{"record":{"id":"19fbb797c0c09c16","repo":"quarkusio/quarkus","slug":"parameter-s-specified-via-permissionsallowed-p","errorCode":null,"errorMessage":"Parameter '%s' specified via @PermissionsAllowed#params on secured method '%s'\n                                        cannot be matched to any %s '%s' parameter. Please make sure that both\n                                        secured method and constructor has formal parameter with name '%1$s'.","messagePattern":"Parameter '(.+?)' specified via @PermissionsAllowed#params on secured method '(.+?)'\n                                        cannot be matched to any (.+?) '(.+?)' parameter\\. Please make sure that both\n                                        secured method and constructor has formal parameter with name '%1\\$s'\\.","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java","lineNumber":1372,"sourceCode":"                    this.passActionsToConstructor = constructor.parametersCount() == 2;\n                }\n            }\n\n            private static void validateParamsDeclaredByUserMatched(SecMethodAndPermCtorIdx[] matches, String[] params,\n                    String[] nestedParamExpressions, MethodInfo securedMethod, MethodInfo constructor,\n                    boolean quarkusPermission, MethodInfo permissionCheckerMethod) {\n                for (int i = 0; i < params.length; i++) {\n                    int aI = i;\n                    boolean paramMapped = Arrays.stream(matches)\n                            .map(SecMethodAndPermCtorIdx::requiredParamIdx)\n                            .filter(Objects::nonNull)\n                            .anyMatch(mIdx -> mIdx == aI);\n                    if (!paramMapped) {\n                        var paramName = nestedParamExpressions == null || nestedParamExpressions[aI] == null ? params[i]\n                                : params[i] + \".\" + nestedParamExpressions[aI];\n                        var matchTarget = quarkusPermission ? PermissionSecurityChecksBuilder.toString(permissionCheckerMethod)\n                                : constructor.declaringClass().name().toString();\n                        throw new RuntimeException(\n                                \"\"\"\n                                        Parameter '%s' specified via @PermissionsAllowed#params on secured method '%s'\n                                        cannot be matched to any %s '%s' parameter. Please make sure that both\n                                        secured method and constructor has formal parameter with name '%1$s'.\n                                        \"\"\"\n                                        .formatted(paramName, PermissionSecurityChecksBuilder.toString(securedMethod),\n                                                quarkusPermission ? \"checker\" : \"constructor\", matchTarget));\n                    }\n                }\n                if (nestedParamExpressions != null) {\n                    outer: for (int i = 0; i < nestedParamExpressions.length; i++) {\n                        if (nestedParamExpressions[i] != null) {\n                            var nestedParamExp = nestedParamExpressions[i];\n                            for (SecMethodAndPermCtorIdx match : matches) {\n                                if (nestedParamExp.equals(match.nestedParamExpression())) {\n                                    continue outer;\n                                }\n                            }","sourceCodeStart":1354,"sourceCodeEnd":1390,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java#L1354-L1390","documentation":"When @PermissionsAllowed#params reference secured method parameters that are resolved through a constructor (custom permission) or a @PermissionChecker (Quarkus permission), Quarkus must map each declared param name to a formal parameter of both the secured method and the target (constructor or checker method). If a param cannot be matched, deployment fails with this message listing the unmatched name, the secured method, the match target, and the missing formal parameter name.","triggerScenarios":"@PermissionsAllowed(value=\"p\", params={\"customerId\"}) where neither the secured method nor the permission's constructor/checker has a parameter formally named 'customerId' (including nested expressions like 'order.customerId' where 'order' exists but the nested path does not map).","commonSituations":"Renaming a method parameter without updating params (parameter names matter); compiling without -parameters so formal names are lost; mismatch between the custom Permission constructor signature and the annotation params; typos in nested property expressions.","solutions":["Make the params names match the secured method parameters exactly and ensure the corresponding constructor/checker declares the same formal parameter names (compile with -parameters).","Fix nested expressions: for params like \"order.customerId\", ensure 'order' is a method parameter and the path resolves on the target side.","Align the custom Permission class constructor signature so every params entry has a constructor parameter of the same name.","Use record-style parameter names or the @ParamName-style conventions supported by Quarkus if names differ."],"exampleFix":"// before\n@PermissionsAllowed(value = \"get\", params = { \"custId\" })\npublic Order get(Long customerId, Permission perm) { ... }\n\n// after\n@PermissionsAllowed(value = \"get\", params = { \"customerId\" })\npublic Order get(Long customerId, Permission perm) { ... }","handlingStrategy":"validation","validationCode":"// Compile with parameter names and keep them in sync:\n// maven.compiler.parameters=true (pom.xml)\n// Verify before build:\n// for each @PermissionsAllowed(params={...}) name, the method and the Permission constructor/checker\n// must declare a parameter with that exact name.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable -parameters compilation so formal names survive in bytecode.","Update @PermissionsAllowed params whenever method/constructor parameter names change.","Keep nested expressions shallow and matching the target's exposed parameter names."],"tags":["quarkus","security","params-mapping","parameter-names"],"backgroundTag":"parameter-name-mismatch","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}