Pass secured method arguments into security checks for @PreAuthorize security annotation on SpringWeb endpoints

[michalvavrik]

• closes: NPE during custom bean invocation via PreAuthorize annotation in Quarkus RESTEasy #44511

When @PreAuthorize placed on endpoints requires secured method arguments, we need to divide security check into 2, one is done eagerly ("is authenticated") and one is done by CDI interceptors when secured method arguments are already available. This is valid for both RESTEasy and Quarkus REST used together with Spring Web, but we only need to test that

quarkus/extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/SecurityCheck.java

Line 46 in 9007580

default boolean requiresMethodArguments() {

returns true (as the mechanism itself is heavily tested for other reasons). I don't know if in Spring you can pass secured method arguments for anonymous users as well, but that we won't support.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 245a281.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

[geoand]

Thanks a lot!