
+# Mobile Tools for Java (J2ME)
+.mtj.tmp/
 
-
-#IntelliJ project files
-*.iml
-.idea
-
-.bash_profile
-
-# Java Files that should be ignored
-.class
-
-# Package Files
+# Package Files #
+*.jar
 *.war
 *.ear
 
-# Backup files
-*.bak
-scratch
-/target/
+# exclude jar for gradle wrapper
+!gradle/wrapper/*.jar
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+hs_err_pid*
+
+# build files
+**/target
+target
+.gradle
+build