ci: expand backend test matrix and harden build configuration

.taskfiles/backend.yml

@@ -109,28 +109,82 @@ tasks:
         platforms: [linux, darwin]
 
   test:
-    desc: "Run backend tests"
+    desc: "Run backend tests with and without frontend bundling"
+    # Cover the backend with the main build/property combinations that change
+    # Gradle behavior in this repo.
     cmds:
       - cmd: cmd /c ".\gradlew.bat test"
         platforms: [windows]
       - cmd: ./gradlew test
         platforms: [linux, darwin]
+      - cmd: cmd /c ".\gradlew.bat test -PbuildWithFrontend=true"
+        platforms: [windows]
+      - cmd: ./gradlew test -PbuildWithFrontend=true
+        platforms: [linux, darwin]
+      - cmd: cmd /c ".\gradlew.bat test -PbuildWithFrontend=true -PprototypesMode=true"
+        platforms: [windows]
+      - cmd: ./gradlew test -PbuildWithFrontend=true -PprototypesMode=true
+        platforms: [linux, darwin]
+      - cmd: cmd /c "set STIRLING_FLAVOR=core&& .\gradlew.bat test"
+        platforms: [windows]
+      - cmd: STIRLING_FLAVOR=core ./gradlew test
+        platforms: [linux, darwin]
+      - cmd: cmd /c "set STIRLING_FLAVOR=saas&& .\gradlew.bat test"
+        platforms: [windows]
+      - cmd: STIRLING_FLAVOR=saas ./gradlew test
+        platforms: [linux, darwin]
 
   format:
     desc: "Auto-fix code formatting"
+    # Mirror the test matrix so formatting is validated under the same backend
+    # configuration variants.
     cmds:
       - cmd: cmd /c ".\gradlew.bat spotlessApply"
         platforms: [windows]
       - cmd: ./gradlew spotlessApply
         platforms: [linux, darwin]
+      - cmd: cmd /c ".\gradlew.bat spotlessApply -PbuildWithFrontend=true"
+        platforms: [windows]
+      - cmd: ./gradlew spotlessApply -PbuildWithFrontend=true
+        platforms: [linux, darwin]
+      - cmd: cmd /c ".\gradlew.bat spotlessApply -PbuildWithFrontend=true -PprototypesMode=true"
+        platforms: [windows]
+      - cmd: ./gradlew spotlessApply -PbuildWithFrontend=true -PprototypesMode=true
+        platforms: [linux, darwin]
+      - cmd: cmd /c "set STIRLING_FLAVOR=core&& .\gradlew.bat spotlessApply"
+        platforms: [windows]
+      - cmd: STIRLING_FLAVOR=core ./gradlew spotlessApply
+        platforms: [linux, darwin]
+      - cmd: cmd /c "set STIRLING_FLAVOR=saas&& .\gradlew.bat spotlessApply"
+        platforms: [windows]
+      - cmd: STIRLING_FLAVOR=saas ./gradlew spotlessApply
+        platforms: [linux, darwin]
 
   format:check:
     desc: "Check code formatting"
+    # Mirror the test matrix so formatting checks use the same backend
+    # configuration variants.
     cmds:
       - cmd: cmd /c ".\gradlew.bat spotlessCheck"
         platforms: [windows]
       - cmd: ./gradlew spotlessCheck
         platforms: [linux, darwin]
+      - cmd: cmd /c ".\gradlew.bat spotlessCheck -PbuildWithFrontend=true"
+        platforms: [windows]
+      - cmd: ./gradlew spotlessCheck -PbuildWithFrontend=true
+        platforms: [linux, darwin]
+      - cmd: cmd /c ".\gradlew.bat spotlessCheck -PbuildWithFrontend=true -PprototypesMode=true"
+        platforms: [windows]
+      - cmd: ./gradlew spotlessCheck -PbuildWithFrontend=true -PprototypesMode=true
+        platforms: [linux, darwin]
+      - cmd: cmd /c "set STIRLING_FLAVOR=core&& .\gradlew.bat spotlessCheck"
+        platforms: [windows]
+      - cmd: STIRLING_FLAVOR=core ./gradlew spotlessCheck
+        platforms: [linux, darwin]
+      - cmd: cmd /c "set STIRLING_FLAVOR=saas&& .\gradlew.bat spotlessCheck"
+        platforms: [windows]
+      - cmd: STIRLING_FLAVOR=saas ./gradlew spotlessCheck
+        platforms: [linux, darwin]
 
