Merge pull request #47575 from michalvavrik/feature/oidc-only-access-fields-using-accessors

sberyozkin · web-flow · commit 63151508ba3c · 2025-04-29T16:34:58.000+01:00
OIDC refactoring: use accessors instead of deprecated fields marked for removal
diff --git a/extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/devservices/AbstractDevUIProcessor.java b/extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/devservices/AbstractDevUIProcessor.java
@@ -13,7 +13,7 @@
 import io.quarkus.deployment.annotations.BuildProducer;
 import io.quarkus.devui.spi.page.CardPageBuildItem;
 import io.quarkus.devui.spi.page.Page;
-import io.quarkus.oidc.OidcTenantConfig;
+import io.quarkus.oidc.runtime.OidcTenantConfig;
 import io.quarkus.oidc.runtime.devui.OidcDevUiRecorder;
 import io.quarkus.oidc.runtime.devui.OidcDevUiRpcSvcPropertiesBean;
 import io.quarkus.runtime.RuntimeValue;
diff --git a/extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/devservices/OidcDevUIProcessor.java b/extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/devservices/OidcDevUIProcessor.java
@@ -17,9 +17,9 @@
 import io.quarkus.devservices.oidc.OidcDevServicesConfigBuildItem;
 import io.quarkus.devui.spi.JsonRPCProvidersBuildItem;
 import io.quarkus.devui.spi.page.CardPageBuildItem;
-import io.quarkus.oidc.OidcTenantConfig;
-import io.quarkus.oidc.OidcTenantConfig.Provider;
 import io.quarkus.oidc.deployment.OidcBuildTimeConfig;
+import io.quarkus.oidc.runtime.OidcTenantConfig;
+import io.quarkus.oidc.runtime.OidcTenantConfig.Provider;
 import io.quarkus.oidc.runtime.devui.OidcDevJsonRpcService;
 import io.quarkus.oidc.runtime.devui.OidcDevUiRecorder;
 import io.quarkus.oidc.runtime.providers.KnownOidcProviders;
diff --git a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/OpaqueTokenVerificationWithUserInfoValidationTest.java b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/OpaqueTokenVerificationWithUserInfoValidationTest.java
@@ -34,7 +34,8 @@ public class OpaqueTokenVerificationWithUserInfoValidationTest {
                 // assert UserInfo is required
                 assertTrue(
                         te.getMessage()
-                                .contains("UserInfo is not required but 'verifyAccessTokenWithUserInfo' is enabled"),
+                                .contains(
+                                        "UserInfo is not required but 'quarkus.oidc.token.verify-access-token-with-user-info' is enabled"),
                         te.getMessage());
             });
 
diff --git a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/UserInfoRequiredDetectionTest.java b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/UserInfoRequiredDetectionTest.java
@@ -107,7 +107,7 @@ public static class UserInfoResource {
         @Path("default-tenant-random")
         @GET
         public String getDefaultTenantName() {
-            if (!tenantConfigBean.getDefaultTenant().oidcConfig().authentication.userInfoRequired.orElse(false)) {
+            if (!tenantConfigBean.getDefaultTenant().oidcConfig().authentication().userInfoRequired().orElse(false)) {
                 throw new IllegalStateException("Default tenant user info should be required");
             }
             String tenantId = routingContext.get(OidcUtils.TENANT_ID_ATTRIBUTE);
@@ -126,7 +126,7 @@ public String getDefaultTenantName() {
         @Path("named-tenant-random")
         @GET
         public String getNamedTenantName() {
-            if (!getNamedTenantConfig("named").authentication.userInfoRequired.orElse(false)) {
+            if (!getNamedTenantConfig("named").authentication().userInfoRequired().orElse(false)) {
                 throw new IllegalStateException("Named tenant user info should be required");
             }
             String tenantId = routingContext.get(OidcUtils.TENANT_ID_ATTRIBUTE);
@@ -142,14 +142,14 @@ public String getNamedTenantName() {
         @Path("named-tenant-2")
         @GET
         public boolean getNamed2TenantUserInfoRequired() {
-            return getNamedTenantConfig("named-2").authentication.userInfoRequired.orElse(false);
+            return getNamedTenantConfig("named-2").authentication().userInfoRequired().orElse(false);
         }
 
