{"record":{"id":"17af5e3cc399ecce","repo":"quarkusio/quarkus","slug":"method-s-was-annotated-with-permissionsallowe","errorCode":null,"errorMessage":"Method '%s' was annotated with '@PermissionsAllowed', but no valid permission was provided","messagePattern":"Method '(.+?)' was annotated with '@PermissionsAllowed', but no valid permission was provided","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java","lineNumber":636,"sourceCode":"                        final String action = parsed.action();\n                        if (permissionToActions.containsKey(permissionNameKey)) {\n                            permissionToActions.get(permissionNameKey).add(action);\n                        } else {\n                            final Set<String> actions = new HashSet<>();\n                            actions.add(action);\n                            permissionToActions.put(permissionNameKey, actions);\n                        }\n                    } else {\n                        if (!permissionToActions.containsKey(permissionNameKey)) {\n                            permissionToActions.put(permissionNameKey, new HashSet<>());\n                        }\n                    }\n                }\n            }\n\n            if (permissionToActions.isEmpty()) {\n                if (annotationTarget.kind() == AnnotationTarget.Kind.METHOD) {\n                    throw new RuntimeException(String.format(\n                            \"Method '%s' was annotated with '@PermissionsAllowed', but no valid permission was provided\",\n                            annotationTarget.asMethod().name()));\n                } else {\n                    throw new RuntimeException(String.format(\n                            \"Class '%s' was annotated with '@PermissionsAllowed', but no valid permission was provided\",\n                            annotationTarget.asClass().name()));\n                }\n            }\n\n            // permissions specified via @PermissionsAllowed has 'one of' relation, therefore we put them in one list\n            final List<PermissionKey> orPermissions = new ArrayList<>();\n            final String[] params = instance.value(\"params\") == null ? new String[] { PermissionsAllowed.AUTODETECTED }\n                    : instance.value(\"params\").asStringArray();\n            final Type classType = getPermissionClass(instance);\n            final boolean inclusive = instance.value(\"inclusive\") != null && instance.value(\"inclusive\").asBoolean();\n\n            if (inclusive && foundPermissionChecker) {\n                // @PermissionsAllowed({ \"read\", \"read:all\", \"read:it\", \"write\" } && @PermissionChecker(\"read\")","sourceCodeStart":618,"sourceCodeEnd":654,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java#L618-L654","documentation":"Quarkus fails deployment when a method annotated with @PermissionsAllowed yields an empty permission set after parsing every value. The annotation is present but provides no usable permission (all values blank/unparseable-skipped), so the security check would be meaningless and is rejected at build time.","triggerScenarios":"@PermissionsAllowed with an empty value array or values that all fail parsing on a METHOD annotation target, leaving permissionToActions empty.","commonSituations":"Passing an empty String[] constant or a constant expression that resolves to nothing; typos that make every entry invalid; refactoring that accidentally removed the values but kept the annotation.","solutions":["Provide at least one valid permission value: @PermissionsAllowed(\"read\") or @PermissionsAllowed({\"read\", \"write\"}).","Remove the @PermissionsAllowed annotation entirely if the method should not be permission-restricted (perhaps use @Authenticated or a security identity check instead).","If values come from constants, verify the constant array is non-empty at compile time."],"exampleFix":"// before\n@PermissionsAllowed({})\npublic void delete() { ... }\n\n// after\n@PermissionsAllowed(\"delete\")\npublic void delete() { ... }","handlingStrategy":"validation","validationCode":"// Never ship an empty permission list:\nif (permissions == null || permissions.length == 0) {\n    throw new IllegalArgumentException(\"@PermissionsAllowed requires at least one permission value\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass at least one non-blank value to @PermissionsAllowed.","Prefer string literals over constant arrays that can be emptied by refactors.","If no restriction is intended, remove the annotation instead of leaving it empty."],"tags":["quarkus","security","permissionsallowed","missing-permission"],"backgroundTag":"missing-permission","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}