quarkusio/quarkus · error · java.lang.RuntimeException

Method '%s' was annotated with '@PermissionsAllowed', but no

Error message

Method '%s' was annotated with '@PermissionsAllowed', but no valid permission was provided

What it means

Quarkus fails deployment when a method annotated with @PermissionsAllowed yields an empty permission set after parsing every value. The annotation is present but provides no usable permission (all values blank/unparseable-skipped), so the security check would be meaningless and is rejected at build time.

Source

Thrown at extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java:636

                        final String action = parsed.action();
                        if (permissionToActions.containsKey(permissionNameKey)) {
                            permissionToActions.get(permissionNameKey).add(action);
                        } else {
                            final Set<String> actions = new HashSet<>();
                            actions.add(action);
                            permissionToActions.put(permissionNameKey, actions);
                        }
                    } else {
                        if (!permissionToActions.containsKey(permissionNameKey)) {
                            permissionToActions.put(permissionNameKey, new HashSet<>());
                        }
                    }
                }
            }

            if (permissionToActions.isEmpty()) {
                if (annotationTarget.kind() == AnnotationTarget.Kind.METHOD) {
                    throw new RuntimeException(String.format(
                            "Method '%s' was annotated with '@PermissionsAllowed', but no valid permission was provided",
                            annotationTarget.asMethod().name()));
                } else {
                    throw new RuntimeException(String.format(
                            "Class '%s' was annotated with '@PermissionsAllowed', but no valid permission was provided",
                            annotationTarget.asClass().name()));
                }
            }

            // permissions specified via @PermissionsAllowed has 'one of' relation, therefore we put them in one list
            final List<PermissionKey> orPermissions = new ArrayList<>();
            final String[] params = instance.value("params") == null ? new String[] { PermissionsAllowed.AUTODETECTED }
                    : instance.value("params").asStringArray();
            final Type classType = getPermissionClass(instance);
            final boolean inclusive = instance.value("inclusive") != null && instance.value("inclusive").asBoolean();

            if (inclusive && foundPermissionChecker) {
                // @PermissionsAllowed({ "read", "read:all", "read:it", "write" } && @PermissionChecker("read")

View on GitHub (pinned to e1c734241f)

Solutions

Provide at least one valid permission value: @PermissionsAllowed("read") or @PermissionsAllowed({"read", "write"}).
Remove the @PermissionsAllowed annotation entirely if the method should not be permission-restricted (perhaps use @Authenticated or a security identity check instead).
If values come from constants, verify the constant array is non-empty at compile time.

Example fix

// before
@PermissionsAllowed({})
public void delete() { ... }

// after
@PermissionsAllowed("delete")
public void delete() { ... }

Defensive patterns

Strategy: validation

Validate before calling

// Never ship an empty permission list:
if (permissions == null || permissions.length == 0) {
    throw new IllegalArgumentException("@PermissionsAllowed requires at least one permission value");
}

Prevention

Always pass at least one non-blank value to @PermissionsAllowed.
Prefer string literals over constant arrays that can be emptied by refactors.
If no restriction is intended, remove the annotation instead of leaving it empty.

When it happens

Trigger: @PermissionsAllowed with an empty value array or values that all fail parsing on a METHOD annotation target, leaving permissionToActions empty.

Common situations: Passing an empty String[] constant or a constant expression that resolves to nothing; typos that make every entry invalid; refactoring that accidentally removed the values but kept the annotation.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/17af5e3cc399ecce. Report an issue: GitHub.