         @PermissionsAllowed("openid")
         @Path("named-tenant-3")
         @GET
         public boolean getNamed3TenantUserInfoRequired() {
-            return getNamedTenantConfig("named-3").authentication.userInfoRequired.orElse(false);
+            return getNamedTenantConfig("named-3").authentication().userInfoRequired().orElse(false);
         }
 
         private OidcTenantConfig getNamedTenantConfig(String configName) {
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
@@ -1040,10 +1040,10 @@ private String generateInternalIdToken(TenantConfigContext context, UserInfo use
         } else if (accessTokenExpiresInSecs != null) {
             builder.expiresIn(accessTokenExpiresInSecs);
         }
-        builder.audience(context.oidcConfig().getClientId().get());
+        builder.audience(context.oidcConfig().clientId().get());
 
         JwtSignatureBuilder sigBuilder = builder.jws().header(INTERNAL_IDTOKEN_HEADER, true);
-        String clientOrJwtSecret = OidcCommonUtils.getClientOrJwtSecret(context.oidcConfig().credentials);
+        String clientOrJwtSecret = OidcCommonUtils.getClientOrJwtSecret(context.oidcConfig().credentials());
         if (clientOrJwtSecret != null) {
             LOG.debug("Signing internal ID token with a configured client secret");
             return sigBuilder.sign(KeyUtils.createSecretKeyFromSecret(clientOrJwtSecret));
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java
@@ -261,7 +261,7 @@ private Uni<TenantConfigContext> getDynamicTenantContext(RoutingContext context)
             @Override
             public Uni<? extends TenantConfigContext> apply(OidcTenantConfig tenantConfig) {
                 if (tenantConfig != null) {
-                    var tenantId = tenantConfig.getTenantId()
+                    var tenantId = tenantConfig.tenantId()
                             .orElseThrow(() -> new OIDCException("Tenant configuration must have tenant id"));
                     var tenantContext = tenantConfigBean.getDynamicTenant(tenantId);
                     if (tenantContext == null) {
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcConfigPropertySupplier.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcConfigPropertySupplier.java
@@ -9,10 +9,9 @@
 import org.eclipse.microprofile.config.Config;
 import org.eclipse.microprofile.config.ConfigProvider;
 
-import io.quarkus.oidc.OidcTenantConfig;
-import io.quarkus.oidc.OidcTenantConfig.Provider;
 import io.quarkus.oidc.common.runtime.OidcCommonUtils;
 import io.quarkus.oidc.common.runtime.OidcConstants;
+import io.quarkus.oidc.runtime.OidcTenantConfig.Provider;
 import io.quarkus.oidc.runtime.providers.KnownOidcProviders;
 import io.smallrye.config.SmallRyeConfig;
 
@@ -99,7 +98,7 @@ public String get(Config config) {
                 if (END_SESSION_PATH_CONFIG_KEY.equals(oidcConfigProperty)) {
                     value = providerConfig.endSessionPath();
                 } else if (TOKEN_PATH_CONFIG_KEY.equals(oidcConfigProperty)) {
-                    value = providerConfig.tokenPath;
+                    value = providerConfig.tokenPath();
                 } else if (AUTH_PATH_CONFIG_KEY.equals(oidcConfigProperty)) {
                     value = providerConfig.authorizationPath();
                 }
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcImpl.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcImpl.java
@@ -13,7 +13,7 @@
 
 final class OidcImpl implements Oidc {
 
-    private Map<String, OidcTenantConfig> staticTenantConfigs;
+    private final Map<String, OidcTenantConfig> staticTenantConfigs;
     private OidcTenantConfig defaultTenantConfig;
 
     OidcImpl(OidcConfig config) {
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java
@@ -574,7 +574,7 @@ static OidcTenantConfig mergeTenantConfig(OidcTenantConfig tenant, OidcTenantCon
     static OidcTenantConfig resolveProviderConfig(OidcTenantConfig oidcTenantConfig) {
         if (oidcTenantConfig != null && oidcTenantConfig.provider().isPresent()) {
             return OidcUtils.mergeTenantConfig(oidcTenantConfig,
-                    KnownOidcProviders.provider(oidcTenantConfig.provider.get()));
+                    KnownOidcProviders.provider(oidcTenantConfig.provider().get()));
         } else {
             return oidcTenantConfig;
         }
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java
@@ -220,8 +220,8 @@ private Uni<TenantConfigContext> createTenantContext(OidcTenantConfig oidcTenant
         }
         if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)
                 && !enableUserInfo(oidcConfig)) {
-            throw new ConfigurationException(
-                    "UserInfo is not required but 'verifyAccessTokenWithUserInfo' is enabled");
+            String propertyName = getConfigPropertyForTenant(tenantId, "token.verify-access-token-with-user-info");
+            throw new ConfigurationException("UserInfo is not required but '%s' is enabled".formatted(propertyName));
         }
         if (!oidcConfig.authentication().idTokenRequired().orElse(true) && OidcUtils.isWebApp(oidcConfig)
                 && StepUpAuthenticationPolicy.isEnabled()) {
@@ -234,7 +234,8 @@ private Uni<TenantConfigContext> createTenantContext(OidcTenantConfig oidcTenant
         }
         if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)) {
             throw new ConfigurationException(
-                    "UserInfo is not required but it will be needed to verify a code flow access token");
+                    "UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token"
+                            .formatted(tenantId));
         }
 