   fix:
     desc: "Auto-fix backend"

app/common/build.gradle

@@ -6,7 +6,7 @@ spotless {
     java {
         target 'src/**/java/**/*.java'
         targetExclude 'src/main/java/org/apache/**'
-        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
+        googleJavaFormat(rootProject.ext.googleJavaFormatVersion).aosp().reorderImports(false)
         // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
         suppressLintsFor { setStep('google-java-format') }
 
@@ -29,19 +29,19 @@ spotless {
     }
 }
 dependencies {
-    api "com.google.guava:guava:${guavaVersion}"
+    api "com.google.guava:guava:${rootProject.ext.guavaVersion}"
     api 'org.springframework.boot:spring-boot-starter-webmvc'
     api 'org.springframework.boot:spring-boot-starter-aspectj'
     api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
     api 'com.fathzer:javaluator:3.0.6'
     api 'com.posthog.java:posthog:1.2.0'
-    api "org.apache.commons:commons-lang3:${commonsLang3}"
+    api "org.apache.commons:commons-lang3:${rootProject.ext.commonsLang3}"
     api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor
     api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
-    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
-    api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
-    api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
-    api "org.apache.pdfbox:preflight:$pdfboxVersion"
+    api "org.apache.pdfbox:pdfbox:${rootProject.ext.pdfboxVersion}"
+    api "org.apache.pdfbox:pdfbox-io:${rootProject.ext.pdfboxVersion}"
+    api "org.apache.pdfbox:xmpbox:${rootProject.ext.pdfboxVersion}"
+    api "org.apache.pdfbox:preflight:${rootProject.ext.pdfboxVersion}"
     api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
@@ -60,7 +60,7 @@ dependencies {
         exclude group: 'com.google.code.gson', module: 'gson'
     }
 
-    api "com.stirling:jpdfium:${jpdfiumVersion}"
+    api "com.stirling:jpdfium:${rootProject.ext.jpdfiumVersion}"
 
     // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
     def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
@@ -75,12 +75,12 @@ dependencies {
     }
     logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
     jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:${jpdfiumVersion}"
+        runtimeOnly "com.stirling:jpdfium-natives-${platform}:${rootProject.ext.jpdfiumVersion}"
     }
 
     // Bucket4j (local in-process token bucket for RateLimitStore default impl)
-    implementation "com.bucket4j:bucket4j_jdk17-core:${bucket4jVersion}"
+    implementation "com.bucket4j:bucket4j_jdk17-core:${rootProject.ext.bucket4jVersion}"
 
     // ArchUnit: enforces module dependency direction (see ArchitectureTest)
-    testImplementation "com.tngtech.archunit:archunit-junit5:${archunitVersion}"
+    testImplementation "com.tngtech.archunit:archunit-junit5:${rootProject.ext.archunitVersion}"
 }

app/core/.prettierignore

@@ -0,0 +1,2 @@
+# Auto-generated by MSW (`msw init`); regenerated verbatim, not hand-formatted.
+src/main/resources/static/mockServiceWorker.js

app/core/build.gradle

@@ -13,7 +13,7 @@ spotless {
     java {
         target 'src/**/java/**/*.java'
         targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
-        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
+        googleJavaFormat(rootProject.ext.googleJavaFormatVersion).aosp().reorderImports(false)
         // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
         suppressLintsFor { setStep('google-java-format') }
 
