style: apply spotless so mvn verify passes on CI

src/main/java/io/jenkins/plugins/MfaFilter.java

@@ -65,8 +65,8 @@ public class MfaFilter implements Filter {
 
         if (mfaRequired) {
             HttpSession session = req.getSession(false);
-            boolean verified = session != null
-                    && Boolean.TRUE.equals(session.getAttribute(MfaConstants.MFA_VERIFIED_ATTR));
+            boolean verified =
+                    session != null && Boolean.TRUE.equals(session.getAttribute(MfaConstants.MFA_VERIFIED_ATTR));
 
             if (verified) {
                 verified = !isSessionExpired(session, globalConfig);

src/main/java/io/jenkins/plugins/MfaUserProperty.java

@@ -29,8 +29,7 @@ public class MfaUserProperty extends UserProperty {
             if (secretKey == null || secretKey.isEmpty()) {
                 // Re-save with MFA already configured: preserve existing secret
                 User currentUser = User.current();
-                MfaUserProperty existing = currentUser != null
-                        ? currentUser.getProperty(MfaUserProperty.class) : null;
+                MfaUserProperty existing = currentUser != null ? currentUser.getProperty(MfaUserProperty.class) : null;
                 if (existing != null && existing.secretKey != null) {
                     this.userConfiguredMfa = true;
                     this.secretKey = existing.secretKey;
@@ -54,8 +53,8 @@ public class MfaUserProperty extends UserProperty {
         if (mfaEnabled) {
             StaplerRequest2 currentReq = Stapler.getCurrentRequest2();
             if (currentReq != null) {
-                String pending = (String) currentReq.getSession()
-                        .getAttribute(MfaConstants.MFA_PENDING_BACKUP_CODES_ATTR);
+                String pending =
+                        (String) currentReq.getSession().getAttribute(MfaConstants.MFA_PENDING_BACKUP_CODES_ATTR);
                 if (pending != null && !pending.isEmpty()) {
                     this.backupCodesData = Secret.fromString(pending);
                     currentReq.getSession().removeAttribute(MfaConstants.MFA_PENDING_BACKUP_CODES_ATTR);

src/main/java/io/jenkins/plugins/MfaVerifyAction.java

@@ -38,8 +38,7 @@ public class MfaVerifyAction implements RootAction {
         }
 
         if (MfaRateLimiter.isLocked(u.getId())) {
-            AUDIT.log(Level.WARNING, "MFA_LOCKED user={0} ip={1}",
-                    new Object[]{u.getId(), req.getRemoteAddr()});
+            AUDIT.log(Level.WARNING, "MFA_LOCKED user={0} ip={1}", new Object[] {u.getId(), req.getRemoteAddr()});
             rsp.sendRedirect(req.getContextPath() + "/mfa-verify?error=locked");
             return;
         }
@@ -54,8 +53,9 @@ public class MfaVerifyAction implements RootAction {
                     verified = mfa.consumeBackupCode(code);
                     if (verified) {
                         u.save();
-                        AUDIT.log(Level.INFO, "MFA_BACKUP_CODE_USED user={0} ip={1}",
-                                new Object[]{u.getId(), req.getRemoteAddr()});
+                        AUDIT.log(Level.INFO, "MFA_BACKUP_CODE_USED user={0} ip={1}", new Object[] {
+                            u.getId(), req.getRemoteAddr()
+                        });
                     }
                 } catch (IOException e) {
                     LOGGER.log(Level.SEVERE, "Failed to save user after backup code consumption", e);
@@ -68,13 +68,13 @@ public class MfaVerifyAction implements RootAction {
                 MfaRateLimiter.reset(u.getId());
                 req.getSession().setAttribute(MfaConstants.MFA_VERIFIED_ATTR, true);
                 req.getSession().setAttribute(MfaConstants.MFA_VERIFIED_AT_ATTR, System.currentTimeMillis());
-                AUDIT.log(Level.INFO, "MFA_SUCCESS user={0} ip={1}",
-                        new Object[]{u.getId(), req.getRemoteAddr()});
+                AUDIT.log(Level.INFO, "MFA_SUCCESS user={0} ip={1}", new Object[] {u.getId(), req.getRemoteAddr()});
                 rsp.sendRedirect(req.getContextPath() + "/");
             } else {
                 MfaRateLimiter.recordFailure(u.getId());
-                AUDIT.log(Level.WARNING, "MFA_FAILURE user={0} ip={1} attempts={2}",
-                        new Object[]{u.getId(), req.getRemoteAddr(), MfaRateLimiter.getAttemptCount(u.getId())});
+                AUDIT.log(Level.WARNING, "MFA_FAILURE user={0} ip={1} attempts={2}", new Object[] {
+                    u.getId(), req.getRemoteAddr(), MfaRateLimiter.getAttemptCount(u.getId())
+                });
                 rsp.sendRedirect(req.getContextPath() + "/mfa-verify?error=1");
             }
             return;

