Merge branch 'main' into SOLR_17712_remove_waitForFinalState_default_true

Author: abumarjikar

AGENTS.md

@@ -29,7 +29,7 @@ While README.md and CONTRIBUTING.md are mainly written for humans, this file is
 
 ## Build and Development Workflow
 
-- When done or preparing to commit changes to java source files, be sure to run `gradlew tidy` to format the code
+- When done or preparing to commit changes to java source files, be sure to run `gradlew tidy` to format the code.  Don't bother beforehand.
 - Always run `gradlew check -x test` before declaring a feature done
 
 ## Code Quality and Best Practices
@@ -38,15 +38,25 @@ While README.md and CONTRIBUTING.md are mainly written for humans, this file is
 - Be careful to not add non-essential logging! If you add slf4j log calls, make sure to wrap debug/trace level calls in `logger.isXxxEnabled()` clause
 - Validate user input. For file paths, always call `myCoreContainer.assertPathAllowed(myPath)` before using
 
-## Testing
+## Running Tests
+
+- See `dev-docs/gradle-help/tests.txt` for hints on running tests
+- To run a specific test: `gradlew :solr:core:test --tests "org.apache.solr.search.TestCaffeineCache"`
+- To run a specific BATS test: `gradlew iTest --tests test_adminconsole_urls.bats`
+- The randomization seed is important.  To repeat a failing tests, pass the same seed given in the failure by adding to Gradle: `-Ptests.seed=HEXADECIMALHERE`.
+- Test output goes to `solr/<module>/build/test-results/test/outputs/OUTPUT-<fully.qualified.TestName>.txt` (stdout/stderr log) and `solr/<module>/build/test-results/test/TEST-<fully.qualified.TestName>.xml` (JUnit XML with pass/fail/error details)
+- To scan test output for a specific issue across already-run tests: `grep -rl "pattern" solr/*/build/test-results/test/outputs/`
+
+## Writing Tests
 
 - When adding a test to an existing suite/file, keep the same style / design choices
 - When adding a *new* Java test suite/file:
-  - Subclass SolrTestCase, or if SolrCloud is needed then SolrCloudTestCase
-  - If SolrTestCase and need to embed Solr, use either EmbeddedSolrServerTestRule (doesn't use HTTP) or SolrJettyTestRule if HTTP/Jetty is relevant to what is being tested.
-  - Avoid SolrTestCaseJ4 for new tests
-
-- See `dev-docs/gradle-help/tests.txt` for hints on running tests
+    - Subclass SolrTestCase, or if SolrCloud is needed then SolrCloudTestCase
+    - If SolrTestCase and need to embed Solr, use either EmbeddedSolrServerTestRule (doesn't use HTTP) or SolrJettyTestRule if HTTP/Jetty is relevant to what is being tested.
+    - Avoid SolrTestCaseJ4 for new tests
+- For BATS shell integration tests in `solr/packaging/test/`:
+    - Always use `run <command>` followed by `assert_output --partial "..."` or `refute_output --partial "..."` instead of capturing output into local variables and using `[[ ]]` comparisons
+    - Avoid patterns like `local var=$(cmd | grep ...); [[ "$var" == *"..."* ]]` — use `run cmd` + `assert_output`/`refute_output` instead
 
 ## Documentation
 

changelog/unreleased/SOLR-18041.yml

@@ -1,8 +1,10 @@
-# See https://github.com/apache/solr/blob/main/dev-docs/changelog.adoc
-title: SOLR 18041 - Path exclusions for the admin UI are now defined in a separate servlet filter
-type: other # added, changed, fixed, deprecated, removed, dependency_update, security, other
+title: Path exclusions for the admin UI no longer need bespoke Solr code.
+type: other
 authors:
   - name: Gus Heck
+  - name: David Smiley
 links:
   - name: SOLR-18041
     url: https://issues.apache.org/jira/browse/SOLR-18041
+  - name: SOLR-18168
+    url: https://issues.apache.org/jira/browse/SOLR-18168

