{"record":{"id":"70edb77501bfa02e","repo":"quarkusio/quarkus","slug":"method-s-s-parameter-s-cannot-be-mapped-to","errorCode":null,"errorMessage":"Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,\n                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is\n                            accessible from method '%s#%s' which is not a public method.","messagePattern":"Method '(.+?)#(.+?)' parameter '(.+?)' cannot be mapped to a Permission constructor parameter,\n                            because expression '(.+?)' specified in the '@PermissionsAllowed#params' attribute is\n                            accessible from method '(.+?)#(.+?)' which is not a public method\\.","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java","lineNumber":1707,"sourceCode":"            var paramExpression = nestedParams[nestedParamIdx];\n            var outerClass = index.getClassByName(outerType.name());\n            if (outerClass == null) {\n                throw new IllegalArgumentException(\"\"\"\n                            Method '%s#%s' parameter '%s' cannot be converted to a Permission constructor parameter\n                            as required by the '@PermissionsAllowed#params' attribute. Parameter expression references '%s'\n                            that has type '%s' which is not a class. Only class methods or fields can be mapped\n                            to a Permission constructor parameter.\n                        \"\"\".formatted(securedMethod.declaringClass().name(), securedMethod.name(),\n                        securedMethod.parameterName(methodParamIdx), paramExpression, outerType.name()));\n            }\n\n            var method = outerClass.method(paramExpression);\n            if (method == null) {\n                method = outerClass.method(toFieldGetter(paramExpression));\n            }\n            if (method != null) {\n                if (!Modifier.isPublic(method.flags())) {\n                    throw new IllegalArgumentException(\"\"\"\n                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,\n                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is\n                            accessible from method '%s#%s' which is not a public method.\n                            \"\"\".formatted(securedMethod.declaringClass().name(), securedMethod.name(),\n                            securedMethod.parameterName(methodParamIdx), paramExpression, method.declaringClass().name(),\n                            method.name()));\n                }\n                validateNestedParams(nestedParams, nestedParamIdx + 1, method.returnType(), securedMethod, methodParamIdx);\n            } else {\n                var field = outerClass.field(paramExpression);\n                if (field == null) {\n                    throw new IllegalArgumentException(\"\"\"\n                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,\n                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute does not\n                            match any method or field of the class '%s'.\n                            \"\"\".formatted(securedMethod.declaringClass().name(), securedMethod.name(),\n                            securedMethod.parameterName(methodParamIdx), paramExpression, outerClass.name()));\n                }","sourceCodeStart":1689,"sourceCodeEnd":1725,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java#L1689-L1725","documentation":"When validating an @PermissionsAllowed params expression, Quarkus resolves a segment as a method (or field getter) on the outer class and requires that method to be public, since it will be invoked to obtain the Permission constructor argument. If the resolved accessor method is not public, the build fails with this error.","triggerScenarios":"An @PermissionsAllowed params expression segment matches a non-public method name (or a 'getX'/'isX' getter whose method is package-private/protected/private) on the traversed class.","commonSituations":"Package-private or protected getters on entities used in expressions; Lombok @Getter with non-default access; methods made non-public during a refactor.","solutions":["Make the referenced accessor method public.","Rename the expression to point at a public getter or public field instead.","Expose a public getter that delegates to the non-public method and reference that in params.","Move the check into a custom Permission implementation or @PermissionChecker that can access the non-public member."],"exampleFix":"// before\nclass Order { String getOwner() { return owner; } } // package-private\n@PermissionsAllowed(\"read:order.owner\")\n\n// after\nclass Order { public String getOwner() { return owner; } }","handlingStrategy":"validation","validationCode":"// check before build: every method referenced in @PermissionsAllowed params must be public\nif (!java.lang.reflect.Modifier.isPublic(Order.class.getMethod(\"getOwner\").getModifiers())) { /* fix visibility */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make all getters used in params expressions public","Avoid Lombok accessor access restrictions on expression targets","Review visibility after refactors touching expression targets"],"tags":["quarkus","security","permissionsallowed","visibility"],"backgroundTag":"permissions-allowed-expression-mapping","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}