{"record":{"id":"cc21a958cbf5f506","repo":"quarkusio/quarkus","slug":"quarkuspermission-should-never-be-assigned-to-a-se","errorCode":null,"errorMessage":"QuarkusPermission should never be assigned to a SecurityIdentity. This permission can only be set to the @PermissionsAllowed#permission attribute by Quarkus itself.","messagePattern":"QuarkusPermission should never be assigned to a SecurityIdentity\\. This permission can only be set to the @PermissionsAllowed#permission attribute by Quarkus itself\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime/src/main/java/io/quarkus/security/runtime/QuarkusPermission.java","lineNumber":104,"sourceCode":"        try {\n            if (isReactive()) {\n                return isGrantedUni(identity);\n            } else {\n                return Uni.createFrom().item(isGranted(identity));\n            }\n        } catch (Throwable throwable) {\n            return Uni.createFrom().failure(throwable);\n        }\n    }\n\n    /**\n     * @throws IllegalStateException for this permission can only be set to the {@link PermissionsAllowed#permission()}\n     */\n    @Override\n    public final boolean implies(Permission requiredPermission) {\n        // possessed permission implies required permission\n        // this is required permission, not the possessed one\n        throw new IllegalStateException(\"QuarkusPermission should never be assigned to a SecurityIdentity. \"\n                + \"This permission can only be set to the @PermissionsAllowed#permission attribute by Quarkus itself.\");\n    }\n\n    @Override\n    public final String getActions() {\n        return \"\";\n    }\n\n    @Override\n    public final boolean equals(Object object) {\n        return this == object;\n    }\n\n    @Override\n    public final int hashCode() {\n        return Objects.hash(toString());\n    }\n","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/QuarkusPermission.java#L86-L122","documentation":"QuarkusPermission is an internal Permission marker placed inside @PermissionsAllowed checks to represent arbitrary action strings. Its implies() is intentionally unimplemented: it should never be the possessed permission of a SecurityIdentity, so any attempt to use it for an authorization decision throws IllegalStateException.","triggerScenarios":"Adding a QuarkusPermission to a SecurityIdentity (e.g. via identity.addPermission(new QuarkusPermission(...))) or a custom SecurityIdentityAugmentor that propagates it; then an authorization check calls implies() on it.","commonSituations":"Custom identity augmentors copying permissions blindly from PermissionsAllowed metadata; reflection-based code that recreates permissions from annotation values; debugging code that prints/adds all permissions of a check.","solutions":["Never add QuarkusPermission instances to a SecurityIdentity; use real Permission implementations (BasicPermission subclasses or custom ones) for possessed permissions.","In augmentors/filters, filter out QuarkusPermission instances when copying permission collections.","If you need @PermissionsAllowed semantics for identity checks, use PermissionVerifier/permission checkers instead of the internal permission class."],"exampleFix":"// before\nidentity.addPermission(new QuarkusPermission(\"read\"));\n// after\nidentity.addPermission(new BasicPermission(\"app\") {\n    { setName(\"read\"); }\n});","handlingStrategy":"type-guard","validationCode":"// filter internal permissions out before attaching to an identity\nPermission[] safe = Stream.of(permissions)\n    .filter(p -> !(p instanceof QuarkusPermission))\n    .toArray(Permission[]::new);","typeGuard":"boolean isAssignable(Permission possessed, Permission required) {\n    return !(possessed instanceof QuarkusPermission) && possessed.implies(required);\n}","tryCatchPattern":null,"preventionTips":["Never add QuarkusPermission to a SecurityIdentity","Use real Permission types for identity permissions","Filter annotation-derived permissions in augmentors"],"tags":["quarkus","security","authorization","permissions"],"backgroundTag":"internal-api-misuse","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}