Fix mixing of the @TestSecurity annotation with HTTP request credentials inside one test method

[michalvavrik]

fixes: #41125

Before #40059 it was possible to mix the @TestSecurity with actual credentials. We didn't have it well tested because #40059 didn't fail any tests. With this PR, it is possible again and there are tests and additional documentation.

[github-actions]

🙈 The PR is closed and the preview is expired.

[sberyozkin]

Thanks @michalvavrik.

Did you have a chance to check why it worked before, was it by pure luck ? I'm just wondering since the updates in the PR are quite involved, so I'd like to understand better what exactly we are fixing here. Thanks

[michalvavrik]

Thanks @michalvavrik. Did you have a chance to check why it worked before, was it by pure luck ?

There is this small section that probably describes it is supposed to work https://quarkus.io/guides/security-testing#mixing-security-tests. It could also mean that you are supposed to test basic in a test method not annotated with @TestSecurity. Based on #41125 we know at least about one affected user. Also I think we don't force anyone, but keeping this option open to use it is positive.

I'm just wondering since the updates in the PR are quite involved, so I'd like to understand better what exactly we are fixing here. Thanks

I tried to explain it in Javadoc, but I can improve that if it is not clear. Let me try here as well. Consider test scenario:

• endpoint is annotated with @BasicAuthentication or HTTP permission quarkus.http.auth.permission.authenticated.auth-mechanism=basic is applied and authentication is required:
  • there must be exactly one authentication mechanism matching 'basic' authentication type
  • in past, test mechanism had lower priority than basic and oidc etc. therefore you could not do https://quarkus.io/guides/security-testing#path-based-authentication @TestSecurity(authMechanism = "basic"), therefore in Support path-based authentication with @TestSecurity annotation #40059 I had to do something about the mechanism priority and I raised it to 3000
• endpoint is annotated with @Authenticated and no HTTP permission is applied, then:
  • Quarkus iterates over already sorted mechanisms and the first one that is willing to authenticate wins
  • If no mechanisms authenticates, for example because there is no basic authorization header, test mechanism wins
  • that was there before and I'm adding it back

Please ask more question if it is unclear.

[sberyozkin]

I think it makes sense, I was just curious why it worked before, thanks @michalvavrik, I'll suggest a few minor doc updates a bit later, otherwise looks good.

[sberyozkin]

Let's merge once a couple of minor suggestions are done

[michalvavrik]

3.12 was branched just yesterday, so I'll add a backport label as it is a bug fix; we can probably stay conservative and do not backport it to 3.11 as 3.12 is out soon...

[quarkus-bot]

Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 5164af2.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

⚠️ There are other workflow runs running, you probably need to wait for their status before merging.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 5164af2.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.