quarkus-spring-data-rest + javax.annotation.security annotations behave inconsistently and lack documentation

[jsmrcka]

Describe the bug

Since #29009, javax.annotation.security annotations are being propagated to generated REST resources when using rest-data-panache.

This applies to the quarkus-spring-data-rest extension as well. But the behavior here is a little bit confusing (compared to e.g. quarkus-hibernate-orm-rest-data-panache).

An example:

package org.acme;

import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;

import org.springframework.data.repository.CrudRepository;

@DenyAll
public interface FruitsRepository extends CrudRepository<Fruit, Long> {
    @Override
    @PermitAll
    Iterable<Fruit> findAll();
}

Here, the @DenyAll gets propagated to the JAX-RS resource, while the @PermitAll does not.

In order to propagate method security annotations, the user has to add @RestResource , even if they would not need it otherwise:

package org.acme;

import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;

import org.springframework.data.repository.CrudRepository;
import org.springframework.data.rest.core.annotation.RestResource;

// No @RepositoryRestResource needed here, the @DenyAll security annotation gets propagated anyway.
@DenyAll
public interface FruitsRepository extends CrudRepository<Fruit, Long> {
    @Override
    @PermitAll
    @RestResource // This must be here in order to propagate the @PermitAll security annotation.
    Iterable<Fruit> findAll();
}

This should be fixed: either require or do not require @RepositoryRestResource/@RestResource annotations both on classes and on methods.

The second issue is lacking documentation. The support for the security annotations should be mentioned in the Spring Data Rest guide for Quarkus 2.13+: https://quarkus.io/version/2.13/guides/spring-data-rest.

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

git clone git@github.com:jsmrcka/spring-data-rest-security-annotations-reproducer.git
mvn -f ./spring-data-rest-security-annotations-reproducer clean test

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.13.6.Final, 2.15.3.Final

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @geoand (spring), @sberyozkin (security)

[jsmrcka]

cc @Sgitario