changelog/unreleased/SOLR-18185-pomPublishVersions.yml

@@ -0,0 +1,7 @@
+title: Published POMs now include resolved dependency versions, fixing ambiguous/missing version problems.
+type: fixed
+authors:
+  - name: David Smiley
+links:
+  - name: SOLR-18185
+    url: https://issues.apache.org/jira/browse/SOLR-18185

changelog/unreleased/SOLR-18186-fix-heap-used-percent-adminui.yml

@@ -0,0 +1,7 @@
+title: Fixed Admin UI to use max heap (-Xmx) value instead of committed heap to compute heap used percentage.
+type: fixed # added, changed, fixed, deprecated, removed, dependency_update, security, other
+authors:
+  - name: Ravi Ranjan Jha
+links:
+  - name: SOLR-18186
+    url: https://issues.apache.org/jira/browse/SOLR-18186

gradle/maven/defaults-maven.gradle

@@ -149,6 +149,12 @@ configure(subprojects.findAll {it.path in rootProject.published}) {prj ->
 
           pom(configurePom)
 
+          // Publish resolved/locked dependency versions instead of declared catalog versions
+          versionMapping {
+            usage('java-api') { fromResolutionOf('runtimeClasspath') }
+            usage('java-runtime') { fromResolutionResult() }
+          }
+
           // Remove the internal :platform dependency from dependencyManagement in POMs
           pom.withXml {
             def root = asNode()

solr/core/src/java/org/apache/solr/servlet/PathExclusionFilter.java

@@ -282,6 +282,7 @@ task integrationTests(type: BatsTask) {
   }
 
   inputs.dir(distDir)
+  inputs.dir('test')  // Track .bats test files and helper as inputs
   outputs.dir(integrationTestOutput)
 
   doFirst {
@@ -311,7 +312,9 @@ task integrationTests(type: BatsTask) {
 }
 
 class BatsTask extends Exec {
-  @InputDirectory
+  // Note: testDir is marked @Internal because it's a String configuration property, not a trackable input.
+  // The task using BatsTask should explicitly declare inputs.dir(testDir) in its configuration.
+  @Internal
   String testDir = 'test'
 
   @Input

solr/core/src/test/org/apache/solr/servlet/LoadAdminUiServletTest.java

@@ -28,11 +28,37 @@ teardown() {
   solr stop --all >/dev/null 2>&1
 }
 
+
 @test "assert able to launch solr admin console" {
   run solr start
 
   run curl -s -o /dev/null -w "%{http_code}" http://localhost:${SOLR_PORT}/solr/
+  assert_output "200"
+
+  run curl -s -I http://localhost:${SOLR_PORT}/solr/
+  assert_output --partial "text/html"
 
-  # Check if the HTTP response code is 200 (OK)
+  run curl -s http://localhost:${SOLR_PORT}/solr/
+  assert_output --partial "<html"
+
+  run curl -s -o /dev/null -w "%{http_code}" http://localhost:${SOLR_PORT}/solr/css/angular/chosen.css
   assert_output "200"
+
+  run curl -s -I http://localhost:${SOLR_PORT}/solr/css/angular/chosen.css
+  assert_output --partial "text/css"
+
+  run curl -s http://localhost:${SOLR_PORT}/solr/css/angular/chosen.css
+  assert_output --partial "{"
+}
+
+@test "assert CSP header contains custom connect src URLs" {
+  # Set custom CSP connect-src URLs via system property
+  local csp_urls="http://example1.com/token,https://example2.com/path/uri1,http://example3.com/oauth2/uri2"
+
+  run solr start -Dsolr.ui.headers.csp.connect-src.urls="${csp_urls}"
+
+  run curl -s -I http://localhost:${SOLR_PORT}/solr/
+  assert_output --partial "http://example1.com/token"
+  assert_output --partial "https://example2.com/path/uri1"
+  assert_output --partial "http://example3.com/oauth2/uri2"
 }

solr/packaging/build.gradle

@@ -75,7 +75,6 @@ dependencies {
   testRuntimeOnly(libs.eclipse.jetty.alpnjavaserver, {
     exclude group: "org.eclipse.jetty.alpn", module: "alpn-api"
   })
-  testImplementation libs.eclipse.jetty.session
 
   testImplementation(libs.mockito.core, {
     exclude group: "net.bytebuddy", module: "byte-buddy-agent"