Add PermissionsAllowed security annotation and default simple string comparison permission
#22
Conversation
|
This blocks me as I can't open Quarkus PR till this get reviewed & merged & released. I can't assign reviewer in this project. |
|
Hi @michalvavrik, Stuart is the project owner and he is away right now :-). Stuart, can you please add myself or someone else to the project admins so that we can review/merge PRs. |
|
@michalvavrik is there a corresponding Quarkus draft PR ready to go? I don't really want to add this API until we have the implementation also ready to go (if the implementation is not ready in time we risk shipping an API that does not work). |
|
@stuartwdouglas I'll open PR next week and request review from you. |
src/main/java/io/quarkus/security/identity/SecurityIdentity.java
Outdated
Show resolved
Hide resolved
Adds `PermissionAllowed` security annotation as required pre-step for quarkusio/quarkus#10988 and transitively for quarkusio/quarkus#12219. "params" attribute can't be supported for RESTEasy Reactive endpoints as I believe whole point of the quarkusio/quarkus#19598 was to run security checks before serialization, but IMO it still makes sense to keep it for cases where security checks are done through the interceptor (e.g. beans and RESTEasy Classic endpoints) The annotation is added here to accompany another standard security annotation - `@Authenticated`.
michalvavrik
requested review from
sberyozkin and
stuartwdouglas
and removed request for
sberyozkin
|
@stuartwdouglas ready to merge? |
|
@stuartwdouglas Hi Stuart, can you actually merge now and release ? I can't approve or merge |
|
I don't have release permissions |
|
Release done. |
Adds
PermissionAllowedsecurity annotation as required pre-step for quarkusio/quarkus#10988 and transitively for quarkusio/quarkus#12219. "params" attribute can't be supported for RESTEasy Reactive endpoints as I believe whole point of the quarkusio/quarkus#19598 was to run security checks before serialization, but IMO it still makes sense to keep it for cases where security checks are done by CDI interceptor (e.g. beans and RESTEasy Classic endpoints)The annotation is added here to accompany another standard security annotation -
@Authenticated.SecurityIdentitynewly containsgetPermissionCheckersas if you want to augment identity with SecurityIdentityAugmentor and keep previous permission checkers, currently you have no option.