Make "denyUnannotated" config prop only build-time fixed

quarkusio · Jan 4, 2025 · 1d5b794 · 1d5b794
1 parent 72dd7dc
commit 1d5b794
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 43 deletions.
diff --git a/...ions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityConfig.java b/...ions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityConfig.java
@@ -34,4 +34,25 @@ public interface SecurityConfig {
      */
     @ConfigDocMapKey("provider-name")
     Map<String, String> securityProviderConfig();
+
+    /**
+     * If set to true, access to all methods of beans that have any security annotations on other members will be denied by
+     * default.
+     * E.g. if enabled, in the following bean, <code>methodB</code> will be denied.
+     *
+     * <pre>
+     *   &#064;ApplicationScoped
+     *   public class A {
+     *      &#064;RolesAllowed("admin")
+     *      public void methodA() {
+     *          ...
+     *      }
+     *      public void methodB() {
+     *          ...
+     *      }
+     *   }
+     * </pre>
+     */
+    @WithDefault("false")
+    boolean denyUnannotatedMembers();
 }
diff --git a/...s/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java b/...s/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java
@@ -109,7 +109,6 @@
 import io.quarkus.security.runtime.IdentityProviderManagerCreator;
 import io.quarkus.security.runtime.QuarkusPermissionSecurityIdentityAugmentor;
 import io.quarkus.security.runtime.QuarkusSecurityRolesAllowedConfigBuilder;
-import io.quarkus.security.runtime.SecurityBuildTimeConfig;
 import io.quarkus.security.runtime.SecurityCheckRecorder;
 import io.quarkus.security.runtime.SecurityIdentityAssociation;
 import io.quarkus.security.runtime.SecurityIdentityProxy;
@@ -550,9 +549,8 @@ void transformAdditionalSecuredClassesToMethods(List<AdditionalSecuredClassesBui
      */
     @BuildStep
     void transformSecurityAnnotations(BuildProducer<AnnotationsTransformerBuildItem> transformers,
-            List<AdditionalSecuredMethodsBuildItem> additionalSecuredMethods,
-            SecurityBuildTimeConfig config) {
-        if (config.denyUnannotated()) {
+            List<AdditionalSecuredMethodsBuildItem> additionalSecuredMethods) {
+        if (security.denyUnannotatedMembers()) {
             transformers.produce(new AnnotationsTransformerBuildItem(AnnotationTransformation
                     .forClasses()
                     .whenClass(new DenyUnannotatedPredicate())
@@ -747,7 +745,7 @@ MethodSecurityChecks gatherSecurityChecks(
             BuildProducer<ClassSecurityCheckStorageBuildItem> classSecurityCheckStorageProducer,
             List<RegisterClassSecurityCheckBuildItem> registerClassSecurityCheckBuildItems,
             BuildProducer<ReflectiveClassBuildItem> reflectiveClassBuildItemBuildProducer,
-            List<AdditionalSecurityCheckBuildItem> additionalSecurityChecks, SecurityBuildTimeConfig config,
+            List<AdditionalSecurityCheckBuildItem> additionalSecurityChecks,
             PermissionSecurityChecksBuilderBuildItem permissionSecurityChecksBuilderBuildItem,
             BuildProducer<GeneratedClassBuildItem> generatedClassesProducer,
             BuildProducer<ReflectiveClassBuildItem> reflectiveClassesProducer) {
@@ -765,7 +763,7 @@ MethodSecurityChecks gatherSecurityChecks(
 
         IndexView index = beanArchiveBuildItem.getIndex();
         Map<MethodInfo, SecurityCheck> securityChecks = gatherSecurityAnnotations(index, configExpSecurityCheckProducer,
-                additionalSecured.values(), config.denyUnannotated(), recorder, configBuilderProducer,
+                additionalSecured.values(), security.denyUnannotatedMembers(), recorder, configBuilderProducer,
                 reflectiveClassBuildItemBuildProducer, rolesAllowedConfigExpResolverBuildItems,
                 registerClassSecurityCheckBuildItems, classSecurityCheckStorageProducer, hasAdditionalSecAnn,
                 additionalSecurityAnnotationItems, permissionSecurityChecksBuilderBuildItem.instance,

diff --git a/...s/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityBuildTimeConfig.java b/...s/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityBuildTimeConfig.java