build.gradle

buildscript {
    apply from: rootProject.file("gradle/versions.gradle")

    // ---------------------------------------------------------------------------
    // Authenticator App opt-in flag.
    // Priority (highest wins): -P command line > ~/.gradle/gradle.properties >
    // project gradle.properties > local.properties (fallback only).
    // project.findProperty() already resolves the first three, so we only fall
    // back to local.properties when none of those are set.
    // ---------------------------------------------------------------------------
    def __localProps = new Properties()
    def __localPropsFile = new File(rootDir, 'local.properties')
    if (__localPropsFile.exists()) {
        __localPropsFile.withInputStream { __localProps.load(it) }
    }
    def includeAuthenticatorApp = (project.findProperty('includeAuthenticatorApp')?.toString()
            ?: __localProps.getProperty('includeAuthenticatorApp') ?: 'false') == 'true'
    project.ext.set('includeAuthenticatorApp', includeAuthenticatorApp)

    // Authenticator is setting versions of their dependencies in their gradle.properties file.
    // We'll load and merge the values we don't have in our properties file.
    if (includeAuthenticatorApp) {
        File authProps = new File("authenticator/PhoneFactor/gradle.properties")
        if (authProps.exists()) {
            Properties props = new Properties()
            props.load(new FileInputStream(authProps))
            props.each { prop ->
                if (!project.ext.has(prop.key)) {
                    project.ext.set(prop.key, prop.value)
                }
            }
        }
    }

    repositories {
        // If you don't have access to the package feed below, uncomment the maven central repo
        // mavenCentral()
        mavenLocal()
        google()
        maven {
            // msazure and aria are consumed via upstream sources of the NewAndroid feed.
            name "vsts-maven-new-android"
            url "https://identitydivision.pkgs.visualstudio.com/_packaging/NewAndroid/maven/v1"
            credentials {
                username System.getenv("ENV_VSTS_MVN_CRED_USERNAME") != null ? System.getenv("ENV_VSTS_MVN_CRED_USERNAME") : project.findProperty("vstsUsername")
                password System.getenv("ENV_VSTS_MVN_CRED_ACCESSTOKEN") != null ? System.getenv("ENV_VSTS_MVN_CRED_ACCESSTOKEN") : project.findProperty("vstsMavenAccessToken")
            }
        }
        if (includeAuthenticatorApp) {
            maven {
                // Authenticator App feed — pulls packages from msazure AuthApp upstream sources.
                name "vsts-maven-authapp"
                url "https://msazure.pkgs.visualstudio.com/One/_packaging/AuthApp/maven/v1"
                credentials {
                    username "VSTS"
                    password System.getenv("SYSTEM_ACCESSTOKEN") != null ? System.getenv("SYSTEM_ACCESSTOKEN") : project.findProperty("adoMsazureAuthAppAccessToken")
                }
                // Tell Gradle to accept artifacts without POMs. Dexguard is stored in external feed without POM
                metadataSources {
                    mavenPom() // Try to find the POM first (preferred)
                    artifact() // If no POM, accept the JAR anyway (fallback)
                }
            }
        }
    }

    dependencies {
        classpath "com.android.tools.build:gradle:${rootProject.ext.gradleVersion}"
        classpath "org.javassist:javassist:${rootProject.ext.javaAssistVersion}"
        classpath "com.microsoft.intune.mam:android-build-plugin:${rootProject.ext.intuneAppSdkVersion}"
        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:${rootProject.ext.kotlinVersion}"
    //    classpath "net.serenity-bdd:serenity-gradle-plugin:1.9.6"
    //    classpath 'com.google.gms:google-services:3.2.1'
    //    classpath "androidx.navigation:navigation-safe-args-gradle-plugin:${project.ext.get('androidx_navigation_version')}"
    //    classpath 'com.google.dagger:hilt-android-gradle-plugin:2.28-alpha'
        // Authenticator App buildscript dependencies
        if (project.ext.has('androidx_navigation_version')) {
            classpath "androidx.navigation:navigation-safe-args-gradle-plugin:${project.ext.get('androidx_navigation_version')}"
        }
        if (project.ext.has('hilt_version')) {
            classpath "com.google.dagger:hilt-android-gradle-plugin:${project.ext.get('hilt_version')}"
        }
        if (project.ext.has('detekt_version')) {
            classpath "io.gitlab.arturbosch.detekt:detekt-gradle-plugin:${project.ext.get('detekt_version')}"
        }
        if (project.ext.has('com_google_gms_google_services_version')) {
            classpath "com.google.gms:google-services:${project.ext.get('com_google_gms_google_services_version')}"
        }
        // NOTE: protobuf-gradle-plugin is NOT on this root classpath.
        // Putting it here causes "already on the classpath with an unknown version" errors
        // for broker4j, which requests it via plugins {} DSL with a version.
        // Instead, it is injected into AuthenticatorPolicyChannel's own buildscript below,
        // and broker4j resolves it via the settings.gradle pluginManagement resolutionStrategy.

