{"record":{"id":"672546b56064a69a","repo":"quarkusio/quarkus","slug":"permissionsallowed-annotation-placed-on-method","errorCode":null,"errorMessage":"@PermissionsAllowed annotation placed on method '%s' has 'params' attribute\n                                    '%s' that cannot be matched to any Permission %s '%s' parameter","messagePattern":"@PermissionsAllowed annotation placed on method '(.+?)' has 'params' attribute\n                                    '(.+?)' that cannot be matched to any Permission (.+?) '(.+?)' parameter","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java","lineNumber":1394,"sourceCode":"                                        secured method and constructor has formal parameter with name '%1$s'.\n                                        \"\"\"\n                                        .formatted(paramName, PermissionSecurityChecksBuilder.toString(securedMethod),\n                                                quarkusPermission ? \"checker\" : \"constructor\", matchTarget));\n                    }\n                }\n                if (nestedParamExpressions != null) {\n                    outer: for (int i = 0; i < nestedParamExpressions.length; i++) {\n                        if (nestedParamExpressions[i] != null) {\n                            var nestedParamExp = nestedParamExpressions[i];\n                            for (SecMethodAndPermCtorIdx match : matches) {\n                                if (nestedParamExp.equals(match.nestedParamExpression())) {\n                                    continue outer;\n                                }\n                            }\n                            var matchTarget = quarkusPermission\n                                    ? PermissionSecurityChecksBuilder.toString(permissionCheckerMethod)\n                                    : constructor.declaringClass().name().toString();\n                            throw new IllegalArgumentException(\"\"\"\n                                    @PermissionsAllowed annotation placed on method '%s' has 'params' attribute\n                                    '%s' that cannot be matched to any Permission %s '%s' parameter\n                                    \"\"\".formatted(PermissionSecurityChecksBuilder.toString(securedMethod),\n                                    params[i] + \".\" + nestedParamExp, quarkusPermission ? \"checker\" : \"constructor\",\n                                    matchTarget));\n                        }\n                    }\n                }\n            }\n\n            private static String[] getMethodParamConverters(PermissionConverterGenerator paramConverterGenerator,\n                    SecMethodAndPermCtorIdx[] matches, MethodInfo securedMethod, int[] methodParamIndexes) {\n                var converters = new String[methodParamIndexes.length];\n                boolean requireConverter = false;\n                for (SecMethodAndPermCtorIdx match : matches) {\n                    if (match.nestedParamExpression() != null) {\n                        requireConverter = true;\n                        converters[match.constructorParamIdx()] = paramConverterGenerator","sourceCodeStart":1376,"sourceCodeEnd":1412,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java#L1376-L1412","documentation":"Similar to the constructor-param mismatch, but thrown from the code path that matches a @PermissionsAllowed 'params' entry (with a nested expression) against the parameters of the Permission checker method or the custom Permission constructor. When a nested param expression like 'item.id' cannot be matched to any parameter of the Permission class's constructor or the checker, Quarkus throws this IllegalArgumentException naming the secured method, the unmatched expression, the kind of target, and the target name.","triggerScenarios":"@PermissionsAllowed(value=\"p\", params={\"order.customerId\"}) where the Permission class constructor or @PermissionChecker method has no parameter named 'order' (or the nested path does not resolve against it).","commonSituations":"Deep-nesting property paths that the constructor/checker does not expose; renaming fields after refactoring; using params with a Quarkus permission checker whose method signature lacks the referenced argument.","solutions":["Add or rename a parameter on the Permission constructor / @PermissionChecker method so the nested expression root matches a formal parameter name.","Simplify the params expression to a level the target actually exposes (e.g. use \"order\" instead of \"order.customerId\" if only the object is available).","Ensure the nested property exists on the passed object type and that parameter names are retained at compile time (-parameters)."],"exampleFix":"// before\n@PermissionsAllowed(value = \"audit\", params = { \"req.headers\" }) // checker takes 'request' only\n\n// after\n@PermissionsAllowed(value = \"audit\", params = { \"request\" })\npublic void handle(RequestContext request, Permission perm) { ... }","handlingStrategy":"validation","validationCode":"// Check nested expression roots against checker/constructor signatures before deploying:\n// For params \"order.customerId\": the checker/constructor must have a parameter named 'order'.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Match the nested expression root to an actual formal parameter of the checker/constructor.","Avoid deep property paths the target cannot resolve.","Compile with -parameters and update expressions together with signature changes."],"tags":["quarkus","security","params-mapping","permissionchecker"],"backgroundTag":"parameter-name-mismatch","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}