@@ -67,55 +67,55 @@ dependencies {
         exclude group: 'com.fasterxml.jackson.jaxrs'
         exclude group: 'com.fasterxml.jackson.module', module: 'jackson-module-jaxb-annotations'
     }
-    implementation "commons-io:commons-io:$commonsIoVersion"
-    implementation "org.bouncycastle:bcprov-jdk18on:$bouncycastleVersion"
-    implementation "org.bouncycastle:bcpkix-jdk18on:$bouncycastleVersion"
+    implementation "commons-io:commons-io:${rootProject.ext.commonsIoVersion}"
+    implementation "org.bouncycastle:bcprov-jdk18on:${rootProject.ext.bouncycastleVersion}"
+    implementation "org.bouncycastle:bcpkix-jdk18on:${rootProject.ext.bouncycastleVersion}"
     implementation 'io.micrometer:micrometer-core'
     implementation 'com.google.zxing:core:3.5.4'
-    implementation "org.commonmark:commonmark:$commonmarkVersion" // https://mvnrepository.com/artifact/org.commonmark/commonmark
-    implementation "org.commonmark:commonmark-ext-gfm-tables:$commonmarkVersion"
+    implementation "org.commonmark:commonmark:${rootProject.ext.commonmarkVersion}" // https://mvnrepository.com/artifact/org.commonmark/commonmark
+    implementation "org.commonmark:commonmark-ext-gfm-tables:${rootProject.ext.commonmarkVersion}"
 
     // General PDF dependencies
-    implementation "org.apache.pdfbox:preflight:$pdfboxVersion"
-    implementation "org.apache.pdfbox:xmpbox:$pdfboxVersion"
+    implementation "org.apache.pdfbox:preflight:${rootProject.ext.pdfboxVersion}"
+    implementation "org.apache.pdfbox:xmpbox:${rootProject.ext.pdfboxVersion}"
 
     implementation 'org.verapdf:validation-model:1.28.2'
     // CVE-2025-66453: Explicit rhino 1.7.15 to override verapdf's 1.7.13
-    implementation "org.mozilla:rhino:${rhinoVersion}"
+    implementation "org.mozilla:rhino:${rootProject.ext.rhinoVersion}"
 
     // veraPDF still uses javax.xml.bind, not the new jakarta namespace
     implementation 'javax.xml.bind:jaxb-api:2.3.1'
     implementation 'com.sun.xml.bind:jaxb-impl:2.3.9'
     implementation 'com.sun.xml.bind:jaxb-core:4.0.7'
 
     // CVE-2022-25647: Explicit gson to prevent unsafe deserialization (tabula would pull 2.8.7)
-    implementation "com.google.code.gson:gson:${gsonVersion}"
+    implementation "com.google.code.gson:gson:${rootProject.ext.gsonVersion}"
     implementation 'org.apache.pdfbox:jbig2-imageio:3.0.4'
     implementation 'com.opencsv:opencsv:5.12.0' // https://mvnrepository.com/artifact/com.opencsv/opencsv
     implementation 'org.apache.poi:poi-ooxml:5.5.1'
 
     // Batik only bridge module needed (transitively pulls anim, gvt, util, css, dom, svg-dom)
     // Replaces batik-all which included unused codec, svggen, transcoder, script modules
-    implementation "org.apache.xmlgraphics:batik-bridge:${batikVersion}"
+    implementation "org.apache.xmlgraphics:batik-bridge:${rootProject.ext.batikVersion}"
     // Required by TwelveMonkeys imageio-batik SPI (SVGImageReaderSpi) during ImageIO init
-    runtimeOnly "org.apache.xmlgraphics:batik-transcoder:${batikVersion}"
+    runtimeOnly "org.apache.xmlgraphics:batik-transcoder:${rootProject.ext.batikVersion}"
 
     // PDFBox Graphics2D bridge for Batik SVG to PDF conversion
     implementation 'de.rototor.pdfbox:graphics2d:3.0.5'
 
