1.11.0 quarkus-smallrye-jwt-build does not work standalone

[huw0]

Describe the bug
Generating a JWT token results in a stacktrace if only the new quarkus-smallrye-jwt-build dependency is included without quarkus-smallrye-jwt

Expected behavior
If quarkus-smallrye-jwt-build requires quarkus-smallrye-jwt then this should be a dependency.

Actual behavior

 org.jboss.resteasy.spi.UnhandledException: java.lang.NoClassDefFoundError: javax/json/JsonObject
        at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:106)
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:372)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:218)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:519)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:261)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:161)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
        at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:138)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.access$000(VertxRequestHandler.java:41)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler$1.run(VertxRequestHandler.java:93)
        at io.quarkus.runtime.CleanableExecutor$CleaningRunnable.run(CleanableExecutor.java:231)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2415)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1452)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at java.base/java.lang.Thread.run(Thread.java:834)
        at org.jboss.threads.JBossThread.run(JBossThread.java:501)
Caused by: java.lang.NoClassDefFoundError: javax/json/JsonObject
        at org.eclipse.microprofile.jwt.Claims.<clinit>(Claims.java:71)
        at io.smallrye.jwt.build.impl.JwtClaimsBuilderImpl.upn(JwtClaimsBuilderImpl.java:105)
        at io.smallrye.jwt.build.Jwt.upn(Jwt.java:178)
        at example.rest.RestResource.test(RestResource.java:13)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:170)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:130)
        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:643)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:507)
        at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:457)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:459)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:419)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:393)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:68)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:492)
        ... 18 more
Caused by: java.lang.ClassNotFoundException: javax.json.JsonObject
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
        at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:428)
        at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:378)
        ... 37 more

To Reproduce

Simple JAX-RS Endpoint:

@Path("/")
public class RestResource {

    @GET
    public String test() {
        return Jwt
                .upn("myUsername")
                .groups("myGroup")
                .signWithSecret("an-example-string-secret-123456789");
    }
}

With dependencies:

    dependencies {
        implementation enforcedPlatform("${quarkusPlatformGroupId}:${quarkusPlatformArtifactId}:${quarkusPlatformVersion}")
        implementation 'io.quarkus:quarkus-resteasy-mutiny'
        implementation 'io.quarkus:quarkus-resteasy-jackson'
        implementation 'io.quarkus:quarkus-smallrye-openapi'
        //Uncomment this and problem disappears
        //implementation 'io.quarkus:quarkus-smallrye-jwt'
        implementation 'io.quarkus:quarkus-smallrye-jwt-build'
    }

Environment (please complete the following information):

• Output of java -version: OpenJDK 11
• GraalVM version (if different from Java): N/A
• Quarkus version or git rev: 1.11.0
• Build tool (ie. output of mvnw --version or gradlew --version): gradle 6.8

[ghost]

/cc @Ladicek, @jmartisk, @kenfinnigan, @phillip-kruger, @radcortez, @sberyozkin

[sberyozkin]

we need

<dependency>
            <groupId>io.quarkus</groupId>
            <artifactId>quarkus-jsonp</artifactId>
</dependency>

[gastaldi]

Would that mean that projects using this extension can't depend on Jackson?

[gsmet]

https://stackoverflow.com/questions/65881841/quarkus-resteasy-reavtive-jacksonjsonprovider-class-missing

It won't be an issue, it's JSON-P, the low level one, not JSON-B. IIRC, RESTEasy Reactive also has this dependency because of JAX-RS spec constraints.

[sberyozkin]

@gastaldi Hi George - I don't think so as it is not a JAX-RS provider level; so they won't be interfering with each other - FYI, right now, quarkus-oidc, by depending on both smallrye-jwt (the server parts) and vertx oauth2, bring both jsonp and jackson providers and it all works (it is going to be optimized though).
However - what I've been thinking about after I signed off yesterday is that we only really need a JSONP API dependency here.
smallrye-jwt-build API docs it will take care of the complex claims which are JsonObject instances. But it does not need an actual JSONP implementation itself - if the users want to deal with complex claims then they'd add quarkus-jsonp. It would be similarly to the case where one wants to resign JsonWebToken - smallrye-jwt-build only depends on the MP JWT API...

I'll update the PR soon

[sberyozkin]

Hi @gastaldi, @gsmet - thanks for approving/closing the PR, I'm going to follow up with a minor optimization for you to review :-)

[sberyozkin]

Hi @gastaldi, @gsmet

So yes, I guess including the API dependency only would be a problem until the implementations stop including this api too, as suggested at https://quarkusio.zulipchat.com/#narrow/stream/187038-dev/topic/Why.20is.20jakarta.2Ejson.3Ajakarta.2Ejson-api.20disabled, so for now I'll keep it as is and can optimize once the implementations will get decoupled.
Or may be not :-) - may be it is better for the users be able to set the complex claims without having to worry about the extra dependency...