        // Authenticator App — additional buildscript dependencies.
        // authenticator/PhoneFactor/build.gradle is never evaluated in android-complete (it's the
        // standalone root build file), so its classpath entries must be replicated here.
        // Each entry is guarded so it's silently skipped when Authenticator isn't checked out.
        if (project.ext.has('org_jacoco_org_jacoco_coreversion')) {
            classpath "org.jacoco:org.jacoco.core:${project.ext.get('org_jacoco_org_jacoco_coreversion')}"
        }
        if (project.ext.has('org_codehaus_groovy_groovy_all_version')) {
            classpath "org.codehaus.groovy:groovy-all:${project.ext.get('org_codehaus_groovy_groovy_all_version')}"
        }
        // Component Governance — pin transitive buildscript dependencies to patched versions.
        if (project.ext.has('org_apache_commons')) {
            classpath "org.apache.commons:commons-compress:${project.ext.get('org_apache_commons')}"
        }
        if (project.ext.has('commons_codec')) {
            classpath "commons-codec:commons-codec:${project.ext.get('commons_codec')}"
        }
        if (project.ext.has('org_bouncycastle_bcprov')) {
            classpath "org.bouncycastle:bcprov-jdk15to18:${project.ext.get('org_bouncycastle_bcprov')}"
        }
        if (project.ext.has('com_google_guava_jre_version')) {
            classpath "com.google.guava:guava:${project.ext.get('com_google_guava_jre_version')}"
        }
        if (project.ext.has('commons_io')) {
            classpath "commons-io:commons-io:${project.ext.get('commons_io')}"
        }
        if (project.ext.has('commons_text')) {
            classpath "org.apache.commons:commons-text:${project.ext.get('commons_text')}"
        }
        if (project.ext.has('commons_lang3')) {
            classpath "org.apache.commons:commons-lang3:${project.ext.get('commons_lang3')}"
        }
        if (project.ext.has('com_google_protobuf_java_version')) {
            classpath "com.google.protobuf:protobuf-java:${project.ext.get('com_google_protobuf_java_version')}"
            classpath "com.google.protobuf:protobuf-java-util:${project.ext.get('com_google_protobuf_java_version')}"
        }
        if (project.ext.has('com_google_code_gson_gson_version')) {
            classpath "com.google.code.gson:gson:${project.ext.get('com_google_code_gson_gson_version')}"
        }
        if (project.ext.has('jsoup_version')) {
            classpath "org.jsoup:jsoup:${project.ext.get('jsoup_version')}"
        }
        if (project.ext.has('grpc_netty_version')) {
            classpath "io.grpc:grpc-netty:${project.ext.get('grpc_netty_version')}"
        }
        if (project.ext.has('io_netty')) {
            classpath "io.netty:netty-all:${project.ext.get('io_netty')}"
        }
        if (project.ext.has('org_apache_ant')) {
            classpath "org.apache.ant:ant:${project.ext.get('org_apache_ant')}"
        }
        if (project.ext.has('org_jdom')) {
            classpath "org.jdom:jdom2:${project.ext.get('org_jdom')}"
        }
        if (project.ext.has('dexguard_gradle_plugin_version')) {
            classpath "com.guardsquare:dexguard-gradle-plugin:${project.ext.get('dexguard_gradle_plugin_version')}"
        }
    }
}