     // TwelveMonkeys
-    runtimeOnly "com.twelvemonkeys.imageio:imageio-batik:$imageioVersion"
-    runtimeOnly "com.twelvemonkeys.imageio:imageio-bmp:$imageioVersion"
-    runtimeOnly "com.twelvemonkeys.imageio:imageio-jpeg:$imageioVersion"
-    runtimeOnly "com.twelvemonkeys.imageio:imageio-tiff:$imageioVersion"
-    runtimeOnly "com.twelvemonkeys.imageio:imageio-webp:$imageioVersion"
+    runtimeOnly "com.twelvemonkeys.imageio:imageio-batik:${rootProject.ext.imageioVersion}"
+    runtimeOnly "com.twelvemonkeys.imageio:imageio-bmp:${rootProject.ext.imageioVersion}"
+    runtimeOnly "com.twelvemonkeys.imageio:imageio-jpeg:${rootProject.ext.imageioVersion}"
+    runtimeOnly "com.twelvemonkeys.imageio:imageio-tiff:${rootProject.ext.imageioVersion}"
+    runtimeOnly "com.twelvemonkeys.imageio:imageio-webp:${rootProject.ext.imageioVersion}"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-hdr:$imageioVersion"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-icns:$imageioVersion"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-iff:$imageioVersion"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-pcx:$imageioVersion@
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-pict:$imageioVersion"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-pnm:$imageioVersion"
-    runtimeOnly "com.twelvemonkeys.imageio:imageio-psd:$imageioVersion"
+    runtimeOnly "com.twelvemonkeys.imageio:imageio-psd:${rootProject.ext.imageioVersion}"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-sgi:$imageioVersion"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-tga:$imageioVersion"
     // runtimeOnly "com.twelvemonkeys.imageio:imageio-thumbsdb:$imageioVersion"
@@ -284,7 +284,9 @@ tasks.register('npmBuild', Exec) {
     group = 'frontend'
     description = 'Build editor frontend application'
     workingDir file('../..')
-    commandLine = ['task', frontendBuildTask]
+    commandLine = Os.isFamily(Os.FAMILY_WINDOWS) ?
+            ['powershell', '-NoProfile', '-Command', "task ${frontendBuildTask}"] :
+            ['task', frontendBuildTask]
     inputs.dir(new File(frontendEditorDir, 'src'))
     inputs.dir(new File(frontendEditorDir, 'public'))
     inputs.file(new File(frontendDir, 'package.json'))

app/core/src/main/resources/static/css/cookieconsentCustomisation.css

@@ -20,17 +20,18 @@
 
   --cc-separator-border-color: #e0e0e0;
 
-  --cc-toggle-on-bg: #007bff;
-  --cc-toggle-off-bg: #667481;
-  --cc-toggle-on-knob-bg: #ffffff;
-  --cc-toggle-off-knob-bg: #ffffff;
+  /* Toggle colors mirror Mantine Switch (light scheme) */
+  --cc-toggle-on-bg: var(--mantine-primary-color-filled, #007bff);
+  --cc-toggle-off-bg: var(--mantine-color-gray-3, #dee2e6);
+  --cc-toggle-on-knob-bg: var(--mantine-color-white, #ffffff);
+  --cc-toggle-off-knob-bg: var(--mantine-color-white, #ffffff);
 
   --cc-toggle-enabled-icon-color: #ffffff;
   --cc-toggle-disabled-icon-color: #ffffff;
 
-  --cc-toggle-readonly-bg: #f1f3f4;
-  --cc-toggle-readonly-knob-bg: #79747e;
-  --cc-toggle-readonly-knob-icon-color: #f1f3f4;
+  --cc-toggle-readonly-bg: var(--mantine-color-disabled, #f1f3f4);
+  --cc-toggle-readonly-knob-bg: var(--mantine-color-gray-0, #f8f9fa);
+  --cc-toggle-readonly-knob-icon-color: transparent;
 
   --cc-section-category-border: #e0e0e0;
 
@@ -69,17 +70,18 @@
 
   --cc-separator-border-color: #555555;
 
