EL Placeholder support in @RolesAllowed annotation

[odellamaggiore]

Describe the bug

If we use an EL placeholder in @RolesAllowed annotation value, to make a reference to a config property, the placeholder is not resolved. Example:

MyClass.java

@RolesAllowed("myrole_${role.suffix}")
public class MyClass

application.yml

role:
  suffix: someValue

This is something that works with Jakarta EE on EAP/Wildfly so I expected it to work also with Quarkus.

Expected behavior

@RolesAllowed annotation value resolved to "myrole_someValue"

Actual behavior

@RolesAllowed annotation value remains "myrole_${role.suffix}"

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[sberyozkin]

Hi @radcortez, @dmlloyd Is it something that our configuration system can help with ? I guess it should work similar to this:

• The code which introspects in this case @RolesAllowed gets the annotation value and then, given the example in this issue,
• Config.resolve("myrole_${role.suffix}") and gets back myrole_someValue

I believe such a resolver code already exists since we already support such indirect property references in application.properties

Thanks

[dmlloyd]

Sure, it should be possible. The expression resolution is performed by smallrye-common-expression with a resolver which assesses the configuration system for its values.

[vsevel]

I believe such a resolver code already exists since we already support such indirect property references in application.properties

hi @sberyozkin agreed. and that has been supported for many years in jboss.

[radcortez]

Check:

• https://github.com/smallrye/smallrye-common/blob/main/expression/src/main/java/io/smallrye/common/expression/Expression.java
• https://github.com/smallrye/smallrye-config/blob/main/implementation/src/main/java/io/smallrye/config/ExpressionConfigSourceInterceptor.java#L39-L68

Let me know if you need any help

[vsevel]

hello, do you think this is likely to be implemented at some point?

[radcortez]

Ideally if this could come from the community it would be faster :)

[vsevel]

thanks for this honest answer @radcortez ;) I have thought about it. I should have more time early next year.

[radcortez]

Great. Thanks. Feel free to reach out if you need help.

[michalvavrik]

Looks like interesting issue, I can have a look provided @vsevel is fine with that.

[vsevel]

sure. np. happy to test if you need. @michalvavrik

[michalvavrik]

Thank you.