plugins {
    id "net.linguica.maven-settings" version "0.5"
    id "com.microsoft.hydralab.client-util" version "1.1.14"
    // Authenticator App plugins — declared with `apply false` so they are available
    // for Authenticator subprojects to apply. These are no-ops when Authenticator is
    // excluded (no module applies them), so they are kept unconditional for simplicity.
    //
    // Versions are resolved dynamically in settings.gradle via pluginManagement's
    // resolutionStrategy.eachPlugin, sourced from authenticator/PhoneFactor/gradle.properties
    // so they can never drift from Authenticator's canonical versions.
    id "com.google.devtools.ksp" apply false
    id "org.jetbrains.kotlin.plugin.compose" apply false
    id "androidx.room" apply false
}

project.ext.vstsUsername = System.getenv("ENV_VSTS_MVN_CRED_USERNAME") != null ? System.getenv("ENV_VSTS_MVN_CRED_USERNAME") : project.findProperty("vstsUsername")
project.ext.vstsMavenAccessToken = System.getenv("ENV_VSTS_MVN_CRED_ACCESSTOKEN") != null ? System.getenv("ENV_VSTS_MVN_CRED_ACCESSTOKEN") : project.findProperty("vstsMavenAccessToken")

// Retrieve the flag computed in the buildscript block.
def includeAuthenticatorApp = project.ext.get('includeAuthenticatorApp')
if (includeAuthenticatorApp) {
    logger.lifecycle("Authenticator App modules: INCLUDED (includeAuthenticatorApp=true)")
} else {
    logger.lifecycle("Authenticator App modules: EXCLUDED (set includeAuthenticatorApp=true to include)")
}

// Authenticator module names — single source of truth for all Authenticator-scoped logic.
// Used to guard property propagation, dependency substitutions, lint config, and CI tasks
// so they apply ONLY to Authenticator sub-projects, never to MSAL/Broker/Common.
def authenticatorModuleNames = includeAuthenticatorApp ? [
        "MSAuthenticator",
        "AadRemoteNgcLibrary",
        "AndroidTestUtilitiesLibrary",
        "AuthenticatorPolicyChannel",
        "AuthenticatorSignalsLibrary",
        "BastionLibrary",
        "CommonUiLibrary",
        "CtapLibrary",
        "ExperimentationLibrary",
        "GraphClient",
        "LocationLibrary",
        "MfaLibrary",
        "MsaAccountLibrary",
        "MsaSdkDebug",
        "MsaSdkRelease",
        "NativeLibrary",
        "NgcProviderLibrary",
        "RootDetectionLibrary",
        "ScanQrCodeLibrary",
        "SecureKeystoreLibrary",
        "SharedCoreLibrary",
        "SilentNotificationChannelLibrary",
        "TestUtilitiesLibrary",
        "VerifiableCredential-SDK",
        "VerifiableCredential-Wallet",
        "WalletLibrary",
        "WalletLibrary-FaceCheck-Extension",
        "uiautomator-tests",
] as Set : [] as Set

// Propagate Authenticator properties to Authenticator subprojects ONLY.
// The Authenticator modules reference properties like compile_sdk_version, min_sdk_version, etc.
// from their PhoneFactor/gradle.properties. Since that's not the root project, those properties
// aren't automatically available. We propagate them here as ext properties, but ONLY to
// Authenticator modules — never to MSAL/Broker/Common — to avoid version leakage.
if (includeAuthenticatorApp) {
    File authPropsFile = new File("authenticator/PhoneFactor/gradle.properties")
    if (authPropsFile.exists()) {
        Properties authProperties = new Properties()
        authPropsFile.withInputStream { authProperties.load(it) }
        subprojects { subproject ->
            if (authenticatorModuleNames.contains(subproject.name)) {
                authProperties.each { prop ->
                    if (!subproject.hasProperty(prop.key)) {
                        subproject.ext.set(prop.key, prop.value)
                    }
                }
            }
        }
    }
}