         if (!oidcConfig.discoveryEnabled().orElse(true)) {
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/devui/OidcDevSessionCookieReaderHandler.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/devui/OidcDevSessionCookieReaderHandler.java
@@ -4,26 +4,25 @@
 import io.quarkus.oidc.AuthorizationCodeTokens;
 import io.quarkus.oidc.OidcTenantConfig;
 import io.quarkus.oidc.runtime.DefaultTokenStateManager;
-import io.quarkus.oidc.runtime.OidcConfig;
 import io.quarkus.oidc.runtime.OidcUtils;
+import io.quarkus.oidc.runtime.TenantConfigBean;
 import io.smallrye.mutiny.Uni;
 import io.vertx.core.Handler;
 import io.vertx.core.http.Cookie;
 import io.vertx.ext.web.RoutingContext;
 
 final class OidcDevSessionCookieReaderHandler implements Handler<RoutingContext> {
 
-    private final OidcTenantConfig defaultTenantConfig;
+    OidcDevSessionCookieReaderHandler() {
 
-    OidcDevSessionCookieReaderHandler(OidcConfig oidcConfig) {
-        this.defaultTenantConfig = OidcTenantConfig.of(OidcConfig.getDefaultTenant(oidcConfig));
     }
 
     @Override
     public void handle(RoutingContext rc) {
         Cookie cookie = rc.request().getCookie(OidcUtils.SESSION_COOKIE_NAME);
         if (cookie != null) {
             DefaultTokenStateManager tokenStateManager = Arc.container().instance(DefaultTokenStateManager.class).get();
+            OidcTenantConfig defaultTenantConfig = getDefaultTenantConfig();
             Uni<AuthorizationCodeTokens> tokensUni = tokenStateManager.getTokens(rc, defaultTenantConfig, cookie.getValue(),
                     null);
             tokensUni.subscribe().with(tokens -> {
@@ -41,4 +40,12 @@ public void handle(RoutingContext rc) {
             rc.end("{}");
         }
     }
+
+    private static OidcTenantConfig getDefaultTenantConfig() {
+        TenantConfigBean tenantConfigBean = Arc.container().instance(TenantConfigBean.class).get();
+        if (tenantConfigBean.getDefaultTenant() != null && tenantConfigBean.getDefaultTenant().oidcConfig() != null) {
+            return tenantConfigBean.getDefaultTenant().oidcConfig();
+        }
+        return OidcTenantConfig.builder().build();
+    }
 }
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/devui/OidcDevUiRecorder.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/devui/OidcDevUiRecorder.java
@@ -8,7 +8,6 @@
 
 import io.quarkus.arc.runtime.BeanContainer;
 import io.quarkus.oidc.common.runtime.OidcConstants;
-import io.quarkus.oidc.runtime.OidcConfig;
 import io.quarkus.runtime.RuntimeValue;
 import io.quarkus.runtime.annotations.Recorder;
 import io.quarkus.vertx.core.runtime.VertxCoreRecorder;
@@ -26,12 +25,6 @@ public class OidcDevUiRecorder {
 
     private static final Logger LOG = Logger.getLogger(OidcDevUiRecorder.class);
 
-    private final RuntimeValue<OidcConfig> oidcConfigRuntimeValue;
-
-    public OidcDevUiRecorder(RuntimeValue<OidcConfig> oidcConfigRuntimeValue) {
-        this.oidcConfigRuntimeValue = oidcConfigRuntimeValue;
-    }
-
     public void createJsonRPCService(BeanContainer beanContainer,
             RuntimeValue<OidcDevUiRpcSvcPropertiesBean> oidcDevUiRpcSvcPropertiesBean, VertxHttpConfig httpConfig) {
         OidcDevJsonRpcService jsonRpcService = beanContainer.beanInstance(OidcDevJsonRpcService.class);
@@ -62,7 +55,7 @@ public RuntimeValue<OidcDevUiRpcSvcPropertiesBean> getRpcServiceProperties(Strin
     }
 