src/main/java/io/jenkins/plugins/QrCodeAction.java

@@ -54,9 +54,9 @@ public class QrCodeAction implements RootAction {
             String[] backupCodes = BackupCodeUtil.generateCodes();
             String[] backupHashes = BackupCodeUtil.hashCodes(backupCodes);
             // Store hashes in session so they survive form submission
-            req.getSession().setAttribute(
-                    MfaConstants.MFA_PENDING_BACKUP_CODES_ATTR,
-                    BackupCodeUtil.toStorageString(backupHashes));
+            req.getSession()
+                    .setAttribute(
+                            MfaConstants.MFA_PENDING_BACKUP_CODES_ATTR, BackupCodeUtil.toStorageString(backupHashes));
 
             JSONObject json = new JSONObject();
             json.put("secret", secret);

src/test/java/io/jenkins/plugins/BackupCodeUtilTest.java

@@ -18,8 +18,7 @@ class BackupCodeUtilTest {
     @Test
     void generateCodes_allUnique() {
         String[] codes = BackupCodeUtil.generateCodes();
-        assertEquals(codes.length, new HashSet<>(Arrays.asList(codes)).size(),
-                "All backup codes should be unique");
+        assertEquals(codes.length, new HashSet<>(Arrays.asList(codes)).size(), "All backup codes should be unique");
     }
 
     @Test

src/test/java/io/jenkins/plugins/MfaRateLimiterTest.java

@@ -45,8 +45,7 @@ class MfaRateLimiterTest {
         long expiredTime = (System.currentTimeMillis() / 1000) - MfaRateLimiter.LOCKOUT_SECONDS - 1;
         MfaRateLimiter.setLastAttemptAt("alice", expiredTime);
 
-        assertFalse(MfaRateLimiter.isLocked("alice"),
-                "Lock should be released after lockout period expires");
+        assertFalse(MfaRateLimiter.isLocked("alice"), "Lock should be released after lockout period expires");
     }
 
     @Test

src/test/java/io/jenkins/plugins/TOTPUtilTest.java

@@ -36,7 +36,8 @@ class TOTPUtilTest {
         String secret = TOTPUtil.generateSecret();
         long time = System.currentTimeMillis() / 1000 / TOTPUtil.TIME_STEP;
         String previousCode = TOTPUtil.generateTOTP(secret, time - 1);
-        assertTrue(TOTPUtil.verifyCode(secret, previousCode),
+        assertTrue(
+                TOTPUtil.verifyCode(secret, previousCode),
                 "Should accept code from previous 30-second window (clock skew tolerance)");
     }
 
@@ -45,7 +46,8 @@ class TOTPUtilTest {
         String secret = TOTPUtil.generateSecret();
         long time = System.currentTimeMillis() / 1000 / TOTPUtil.TIME_STEP;
         String nextCode = TOTPUtil.generateTOTP(secret, time + 1);
-        assertTrue(TOTPUtil.verifyCode(secret, nextCode),
+        assertTrue(
+                TOTPUtil.verifyCode(secret, nextCode),
                 "Should accept code from next 30-second window (clock skew tolerance)");
     }
 
@@ -54,8 +56,7 @@ class TOTPUtilTest {
         String secret = TOTPUtil.generateSecret();
         long time = System.currentTimeMillis() / 1000 / TOTPUtil.TIME_STEP;
         String staleCode = TOTPUtil.generateTOTP(secret, time - 2);
-        assertFalse(TOTPUtil.verifyCode(secret, staleCode),
-                "Should reject code older than 1 window");
+        assertFalse(TOTPUtil.verifyCode(secret, staleCode), "Should reject code older than 1 window");
     }
 
     @Test
@@ -77,7 +78,7 @@ class TOTPUtilTest {
     @Test
     void verifyCode_withWrongLength_returnsFalse() {
         String secret = TOTPUtil.generateSecret();
-        assertFalse(TOTPUtil.verifyCode(secret, "12345"));   // too short
+        assertFalse(TOTPUtil.verifyCode(secret, "12345")); // too short
         assertFalse(TOTPUtil.verifyCode(secret, "1234567")); // too long
     }