allprojects {
    repositories {
        mavenLocal()
        google()
        mavenCentral()
        maven {
            // msazure and aria are consumed via upstream sources of the NewAndroid feed.
            name "vsts-maven-new-android"
            url "https://identitydivision.pkgs.visualstudio.com/_packaging/NewAndroid/maven/v1"
            credentials {
                username project.vstsUsername
                password project.vstsMavenAccessToken
            }
        }
        if (includeAuthenticatorApp) {
            maven {
                // Authenticator App feed — pulls packages from msazure AuthApp upstream sources.
                name "vsts-maven-authapp"
                url "https://msazure.pkgs.visualstudio.com/One/_packaging/AuthApp/maven/v1"
                credentials {
                    username "VSTS"
                    password System.getenv("SYSTEM_ACCESSTOKEN") != null ? System.getenv("SYSTEM_ACCESSTOKEN") : project.findProperty("adoMsazureAuthAppAccessToken")
                }
                // Tell Gradle to accept artifacts without POMs. Dexguard is stored in external feed without POM
                metadataSources {
                    mavenPom() // Try to find the POM first (preferred)
                    artifact() // If no POM, accept the JAR anyway (fallback)
                }
            }
        }
    }

    gradle.projectsEvaluated {
        tasks.withType(JavaCompile) {
            options.compilerArgs << "-Xlint:unchecked"
        }
    }

    tasks.withType(Javadoc) {
        options.addStringOption('Xdoclint:none', '-quiet')
    }

    // Dependency substitution: when building in android-complete, replace Maven artifacts
    // with their local project equivalents to avoid duplicate class / resource errors.
    // Note: Skip substitution for 'dist' and 'external' flavor configurations — those are
    // intended to resolve remote artifacts (e.g. distApi dependencies in test apps,
    // externalImplementation in AzureSample).
    configurations.configureEach {
        // Skip dist/external flavor configurations so they resolve remote Maven artifacts
        if (name.toLowerCase().contains('dist') || name.toLowerCase().contains('external')) {
            return
        }
        resolutionStrategy.dependencySubstitution {
            if (rootProject.findProject(':AADAuthenticator') != null) {
                substitute module('com.microsoft.workplace:ad-accounts-for-android') using project(':AADAuthenticator')
            }
            if (rootProject.findProject(':common') != null) {
                substitute module('com.microsoft.identity:common') using project(':common')
            }
            if (rootProject.findProject(':msal') != null) {
                substitute module('com.microsoft.identity.client:msal') using project(':msal')
            }
            if (rootProject.findProject(':broker4j') != null) {
                substitute module('com.microsoft.identity:broker4j') using project(':broker4j')
            }
            if (rootProject.findProject(':common4j') != null) {
                substitute module('com.microsoft.identity:common4j') using project(':common4j')
            }
        }
    }

    // Exclude the ancient pre-AndroidX support-v4 library globally.
    // It conflicts with androidx.core and androidx.media which are used everywhere.
    configurations.configureEach {
        exclude group: 'com.android.support', module: 'support-v4'
    }

    // For modules with an 'external' product flavor that resolve MSAL from Maven:
    // the published artifact uses the 'dist' flavor, so 'external' needs a fallback.
    afterEvaluate {
        def android = extensions.findByName('android')
        if (android != null) {
            def externalFlavor = android.productFlavors.findByName('external')
            if (externalFlavor != null && !externalFlavor.matchingFallbacks) {
                externalFlavor.matchingFallbacks = ['dist']
            }
        }
    }
}

// =============================================================================
// Authenticator-scoped subprojects configuration.
// Replicates what authenticator/PhoneFactor/build.gradle applies via its
// subprojects {} block. That file is never evaluated in android-complete
// (it's the standalone root build file), so everything it does must be
// selectively mirrored here, guarded to Authenticator modules only.
// =============================================================================
if (includeAuthenticatorApp) {
    // Inject protobuf-gradle-plugin into AuthenticatorPolicyChannel's OWN buildscript classpath.
    // In standalone Authenticator, this is on the root classpath (PhoneFactor/build.gradle line 45).
    // We can't put it on android-complete's root classpath because broker4j also uses protobuf
    // via plugins {} DSL with a version, which conflicts ("already on classpath with unknown version").
    // Injecting into the subproject's buildscript only makes it invisible to broker4j.
    if (rootProject.findProject(':AuthenticatorPolicyChannel') != null) {
        project(':AuthenticatorPolicyChannel').buildscript {
            repositories {
                gradlePluginPortal()
                mavenCentral()
            }
            dependencies {
                classpath "com.google.protobuf:protobuf-gradle-plugin:0.9.4"
            }
        }
    }

    subprojects { subproject ->
        if (authenticatorModuleNames.contains(subproject.name)) {

