Code review comment: If someone however augment identity inside non-JAXRS HTTP Perms, then there of course is different event. Because it is different authorization. This is authorization.

Code before review:
Uni<SecurityIdentity> getPermissionCheck(ResteasyReactiveRequestContext requestContext, SecurityIdentity identity) {
final RoutingContext routingContext = requestContext.unwrap(RoutingContext.class);
if (routingContext == null) {
throw new IllegalStateException(
"HTTP Security policy applied only on Quarkus REST cannot be run as 'RoutingContext' is null");
}
record SecurityCheckWithIdentity(SecurityIdentity identity, HttpSecurityPolicy.CheckResult checkResult) {
}
return jaxRsPathMatchingPolicy
.checkPermission(routingContext, identity == null ? getDeferredIdentity() : Uni.createFrom().item(identity),
authorizationRequestContext)
.flatMap(new Function<HttpSecurityPolicy.CheckResult, Uni<? extends SecurityCheckWithIdentity>>() {
@Override
public Uni<SecurityCheckWithIdentity> apply(HttpSecurityPolicy.CheckResult checkResult) {
if (identity != null) {
return Uni.createFrom().item(new SecurityCheckWithIdentity(identity, checkResult));
}
if (checkResult.isPermitted() && checkResult.getAugmentedIdentity() == null) {
return Uni.createFrom().item(new SecurityCheckWithIdentity(null, checkResult));
}
return getDeferredIdentity().map(new Function<SecurityIdentity, SecurityCheckWithIdentity>() {
@Override
public SecurityCheckWithIdentity apply(SecurityIdentity identity1) {
return new SecurityCheckWithIdentity(identity1, checkResult);
}
});
}
})
.map(new Function<SecurityCheckWithIdentity, SecurityIdentity>() {
@Override
public SecurityIdentity apply(SecurityCheckWithIdentity checkWithIdentity) {
final HttpSecurityPolicy.CheckResult checkResult = checkWithIdentity.checkResult();
final SecurityIdentity newIdentity;
if (checkResult.getAugmentedIdentity() == null) {
newIdentity = checkWithIdentity.identity();
} else if (checkResult.getAugmentedIdentity() != checkWithIdentity.identity()) {
newIdentity = checkResult.getAugmentedIdentity();
QuarkusHttpUser.setIdentity(newIdentity, routingContext);
identityAssociation.get().setIdentity(newIdentity);
} else {
newIdentity = checkResult.getAugmentedIdentity();
}
if (checkResult.isPermitted()) {
if (eventHelper.fireEventOnSuccess()) {
eventHelper.fireSuccessEvent(new AuthorizationSuccessEvent(newIdentity,
AbstractPathMatchingHttpSecurityPolicy.class.getName(),
Map.of(RoutingContext.class.getName(), routingContext,
AuthorizationSuccessEvent.SECURITY_IDENTITY_AUGMENTED,
isIdentityAugmented(checkWithIdentity, checkResult))));
}
return newIdentity;
}
final RuntimeException exception;
if (newIdentity.isAnonymous()) {
exception = new UnauthorizedException();
} else {
exception = new ForbiddenException();
}
if (eventHelper.fireEventOnFailure()) {
eventHelper.fireFailureEvent(new AuthorizationFailureEvent(newIdentity, exception,
AbstractPathMatchingHttpSecurityPolicy.class.getName(),
Map.of(RoutingContext.class.getName(), routingContext,
AuthorizationFailureEvent.SECURITY_IDENTITY_AUGMENTED,
isIdentityAugmented(checkWithIdentity, checkResult))));
}
throw exception;
}
private static boolean isIdentityAugmented(SecurityCheckWithIdentity checkWithIdentity,
HttpSecurityPolicy.CheckResult checkResult) {
return checkResult.getAugmentedIdentity() != null && !checkResult.getAugmentedIdentity().isAnonymous()
&& checkResult.getAugmentedIdentity() != checkWithIdentity.identity();
}
});
}

Line under review: final RuntimeException exception;

Code after addressing the review:
Uni<SecurityIdentity> getPermissionCheck(ResteasyReactiveRequestContext requestContext, SecurityIdentity identity) {
final RoutingContext routingContext = requestContext.unwrap(RoutingContext.class);
if (routingContext == null) {
throw new IllegalStateException(
"HTTP Security policy applied only on Quarkus REST cannot be run as 'RoutingContext' is null");
}
record SecurityCheckWithIdentity(SecurityIdentity identity, HttpSecurityPolicy.CheckResult checkResult) {
}
return jaxRsPathMatchingPolicy
.checkPermission(routingContext, identity == null ? getDeferredIdentity() : Uni.createFrom().item(identity),
authorizationRequestContext)
.flatMap(new Function<HttpSecurityPolicy.CheckResult, Uni<? extends SecurityCheckWithIdentity>>() {
@Override
public Uni<SecurityCheckWithIdentity> apply(HttpSecurityPolicy.CheckResult checkResult) {
if (identity != null) {
return Uni.createFrom().item(new SecurityCheckWithIdentity(identity, checkResult));
}
if (checkResult.isPermitted() && checkResult.getAugmentedIdentity() == null) {
return Uni.createFrom().item(new SecurityCheckWithIdentity(null, checkResult));
}
return getDeferredIdentity().map(new Function<SecurityIdentity, SecurityCheckWithIdentity>() {
@Override
public SecurityCheckWithIdentity apply(SecurityIdentity identity1) {
return new SecurityCheckWithIdentity(identity1, checkResult);
}
});
}
})
.map(new Function<SecurityCheckWithIdentity, SecurityIdentity>() {
@Override
public SecurityIdentity apply(SecurityCheckWithIdentity checkWithIdentity) {
final HttpSecurityPolicy.CheckResult checkResult = checkWithIdentity.checkResult();
final SecurityIdentity newIdentity;
if (checkResult.getAugmentedIdentity() == null) {
newIdentity = checkWithIdentity.identity();
} else if (checkResult.getAugmentedIdentity() != checkWithIdentity.identity()) {
newIdentity = checkResult.getAugmentedIdentity();
QuarkusHttpUser.setIdentity(newIdentity, routingContext);
identityAssociation.get().setIdentity(newIdentity);
} else {
newIdentity = checkResult.getAugmentedIdentity();
}
if (checkResult.isPermitted()) {
if (eventHelper.fireEventOnSuccess()) {
eventHelper.fireSuccessEvent(new AuthorizationSuccessEvent(newIdentity,
AbstractPathMatchingHttpSecurityPolicy.class.getName(),
Map.of(RoutingContext.class.getName(), routingContext)));
}
return newIdentity;
}
final RuntimeException exception;
if (newIdentity.isAnonymous()) {
exception = new UnauthorizedException();
} else {
exception = new ForbiddenException();
}
if (eventHelper.fireEventOnFailure()) {
eventHelper.fireFailureEvent(new AuthorizationFailureEvent(newIdentity, exception,
AbstractPathMatchingHttpSecurityPolicy.class.getName(),
Map.of(RoutingContext.class.getName(), routingContext)));
}
throw exception;
}
});
}