{"record":{"id":"d98a35473e9098b1","repo":"quarkusio/quarkus","slug":"method-s-s-parameter-s-cannot-be-mapped-to-d98a35","errorCode":null,"errorMessage":"Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,\n                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is only\n                            accessible from field '%s#%s' which is not a public field. Please declare a getter method.","messagePattern":"Method '(.+?)#(.+?)' parameter '(.+?)' cannot be mapped to a Permission constructor parameter,\n                            because expression '(.+?)' specified in the '@PermissionsAllowed#params' attribute is only\n                            accessible from field '(.+?)#(.+?)' which is not a public field\\. Please declare a getter method\\.","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java","lineNumber":1727,"sourceCode":"                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is\n                            accessible from method '%s#%s' which is not a public method.\n                            \"\"\".formatted(securedMethod.declaringClass().name(), securedMethod.name(),\n                            securedMethod.parameterName(methodParamIdx), paramExpression, method.declaringClass().name(),\n                            method.name()));\n                }\n                validateNestedParams(nestedParams, nestedParamIdx + 1, method.returnType(), securedMethod, methodParamIdx);\n            } else {\n                var field = outerClass.field(paramExpression);\n                if (field == null) {\n                    throw new IllegalArgumentException(\"\"\"\n                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,\n                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute does not\n                            match any method or field of the class '%s'.\n                            \"\"\".formatted(securedMethod.declaringClass().name(), securedMethod.name(),\n                            securedMethod.parameterName(methodParamIdx), paramExpression, outerClass.name()));\n                }\n                if (!Modifier.isPublic(field.flags())) {\n                    throw new IllegalArgumentException(\"\"\"\n                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,\n                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is only\n                            accessible from field '%s#%s' which is not a public field. Please declare a getter method.\n                            \"\"\".formatted(securedMethod.declaringClass().name(), securedMethod.name(),\n                            securedMethod.parameterName(methodParamIdx), paramExpression, field.declaringClass().name(),\n                            field.name()));\n                }\n                validateNestedParams(nestedParams, nestedParamIdx + 1, field.type(), securedMethod, methodParamIdx);\n            }\n        }\n\n        private Expr generateNestedParam(String[] nestedParams, int nestedParamIdx, Expr outer,\n                BlockCreator bc, Type outerType) {\n            if (nestedParamIdx == nestedParams.length) {\n                return outer;\n            }\n\n            // param name or getter name","sourceCodeStart":1709,"sourceCodeEnd":1745,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java#L1709-L1745","documentation":"When an @PermissionsAllowed params expression segment resolves to a field (no matching method/getter exists), Quarkus requires that field be public because it will be read reflectively to build the Permission argument. Non-public fields trigger this build-time error with a suggestion to declare a getter method.","triggerScenarios":"An expression segment matches a private/package-private/protected field of the traversed class and no public getter method with the same name (or getX/isX form) exists.","commonSituations":"Entities with private fields and non-standard getter names; expressions written against field names when only differently-named getters exist; records/components whose accessors don't follow the resolved naming convention.","solutions":["Declare a public getter for the field and reference the getter-style name in the params expression.","Make the field public (less desirable, but allowed).","Rename the params expression to match the existing public accessor name.","Compute the value in a custom Permission or @PermissionChecker rather than navigating the field."],"exampleFix":"// before\nclass Order { private String owner; }\n@PermissionsAllowed(value=\"read\", params=\"order.owner\")\n\n// after\nclass Order { private String owner; public String getOwner() { return owner; } }\n@PermissionsAllowed(value=\"read\", params=\"order.owner\") // resolved via public getter","handlingStrategy":"validation","validationCode":"// ensure a public field or public getter exists for each params segment\nboolean ok = java.lang.reflect.Modifier.isPublic(Order.class.getField(\"owner\").getModifiers());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Follow the JavaBean convention: private field + public getter","Prefer getters over fields in params expressions","Run a reflection-based unit test validating @PermissionsAllowed expressions"],"tags":["quarkus","security","permissionsallowed","visibility","encapsulation"],"backgroundTag":"permissions-allowed-expression-mapping","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}