     public Handler<RoutingContext> readSessionCookieHandler() {
-        return new OidcDevSessionCookieReaderHandler(oidcConfigRuntimeValue.getValue());
+        return new OidcDevSessionCookieReaderHandler();
     }
 
     public Handler<RoutingContext> logoutHandler() {
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/providers/KnownOidcProviders.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/providers/KnownOidcProviders.java
@@ -7,12 +7,13 @@
 import static io.quarkus.oidc.runtime.OidcTenantConfig.Authentication.ResponseMode.FORM_POST;
 
 import io.quarkus.oidc.OidcTenantConfig;
+import io.quarkus.oidc.runtime.OidcTenantConfig.Provider;
 import io.quarkus.oidc.runtime.builders.AuthenticationConfigBuilder;
 import io.smallrye.jwt.algorithm.SignatureAlgorithm;
 
 public class KnownOidcProviders {
 
-    public static OidcTenantConfig provider(OidcTenantConfig.Provider provider) {
+    public static OidcTenantConfig provider(Provider provider) {
         return switch (provider) {
             case APPLE -> apple();
             case DISCORD -> discord();
diff --git a/extensions/oidc/runtime/src/test/java/io/quarkus/oidc/runtime/KnownOidcProvidersTest.java b/extensions/oidc/runtime/src/test/java/io/quarkus/oidc/runtime/KnownOidcProvidersTest.java
@@ -11,8 +11,8 @@
 import io.quarkus.oidc.OidcTenantConfig;
 import io.quarkus.oidc.OidcTenantConfig.ApplicationType;
 import io.quarkus.oidc.OidcTenantConfig.Authentication.ResponseMode;
-import io.quarkus.oidc.OidcTenantConfig.Provider;
 import io.quarkus.oidc.common.runtime.OidcClientCommonConfig.Credentials.Secret.Method;
+import io.quarkus.oidc.runtime.OidcTenantConfig.Provider;
 import io.quarkus.oidc.runtime.providers.KnownOidcProviders;
 import io.smallrye.jwt.algorithm.SignatureAlgorithm;
 

Original file line number	Diff line number	Diff line change
`@@ -574,7 +574,7 @@ static OidcTenantConfig mergeTenantConfig(OidcTenantConfig tenant, OidcTenantCon`
`574`	`574`	`static OidcTenantConfig resolveProviderConfig(OidcTenantConfig oidcTenantConfig) {`
`575`	`575`	`if (oidcTenantConfig != null && oidcTenantConfig.provider().isPresent()) {`
`576`	`576`	`return OidcUtils.mergeTenantConfig(oidcTenantConfig,`
`577`		`- KnownOidcProviders.provider(oidcTenantConfig.provider.get()));`
	`577`	`+ KnownOidcProviders.provider(oidcTenantConfig.provider().get()));`
`578`	`578`	`} else {`
`579`	`579`	`return oidcTenantConfig;`
`580`	`580`	`}`
Original file line number	Diff line number	Diff line change
`@@ -220,8 +220,8 @@ private Uni<TenantConfigContext> createTenantContext(OidcTenantConfig oidcTenant`
`220`	`220`	`}`
`221`	`221`	`if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)`
`222`	`222`	`&& !enableUserInfo(oidcConfig)) {`
`223`		`- throw new ConfigurationException(`
`224`		`- "UserInfo is not required but 'verifyAccessTokenWithUserInfo' is enabled");`
	`223`	`+ String propertyName = getConfigPropertyForTenant(tenantId, "token.verify-access-token-with-user-info");`
	`224`	`+ throw new ConfigurationException("UserInfo is not required but '%s' is enabled".formatted(propertyName));`
`225`	`225`	`}`
`226`	`226`	`if (!oidcConfig.authentication().idTokenRequired().orElse(true) && OidcUtils.isWebApp(oidcConfig)`
`227`	`227`	`&& StepUpAuthenticationPolicy.isEnabled()) {`
`@@ -234,7 +234,8 @@ private Uni<TenantConfigContext> createTenantContext(OidcTenantConfig oidcTenant`
`234`	`234`	`}`
`235`	`235`	`if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)) {`
`236`	`236`	`throw new ConfigurationException(`
`237`		`- "UserInfo is not required but it will be needed to verify a code flow access token");`
	`237`	`+ "UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token"`
	`238`	`+ .formatted(tenantId));`
`238`	`239`	`}`
`239`	`240`
`240`	`241`	`if (!oidcConfig.discoveryEnabled().orElse(true)) {`