OpenAPI does not correctly generate security schema when @RolesAllowed is used

[jsmrcka]

Describe the bug

quarkus-smallrye-openapi creates incorrect security schema for endpoints, which use @RolesAllowed annotation on both class level and method level.
E.g.:

@Path("/roles-allowed-user")
@RolesAllowed("user")
public class RolesAllowedResource {

    @GET
    public void rolesAllowedUser() {
    }

    @GET
    @Path("/roles-allowed-admin")
    @RolesAllowed("admin")
    public void rolesAllowedAdmin() {
    }
}

Then the /q/openapi produces:

---
openapi: 3.0.3
info:
  title: openapi-security-reproducer API
  version: 1.0.0-SNAPSHOT
paths:
  /roles-allowed-user:
    get:
      tags:
      - Roles Allowed Resource
      responses:
        "204":
          description: No Content
        "401":
          description: Not Authorized
        "403":
          description: Not Allowed
      security:
      - SecurityScheme:
        - user
  /roles-allowed-user/roles-allowed-admin:
    get:
      tags:
      - Roles Allowed Resource
      responses:
        "204":
          description: No Content
        "401":
          description: Not Authorized
        "403":
          description: Not Allowed
      security:
      - SecurityScheme:
        - user
components:
  securitySchemes:
    SecurityScheme:
      type: http
      description: Authentication
      scheme: basic

The actual behavior of the /roles-allowed-user/roles-allowed-admin endpoint correctly reflects the security specification and requires the admin role.
However, the OpenAPI schema shows the user role in the endpoint.

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

git clone [email protected]:jsmrcka/openapi-security-reproducer.git
mvn -f ./openapi-security-reproducer test

Output of uname -a or ver

Linux ... 6.0.15-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Dec 21 18:33:23 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Output of java -version

openjdk version "11.0.12" 2021-07-20

GraalVM version (if different from Java)

No response

Quarkus version or git rev

999-SNAPSHOT, 2.16.1.Final

Build tool (ie. output of mvnw --version or gradlew --version)

3.8.6

Additional information

No response

[quarkus-bot]

/cc @EricWittmann (openapi), @MikeEdgar (openapi), @phillip-kruger (openapi), @sberyozkin (security)

[phillip-kruger]

Agree, this is a bug. I'll have a look a.s.a.p. If you are in a hurry please do a PR.

[Plawn]

Ok, I'm not crazy, got this issue for months but never bothered to create the issue