        // --- Test dependency configuration ---
        // Force consistent ASM/Objenesis versions across all test frameworks,
        // and exclude mockk-agent-jvm which conflicts in instrumented tests.
        configurations {
            all {
                resolutionStrategy {
                    force "org.ow2.asm:asm:9.6"
                    force 'org.objenesis:objenesis:2.6'
                }
            }
            // Fixes duplicate class io.mockk.valueCClassSupportKt in instrumented tests
            androidTestImplementation {
                exclude group: 'io.mockk', module: 'mockk-agent-jvm'
            }
        }

        afterEvaluate {
            // --- Lint configuration ---
            // In standalone Authenticator, lint.xml resolves relative to PhoneFactor/.
            // Here we must use an absolute path since rootDir is android-complete/.
            if (subproject.plugins.hasPlugin('com.android.application') ||
                    subproject.plugins.hasPlugin('com.android.library')) {
                android {
                    lint {
                        lintConfig file("${rootDir}/authenticator/PhoneFactor/lint.xml")
                        abortOnError true
                        warningsAsErrors true
                        textReport true
                        explainIssues true
                        showAll true
                    }
                }
            }

            // --- Classpath consistency ---
            // Ensures runtime/test/lint classpaths resolve the same versions as compileClasspath.
            // Without this, transitive dependency differences can cause "works at compile time,
            // breaks at runtime" bugs.
            configurations {
                runtimeClasspath.shouldResolveConsistentlyWith(compileClasspath)
                testClasspath.shouldResolveConsistentlyWith(compileClasspath)
                androidtestClasspath.shouldResolveConsistentlyWith(compileClasspath)
                lintClasspath.shouldResolveConsistentlyWith(compileClasspath)

