{"record":{"id":"768cdf6ba8daacfc","repo":"quarkusio/quarkus","slug":"authorization-policy-has-not-been-set-for-paths","errorCode":null,"errorMessage":"Authorization Policy has not been set for paths: ","messagePattern":"Authorization Policy has not been set for paths: ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":542,"sourceCode":"        @Override\n        public boolean shouldApplyToJaxRs() {\n            return applyToJaxRs;\n        }\n\n        @Override\n        public Set<String> getMethods() {\n            return methods == null ? Set.of() : Set.of(methods);\n        }\n\n        @Override\n        public HttpSecurityConfiguration.AuthenticationMechanisms getAuthMechanisms() {\n            return authMechanism;\n        }\n\n        @Override\n        public Policy getPolicy() {\n            if (authorizationPolicy == null || authorizationPolicy.policy == null) {\n                throw new IllegalStateException(\"Authorization Policy has not been set for paths: \" + getPaths());\n            }\n            return authorizationPolicy.policy;\n        }\n    }\n\n    private static final class PermissionsHttpSecurityPolicy implements HttpSecurityPolicy {\n\n        private final Permission[] permissions;\n\n        private PermissionsHttpSecurityPolicy(Permission[] permissions) {\n            this.permissions = Arrays.copyOf(permissions, permissions.length);\n        }\n\n        @Override\n        public Uni<CheckResult> checkPermission(RoutingContext request, Uni<SecurityIdentity> identityUni,\n                AuthorizationRequestContext requestContext) {\n            return identityUni.onItemOrFailure()\n                    .transformToUni(new BiFunction<SecurityIdentity, Throwable, Uni<? extends CheckResult>>() {","sourceCodeStart":524,"sourceCodeEnd":560,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L524-L560","documentation":"Thrown by HttpPermissionImpl.getPolicy() when getPolicy() is queried but no authorization policy was ever set on the permission (authorizationPolicy or its inner policy is null). This IllegalStateException indicates the permission was registered without a terminal policy call, so it cannot produce an HttpSecurityPolicy.","triggerScenarios":"Building a HttpPermission via paths(...) and terminating with methods()/paths modifiers but never calling permit/deny/roles/permissions/policy/authorization/authenticated, then the recorder asks for its Policy.","commonSituations":"Programmatic HttpSecurity setup where an early return/condition skipped the policy call; refactors that removed a permit()/deny() terminator; custom code consuming HttpPermissionCarrier.getPolicy() directly.","solutions":["Terminate every permission chain with exactly one policy call: permit(), deny(), roles(...), permissions(...), policy(...), or authenticated().","Audit all paths(...) chains in your HttpSecurity setup for missing terminal calls.","If consuming getPolicy() yourself, check the permission's policy state before calling."],"exampleFix":"// before\nvar perm = httpSecurity.paths(\"/api/*\").methods(\"GET\"); // no policy\n// after\nhttpSecurity.paths(\"/api/*\").methods(\"GET\").permit();","handlingStrategy":"validation","validationCode":"// before finishing setup, assert each permission has a terminal policy call\npermissions.forEach(p -> { /* ensure permit/deny/roles/permissions/policy/authenticated was called */ });","typeGuard":null,"tryCatchPattern":"try { Policy pol = ((HttpPermissionCarrier) perm).getPolicy(); } catch (IllegalStateException e) { if (!e.getMessage().startsWith(\"Authorization Policy has not been set\")) throw e; }","preventionTips":["Always terminate every paths(...) chain with a policy call.","Code-review programmatic HttpSecurity setup for unterminated chains.","Write a startup smoke test that builds the full security configuration."],"tags":["quarkus","http-security","authorization","illegal-state"],"backgroundTag":"missing-required-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}