Refactor RESTEasy Classic default JAX-RS security to make endpoint detection more robust

[michalvavrik]

This solution replaces build time detection of endpoints which proved to be an issue in past. I think it's more secure as annotation inheritance discord between CDI and JAX-RS is really complex.

[sberyozkin]

Michal, @michalvavrik Thanks, it does look like it simplifies things, but I'd like to question if it is necessary to do this security related refactoring for the legacy extension, where everything is settled now, and we recommend the Resteasy Reactive extension.

The code is simpler but it is a new code and we already cover the deny all use case with your fixes, tests

[michalvavrik]

if it is necessary to do this security related refactoring for the legacy extension

this extension is not deprecated, I'll treat it differently when the deprecation happens; right now, there is product level support and according to discussion on renaming of RESTEasy Reactive, this extension is one used by majority of Jakarta REST users

where everything is settled now

Maybe I didn't describe it correctly in the PR description - current detection of endpoints is far from perfect, I did my best, but I don't believe I covered every inheritance combination. There is theoretical chance I covered all of them, but I think that's what we had thought last time. This is hardening PR.

[michalvavrik]

BTW I couldn't do this originally because of the order of 2 PRs, this needed to be based on the combination of previous RC fixes.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 46b39c8.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

---

Flaky tests - Develocity

⚙️ JVM Tests - JDK 17

📦 extensions/smallrye-reactive-messaging-kafka/deployment

✖ io.quarkus.smallrye.reactivemessaging.kafka.deployment.dev.KafkaDevServicesDevModeTestCase.sseStream - History

• Assertion condition defined as a io.quarkus.smallrye.reactivemessaging.kafka.deployment.dev.KafkaDevServicesDevModeTestCase Expecting size of: [] to be greater than or equal to 2 but was 0 within 10 seconds. - org.awaitility.core.ConditionTimeoutException

org.awaitility.core.ConditionTimeoutException: 
Assertion condition defined as a io.quarkus.smallrye.reactivemessaging.kafka.deployment.dev.KafkaDevServicesDevModeTestCase 
Expecting size of:
  []
to be greater than or equal to 2 but was 0 within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:119)
	at org.awaitility.core.AssertionCondition.await(AssertionCondition.java:31)

[sberyozkin]

I'd like to wait till Monday, @stuartwdouglas - have a quick look please if you can, it looks good