                // --- Component Governance dependency substitutions ---
                // Force patched versions of transitive dependencies flagged by Microsoft's
                // supply chain security scanner. Each rule targets a specific vulnerable
                // version and replaces it with the pinned safe version from Authenticator's
                // gradle.properties.
                all {
                    resolutionStrategy.dependencySubstitution {
                        // commons-compress
                        substitute module("org.apache.commons:commons-compress:1.12") using module("org.apache.commons:commons-compress:${subproject.findProperty('org_apache_commons')}")
                        substitute module("org.apache.commons:commons-compress:1.20") using module("org.apache.commons:commons-compress:${subproject.findProperty('org_apache_commons')}")
                        substitute module("org.apache.commons:commons-compress:1.21") using module("org.apache.commons:commons-compress:${subproject.findProperty('org_apache_commons')}")
                        // plexus-utils
                        substitute module("org.codehaus.plexus:plexus-utils:1.5.15") using module("org.codehaus.plexus:plexus-utils:${subproject.findProperty('org_codehaus_plexus')}")
                        // commons-codec
                        substitute module("commons-codec:commons-codec:1.10") using module("commons-codec:commons-codec:${subproject.findProperty('commons_codec')}")
                        substitute module("commons-codec:commons-codec:1.11") using module("commons-codec:commons-codec:${subproject.findProperty('commons_codec')}")
                        // ant
                        substitute module("org.apache.ant:ant:1.8.0") using module("org.apache.ant:ant:${subproject.findProperty('org_apache_ant')}")
                        substitute module("org.apache.ant:ant:1.10.9") using module("org.apache.ant:ant:${subproject.findProperty('org_apache_ant')}")
                        // groovy
                        substitute module("org.codehaus.groovy:groovy-all:2.4.15") using module("org.codehaus.groovy:groovy-all:${subproject.findProperty('org_codehaus_groovy_groovy_all_version')}")
                        // guava
                        substitute module("com.google.guava:guava:27.0.1-jre") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_jre_version')}")
                        substitute module("com.google.guava:guava:27.1-jre") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_jre_version')}")
                        substitute module("com.google.guava:guava:23.5-jre") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_jre_version')}")
                        substitute module("com.google.guava:guava:30.1.1-jre") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_jre_version')}")
                        substitute module("com.google.guava:guava:31.1-jre") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_jre_version')}")
                        substitute module("com.google.guava:guava:28.1-android") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_version')}")
                        substitute module("com.google.guava:guava:20.0") using module("com.google.guava:guava:${subproject.findProperty('com_google_guava_version')}")
                        // gson
                        substitute module("com.google.code.gson:gson:2.8.0") using module("com.google.code.gson:gson:${subproject.findProperty('com_google_code_gson_gson_version')}")
                        substitute module("com.google.code.gson:gson:2.8.6") using module("com.google.code.gson:gson:${subproject.findProperty('com_google_code_gson_gson_version')}")
                        // protobuf-java
                        substitute module("com.google.protobuf:protobuf-java:3.10.0") using module("com.google.protobuf:protobuf-java:${subproject.findProperty('com_google_protobuf_java_version')}")
                        substitute module("com.google.protobuf:protobuf-java:3.17.2") using module("com.google.protobuf:protobuf-java:${subproject.findProperty('com_google_protobuf_java_version')}")
                        substitute module("com.google.protobuf:protobuf-java:3.22.3") using module("com.google.protobuf:protobuf-java:${subproject.findProperty('com_google_protobuf_java_version')}")
                        substitute module("com.google.protobuf:protobuf-java:3.24.4") using module("com.google.protobuf:protobuf-java:${subproject.findProperty('com_google_protobuf_java_version')}")
                        substitute module("com.google.protobuf:protobuf-java-util:3.10.0") using module("com.google.protobuf:protobuf-java-util:${subproject.findProperty('com_google_protobuf_java_version')}")
                        substitute module("com.google.protobuf:protobuf-java-util:3.24.4") using module("com.google.protobuf:protobuf-java-util:${subproject.findProperty('com_google_protobuf_java_version')}")
                        substitute module("com.google.protobuf:protobuf-kotlin:3.24.4") using module("com.google.protobuf:protobuf-kotlin:${subproject.findProperty('com_google_protobuf_java_version')}")
                        // okio
                        substitute module("com.squareup.okio:okio:1.15.0") using module("com.squareup.okio:okio:${subproject.findProperty('com_squareup_okio')}")
                        substitute module("com.squareup.okio:okio:1.17.4") using module("com.squareup.okio:okio:${subproject.findProperty('com_squareup_okio')}")
                        substitute module("com.squareup.okio:okio:2.8.0") using module("com.squareup.okio:okio:${subproject.findProperty('com_squareup_okio')}")
                        // grpc
                        substitute module("io.grpc:grpc-netty:1.21.1") using module("io.grpc:grpc-netty:${subproject.findProperty('grpc_netty_version')}")
                        substitute module("io.grpc:grpc-netty:1.57.0") using module("io.grpc:grpc-netty:${subproject.findProperty('grpc_netty_version')}")