-  --cc-toggle-on-bg: #4dabf7;
-  --cc-toggle-off-bg: #667481;
-  --cc-toggle-on-knob-bg: #2d2d2d;
-  --cc-toggle-off-knob-bg: #2d2d2d;
+  /* Toggle colors mirror Mantine Switch (dark scheme) */
+  --cc-toggle-on-bg: var(--mantine-primary-color-filled, #4dabf7);
+  --cc-toggle-off-bg: var(--mantine-color-dark-5, #555555);
+  --cc-toggle-on-knob-bg: var(--mantine-color-white, #ffffff);
+  --cc-toggle-off-knob-bg: var(--mantine-color-white, #ffffff);
 
   --cc-toggle-enabled-icon-color: #2d2d2d;
   --cc-toggle-disabled-icon-color: #2d2d2d;
 
-  --cc-toggle-readonly-bg: #555555;
-  --cc-toggle-readonly-knob-bg: #8e8e8e;
-  --cc-toggle-readonly-knob-icon-color: #555555;
+  --cc-toggle-readonly-bg: var(--mantine-color-disabled, #555555);
+  --cc-toggle-readonly-knob-bg: var(--mantine-color-dark-3, #8e8e8e);
+  --cc-toggle-readonly-knob-icon-color: transparent;
 
   --cc-section-category-border: #555555;
 
@@ -176,9 +178,16 @@
   color: var(--cc-primary-color) !important;
 }
 
-/* Lower z-index so cookie banner appears behind onboarding modals */
+/* Banner sits above the chat FAB but behind all modals and onboarding; value
+   is Z_INDEX_COOKIE_CONSENT_BANNER, set as this variable by useCookieConsent */
 #cc-main {
-  z-index: 100 !important;
+  z-index: var(--z-index-cookie-consent) !important;
+}
+
+/* Preferences dialog sits above the settings modal it opens from; value is
+   Z_INDEX_COOKIE_PREFERENCES_MODAL, set as this variable by useCookieConsent */
+.show--preferences #cc-main {
+  z-index: var(--z-index-cookie-preferences) !important;
 }
 
 /* Ensure consent modal text is visible in both themes */
@@ -203,3 +212,63 @@
 #cc-main .cm__link {
   color: var(--cc-primary-color) !important;
 }
+
+/* ── Category toggles restyled to match Mantine Switch (size sm) ──────────
+   Mantine sm metrics: 38×20 track, 14px plain thumb, 2.5px inline padding,
+   150ms ease transitions, no icon inside the thumb. Colors come from the
+   --cc-toggle-* variables above, which point at the Mantine palette. */
+#cc-main .section__toggle,
+#cc-main .section__toggle-wrapper,
+#cc-main .toggle__icon,
+#cc-main .toggle__label {
+  width: 38px !important;
+  height: 20px !important;
+  border-radius: 1000px !important;
+}
+
+/* Track: flat fill, no outline ring or border */
+#cc-main .toggle__icon {
+  border: none !important;
+  box-shadow: none !important;
+  transition: background-color 150ms ease !important;
+}
+
+#cc-main .section__toggle:checked ~ .toggle__icon {
+  border: none !important;
+  box-shadow: none !important;
+}
+
+/* Always-enabled categories = Mantine disabled switch (must out-prioritise
+   the !important checked-track rule above) */
+#cc-main .section__toggle:checked:disabled ~ .toggle__icon {
+  background: var(--cc-toggle-readonly-bg) !important;
+  border: none !important;
+  box-shadow: none !important;
+}
+
+#cc-main .section__toggle:disabled {
+  cursor: not-allowed !important;
+}
+
+/* Thumb: small plain circle, vertically centred, no drop shadow */
+#cc-main .toggle__icon-circle {
+  width: 14px !important;
+  height: 14px !important;
+  top: 3px !important;
+  left: 2.5px !important;
+  box-shadow: none !important;
+  transition:
+    transform 150ms ease,
+    background-color 150ms ease !important;
+}
+
+/* Checked thumb travel: 38 − 14 − 2.5 = 21.5px end position */
+#cc-main .section__toggle:checked ~ .toggle__icon .toggle__icon-circle {
+  transform: translateX(19px) !important;
+}
+
+/* Mantine switches have no check/cross glyph inside the thumb */
+#cc-main .toggle__icon-on,
+#cc-main .toggle__icon-off {
+  display: none !important;
+}