quarkusio/quarkus · error · java.lang.IllegalArgumentException

Method '%s#%s' parameter '%s' cannot be mapped to a Permissi

Error message

Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,
                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute does not
                            match any method or field of the class '%s'.

What it means

Quarkus resolves each dot-separated segment of an @PermissionsAllowed params expression against the current class's methods and fields. If no method or field with the segment's name (or its getter form) exists on the class, the build fails with this error indicating the expression cannot be mapped to a Permission constructor parameter.

Source

Thrown at extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java:1719

            var method = outerClass.method(paramExpression);
            if (method == null) {
                method = outerClass.method(toFieldGetter(paramExpression));
            }
            if (method != null) {
                if (!Modifier.isPublic(method.flags())) {
                    throw new IllegalArgumentException("""
                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,
                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is
                            accessible from method '%s#%s' which is not a public method.
                            """.formatted(securedMethod.declaringClass().name(), securedMethod.name(),
                            securedMethod.parameterName(methodParamIdx), paramExpression, method.declaringClass().name(),
                            method.name()));
                }
                validateNestedParams(nestedParams, nestedParamIdx + 1, method.returnType(), securedMethod, methodParamIdx);
            } else {
                var field = outerClass.field(paramExpression);
                if (field == null) {
                    throw new IllegalArgumentException("""
                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,
                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute does not
                            match any method or field of the class '%s'.
                            """.formatted(securedMethod.declaringClass().name(), securedMethod.name(),
                            securedMethod.parameterName(methodParamIdx), paramExpression, outerClass.name()));
                }
                if (!Modifier.isPublic(field.flags())) {
                    throw new IllegalArgumentException("""
                            Method '%s#%s' parameter '%s' cannot be mapped to a Permission constructor parameter,
                            because expression '%s' specified in the '@PermissionsAllowed#params' attribute is only
                            accessible from field '%s#%s' which is not a public field. Please declare a getter method.
                            """.formatted(securedMethod.declaringClass().name(), securedMethod.name(),
                            securedMethod.parameterName(methodParamIdx), paramExpression, field.declaringClass().name(),
                            field.name()));
                }
                validateNestedParams(nestedParams, nestedParamIdx + 1, field.type(), securedMethod, methodParamIdx);
            }
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Fix the expression in @PermissionsAllowed#params to exactly match an existing public method or field name (getter forms getX/isX are also resolved).
2. Verify member names on the class the expression reaches at that segment.
3. If the member is generated (Lombok, mapstruct), confirm it is present at build time and indexed; otherwise declare it explicitly.
4. Use a custom Permission class or @PermissionChecker instead of navigating nonexistent members.

Example fix

// before
@PermissionsAllowed(value = "read", params = "order.ownr") // typo

// after
@PermissionsAllowed(value = "read", params = "order.owner")

// verify each params expression segment matches a public method or field name
boolean ok = java.util.Arrays.stream(Order.class.getMethods()).anyMatch(m -> m.getName().equals("owner") || m.getName().equals("getOwner"));

When it happens

Trigger: A params expression segment names a method/field that does not exist on the traversed class — typos, wrong property name, or referencing members added at runtime only.

Common situations: Typos in property names; renaming a getter or field without updating the annotation; expressions referencing Lombok- or annotation-generated accessors that aren't in the Jandex index; navigating past the end of an object graph.

Related errors

• Invalid @PermissionsAllowed value '%s': %s
• Method '%s' was annotated with '@PermissionsAllowed', but no
• Class '%s' was annotated with '@PermissionsAllowed', but no
• @PermissionAllowed instance that accepts method arguments mu
• Method '%s#%s' parameter '%s' cannot be converted to a Permi

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/41c4c19ca6d94e91. Report an issue: GitHub.