                        substitute module("io.grpc:grpc-protobuf:1.39.0") using module("io.grpc:grpc-protobuf:${subproject.findProperty('grpc_netty_version')}")
                        substitute module("io.grpc:grpc-protobuf-lite:1.39.0") using module("io.grpc:grpc-protobuf-lite:${subproject.findProperty('grpc_netty_version')}")
                        // netty
                        substitute module("io.netty:netty-common:4.1.110.Final") using module("io.netty:netty-common:${subproject.findProperty('io_netty')}")
                        substitute module("io.netty:netty-handler:4.1.110.Final") using module("io.netty:netty-handler:${subproject.findProperty('io_netty')}")
                        substitute module("io.netty:netty-handler:4.1.93.Final") using module("io.netty:netty-handler:${subproject.findProperty('io_netty')}")
                        substitute module("io.netty:netty-codec-http:4.1.110.Final") using module("io.netty:netty-codec-http:${subproject.findProperty('io_netty')}")
                        substitute module("io.netty:netty-codec:4.1.110.Final") using module("io.netty:netty-codec:${subproject.findProperty('io_netty')}")
                        substitute module("io.netty:netty-codec-http2:4.1.93.Final") using module("io.netty:netty-codec-http2:${subproject.findProperty('io_netty')}")
                        substitute module("io.netty:netty-codec-http2:4.1.110.Final") using module("io.netty:netty-codec-http2:${subproject.findProperty('io_netty')}")
                        // crypto tink
                        substitute module("com.google.crypto.tink:tink-android:1.4.0") using module("com.google.crypto.tink:tink-android:${subproject.findProperty('com_google_crypto_tink')}")
                        // commons-io
                        substitute module("commons-io:commons-io:2.4") using module("commons-io:commons-io:${subproject.findProperty('commons_io')}")
                        substitute module("commons-io:commons-io:2.13.0") using module("commons-io:commons-io:${subproject.findProperty('commons_io')}")
                        substitute module("commons-io:commons-io:2.15.1") using module("commons-io:commons-io:${subproject.findProperty('commons_io')}")
                        // commons-lang3
                        substitute module("org.apache.commons:commons-lang3:3.14.0") using module("org.apache.commons:commons-lang3:${subproject.findProperty('commons_lang3')}")
                        // kotlin-stdlib
                        substitute module("org.jetbrains.kotlin:kotlin-stdlib:1.3.70") using module("org.jetbrains.kotlin:kotlin-stdlib:${subproject.findProperty('kotlin_version')}")
                        substitute module("org.jetbrains.kotlin:kotlin-stdlib:1.3.72") using module("org.jetbrains.kotlin:kotlin-stdlib:${subproject.findProperty('kotlin_version')}")
                        substitute module("org.jetbrains.kotlin:kotlin-stdlib:1.4.10") using module("org.jetbrains.kotlin:kotlin-stdlib:${subproject.findProperty('kotlin_version')}")
                        substitute module("org.jetbrains.kotlin:kotlin-stdlib:1.4.32") using module("org.jetbrains.kotlin:kotlin-stdlib:${subproject.findProperty('kotlin_version')}")
                        substitute module("org.jetbrains.kotlin:kotlin-stdlib:1.5.32") using module("org.jetbrains.kotlin:kotlin-stdlib:${subproject.findProperty('kotlin_version')}")
                        // snakeyaml
                        substitute module("org.yaml:snakeyaml:1.30") using module("org.yaml:snakeyaml:${subproject.findProperty('org_yaml_snakeyaml')}")
                        substitute module("org.yaml:snakeyaml:1.31") using module("org.yaml:snakeyaml:${subproject.findProperty('org_yaml_snakeyaml')}")
                        // play-services
                        substitute module("com.google.android.gms:play-services-base:17.5.0") using module("com.google.android.gms:play-services-base:${subproject.findProperty('com_google_android_gms_play_services_base_version')}")
                        substitute module("com.google.android.gms:play-services-basement:17.5.0") using module("com.google.android.gms:play-services-basement:${subproject.findProperty('com_google_android_gms_play_services_base_version')}")
                        // sqlite-jdbc
                        substitute module("org.xerial:sqlite-jdbc:3.36.0") using module("org.xerial:sqlite-jdbc:${subproject.findProperty('sqlite_jdbc')}")
                        // json
                        substitute module("org.json:json:20230227") using module("org.json:json:${subproject.findProperty('json_version')}")
                        // bouncycastle
                        substitute module("org.bouncycastle:bcprov-jdk15on:1.67") using module("org.bouncycastle:bcprov-jdk15to18:${subproject.findProperty('org_bouncycastle_bcprov')}")
                        substitute module("org.bouncycastle:bcprov-jdk18on:1.76") using module("org.bouncycastle:bcprov-jdk15to18:${subproject.findProperty('org_bouncycastle_bcprov')}")
                        substitute module("org.bouncycastle:bcprov-jdk18on:1.77") using module("org.bouncycastle:bcprov-jdk15to18:${subproject.findProperty('org_bouncycastle_bcprov')}")
                        substitute module("org.bouncycastle:bcpkix-jdk15to18:1.78") using module("org.bouncycastle:bcpkix-jdk15to18:${subproject.findProperty('org_bouncycastle_bcpkix')}")
                        // beanutils
                        substitute module("commons-beanutils:commons-beanutils:1.9.4") using module("commons-beanutils:commons-beanutils:${subproject.findProperty('beanutils_version')}")
                        // okhttp
                        substitute module("com.squareup.okhttp3:okhttp:3.12.1") using module("com.squareup.okhttp3:okhttp:${subproject.findProperty('com_squareup_okhttp3_okhttp_version')}")
                    }
                }
            }
        }

