@TestSecurity with @PermissionsAllowed annotated endpoint

[sberyozkin]

Discussed in #42499

^{Originally posted by ralph089 August 13, 2024}
I've been trying to use the @TestSecurity and @PermissionsAllowed annotations in my Quarkus application, but I'm facing some issues.

An endpoint has been annotated with @PermissionsAllowed:

@Path("/my-endpoint")
public class MyEndpointResource {

    @GET
    @PermissionsAllowed("endpoint:read")
    public Response getMyData() {
        return Response.ok("My data").build();
    }
}

When using @TestSecurity in my test class I can only specify roles. I tried it using @OidcSecurity and specifiying the scopes claim, but this also has no effect. The tests are failing due to unauthorized access.

I've got a use case, where I fetch the permissions of a user using a SecurityIdentityAugmentor and a DB call (this SecurityIdentityAugmentor is not being used when using @TestSecurity). Creating all the possible combinations through a quarkus.http.auth.policy upfront and relate the permission combinations to "test roles" that I use in my tests would probably be possible, but a lot of overhead.

Is there any other way on how to specify the permissions for a test case for a given user?

[michalvavrik]

I'll take care of it in upcoming days.