{"record":{"id":"f75e68c58eaee489","repo":"quarkusio/quarkus","slug":"permissionsecuritycheck-must-be-created-either-for","errorCode":null,"errorMessage":"PermissionSecurityCheck must be created either for computed permissionsor plain permissions, but received both","messagePattern":"PermissionSecurityCheck must be created either for computed permissionsor plain permissions, but received both","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/check/PermissionSecurityCheck.java","lineNumber":32,"sourceCode":"import io.quarkus.security.spi.runtime.SecurityCheck;\nimport io.smallrye.mutiny.Uni;\n\npublic abstract class PermissionSecurityCheck<T> implements SecurityCheck {\n\n    private static final Uni<Object> SUCCESSFUL_CHECK = Uni.createFrom().nullItem();\n    private final T permissions;\n    private final Function<Object[], T> computedPermissions;\n    private final boolean useComputedPermissions;\n\n    private PermissionSecurityCheck(T permissions, Function<Object[], T> computedPermissions) {\n        if (permissions == null) {\n            Objects.requireNonNull(computedPermissions);\n            this.useComputedPermissions = true;\n        } else {\n            if (computedPermissions == null) {\n                this.useComputedPermissions = false;\n            } else {\n                throw new IllegalStateException(\"PermissionSecurityCheck must be created either for computed permissions\" +\n                        \"or plain permissions, but received both\");\n            }\n        }\n        this.permissions = permissions;\n        this.computedPermissions = computedPermissions;\n    }\n\n    private T getPermissions(Object[] parameters) {\n        if (useComputedPermissions) {\n            return computedPermissions.apply(parameters);\n        }\n        return permissions;\n    }\n\n    @Override\n    public void apply(SecurityIdentity identity, Method method, Object[] parameters) {\n        checkPermissions(identity, getPermissions(parameters));\n    }","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/check/PermissionSecurityCheck.java#L14-L50","documentation":"The PermissionSecurityCheck constructor throws IllegalStateException if it is given BOTH plain Permission instances and a computed-permissions supplier — exactly one representation must be used. This is an internal/extension programming error during security check wiring, not user configuration.","triggerScenarios":"An extension or custom build step constructs new PermissionSecurityCheck(perms, computedPerms) with non-null values for both the permissions and computedPermissions parameters.","commonSituations":"Custom @SecurityCheckType/permission metadata generators passing both security-check-permissions and computed permissions build items; a Quarkus version change adding the computed-permissions parameter while custom code still passes legacy values.","solutions":["Pass either the plain Permission[] or the ComputedPermissions instance, never both; use null for the unused one","If your extension generates both, prefer computed permissions and null the plain array","Update custom security-check recorder code to the current PermissionSecurityCheck constructor contract"],"exampleFix":"// before\nnew PermissionSecurityCheck(new Permission[]{p}, computedPerms); // both -> IllegalStateException\n// after\nnew PermissionSecurityCheck(new Permission[]{p}, null);","handlingStrategy":"validation","validationCode":"if (permissions != null && computedPermissions != null) {\n  throw new IllegalArgumentException(\"Pass either plain permissions or computed permissions, not both\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  new PermissionSecurityCheck(perms, computedPerms);\n} catch (IllegalStateException e) {\n  // fix construction: null out one of the two arguments\n}","preventionTips":["Always null one of the two constructor arguments explicitly","Keep custom security-check generation code in sync with Quarkus API changes","Prefer computed permissions for dynamic permission handling"],"tags":["security","permissions","constructor-argument","build-time"],"backgroundTag":"invalid-security-check-construction","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}