        // --- Authenticator CI aggregate tasks ---
        // These tasks are called by Authenticator's ADO pipeline. They aggregate individual
        // module test/lint tasks into single entry points (e.g., `gradlew unitTestReport`).

        // Modules that have working unit tests
        def unitTestSupportedProjects = [
                "MSAuthenticator",
                "AndroidTestUtilitiesLibrary",
                "AadRemoteNgcLibrary",
                "AuthenticatorPolicyChannel",
                "BastionLibrary",
                "CommonUiLibrary",
                "ExperimentationLibrary",
                "GraphClient",
                "LocationLibrary",
                "MfaLibrary",
                "MsaAccountLibrary",
                "RootDetectionLibrary",
                "ScanQrCodeLibrary",
                "NgcProviderLibrary",
                "SecureKeystoreLibrary",
                "CtapLibrary",
                "SharedCoreLibrary",
                "TestUtilitiesLibrary",
        ]
        if (unitTestSupportedProjects.contains(subproject.name)) {
            tasks.whenTaskAdded { task ->
                if (task.name.matches('test(Production)?DebugUnitTest')) {
                    unitTestReport.dependsOn task
                }
            }
        }

        // Modules that have working connected (instrumented) tests
        def connectedTestSupportedProjects = [
                "CommonUiLibrary",
                "LocationLibrary",
                "RootDetectionLibrary",
        ]
        if (connectedTestSupportedProjects.contains(subproject.name)) {
            tasks.whenTaskAdded { task ->
                if (task.name.matches('connected(Production)?DebugAndroidTest')) {
                    runLibraryAndroidConnectedTests.dependsOn task
                }
            }
        }

        // Modules that have working lint reports
        def lintReportSupportedProjects = [
                "MSAuthenticator",
                "AndroidTestUtilitiesLibrary",
                "AadRemoteNgcLibrary",
                "AuthenticatorPolicyChannel",
                "BastionLibrary",
                "CommonUiLibrary",
                "ExperimentationLibrary",
                "GraphClient",
                "LocationLibrary",
                "MfaLibrary",
                "MsaAccountLibrary",
                "RootDetectionLibrary",
                "ScanQrCodeLibrary",
                "NgcProviderLibrary",
                "SecureKeystoreLibrary",
                "CtapLibrary",
                "SharedCoreLibrary",
                "TestUtilitiesLibrary",
                "VerifiableCredential-SDK",
                "SilentNotificationChannelLibrary",
        ]
        if (lintReportSupportedProjects.contains(subproject.name)) {
            tasks.whenTaskAdded { task ->
                if (task.name.matches('lint(Production)?Debug')) {
                    lintReport.dependsOn task
                }
            }
        }

        // Aggregate task definitions — empty tasks that collect dependsOn from above
        tasks.register('lintReport')
        tasks.register('unitTestReport')
        tasks.register('runLibraryAndroidConnectedTests')
    }
}
} // end if (includeAuthenticatorApp)

task clean(type: Delete) {
    delete rootProject.buildDir
}
if (!project.hasProperty("vstsUsername")) {
    logger.error('vstsUsername is missing in gradle.properties')
}
if (!project.hasProperty("vstsMavenAccessToken")) {
    logger.error('vstsMavenAccessToken is missing in gradle.properties')
}