Review fixes

kabir · kabir · commit 815d07b0d76c · 2026-05-05T13:28:41.000+01:00
diff --git a/reference/common/src/main/java/org/a2aproject/sdk/server/common/quarkus/VertxSecurityHelper.java b/reference/common/src/main/java/org/a2aproject/sdk/server/common/quarkus/VertxSecurityHelper.java
@@ -7,7 +7,9 @@
 import io.quarkus.arc.Arc;
 import io.quarkus.arc.ManagedContext;
 import io.quarkus.security.identity.CurrentIdentityAssociation;
+import io.quarkus.vertx.http.runtime.security.ChallengeData;
 import io.quarkus.vertx.http.runtime.security.HttpAuthenticator;
+import io.vertx.core.Context;
 import io.vertx.ext.web.RoutingContext;
 
 /**
@@ -48,7 +50,7 @@
  *                     myAuthenticatedMethod(); // Has @Authenticated annotation
  *                 });
  *             } catch (UnauthorizedException | ForbiddenException e) {
- *                 VertxSecurityHelper.handleAuthError(ctx, e);
+ *                 securityHelper.handleAuthError(ctx, e);
  *             } catch (Exception e) {
  *                 VertxSecurityHelper.handleGenericError(ctx);
  *             }
@@ -68,9 +70,8 @@ public final class VertxSecurityHelper {
     @Inject
     Instance<CurrentIdentityAssociation> currentIdentityAssociation;
 
-
     public VertxSecurityHelper() {
-        // Utility class - no instantiation
+        // CDI-managed constructor
     }
 
     /**
@@ -98,6 +99,10 @@ public VertxSecurityHelper() {
      * @throws RuntimeException if the task throws an exception
      */
     public void runInRequestContext(RoutingContext ctx, Runnable task) {
+        if (Context.isOnEventLoopThread()) {
+            throw new IllegalStateException(
+                    "Cannot perform blocking authentication on event loop thread. Use blockingHandler().");
+        }
         ManagedContext requestContext = Arc.container().requestContext();
         boolean wasActive = requestContext.isActive();
         if (!wasActive) {
@@ -124,22 +129,31 @@ public void runInRequestContext(RoutingContext ctx, Runnable task) {
      *
      * <ul>
      *   <li>{@code ForbiddenException} → HTTP 403 Forbidden</li>
-     *   <li>All other auth errors → HTTP 401 Unauthorized with {@code WWW-Authenticate: Basic} header</li>
+     *   <li>All other auth errors → delegates to {@link HttpAuthenticator#getChallenge} to obtain
+     *       the correct {@code WWW-Authenticate} header for the configured auth mechanism
+     *       (Basic, Bearer, etc.) and sends HTTP 401 with the challenge header</li>
      * </ul>
      *
      * @param ctx the routing context
      * @param e the authentication or authorization exception
      */
-    public static void handleAuthError(RoutingContext ctx, Exception e) {
+    public void handleAuthError(RoutingContext ctx, Exception e) {
         if (!ctx.response().ended()) {
             if (e instanceof io.quarkus.security.ForbiddenException) {
                 ctx.response()
                     .setStatusCode(403)
                     .end();
             } else {
+                int status = 401;
+                if (!httpAuthenticator.isUnsatisfied()) {
+                    ChallengeData challenge = httpAuthenticator.get().getChallenge(ctx).await().indefinitely();
+                    if (challenge != null) {
+                        status = challenge.status;
+                        ctx.response().putHeader(challenge.headerName, challenge.headerContent);
+                    }
+                }
                 ctx.response()
-                    .setStatusCode(401)
-                    .putHeader("WWW-Authenticate", "Basic realm=\"Quarkus\"")
+                    .setStatusCode(status)
                     .end();
             }
         }
diff --git a/reference/grpc/pom.xml b/reference/grpc/pom.xml
@@ -105,11 +105,6 @@
             <artifactId>quarkus-elytron-security-properties-file</artifactId>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>io.quarkus</groupId>
-            <artifactId>quarkus-test-security</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 
-</project> 
+</project>
diff --git a/reference/grpc/src/test/java/org/a2aproject/sdk/server/grpc/quarkus/AuthTestProfile.java b/reference/grpc/src/test/java/org/a2aproject/sdk/server/grpc/quarkus/AuthTestProfile.java
diff --git a/reference/grpc/src/test/java/org/a2aproject/sdk/server/grpc/quarkus/QuarkusA2AGrpcWithAuthTest.java b/reference/grpc/src/test/java/org/a2aproject/sdk/server/grpc/quarkus/QuarkusA2AGrpcWithAuthTest.java
@@ -8,6 +8,7 @@
 import org.a2aproject.sdk.client.transport.spi.interceptors.auth.AuthInterceptor;
 import org.a2aproject.sdk.server.PublicAgentCard;
 import org.a2aproject.sdk.server.apps.common.AbstractA2AServerWithAuthTest;
+import org.a2aproject.sdk.server.apps.common.AuthTestProfile;
 import org.a2aproject.sdk.spec.AgentCard;
 import org.a2aproject.sdk.spec.TransportProtocol;
 import io.grpc.ManagedChannel;
diff --git a/reference/jsonrpc/pom.xml b/reference/jsonrpc/pom.xml
@@ -110,10 +110,5 @@
             <artifactId>quarkus-elytron-security-properties-file</artifactId>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>io.quarkus</groupId>
-            <artifactId>quarkus-test-security</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 </project>
diff --git a/reference/jsonrpc/src/main/java/org/a2aproject/sdk/server/apps/quarkus/A2AServerRoutes.java b/reference/jsonrpc/src/main/java/org/a2aproject/sdk/server/apps/quarkus/A2AServerRoutes.java
@@ -216,7 +216,7 @@ void setupRoutes(@Observes Router router) {
                         invokeJSONRPCHandler(ctx.body().asString(), ctx);
                     });
                 } catch (UnauthorizedException | ForbiddenException e) {
-                    VertxSecurityHelper.handleAuthError(ctx, e);
+                    vertxSecurityHelper.handleAuthError(ctx, e);
                 } catch (Exception e) {
                     VertxSecurityHelper.handleGenericError(ctx);
                 }
diff --git a/reference/jsonrpc/src/test/java/org/a2aproject/sdk/server/apps/quarkus/QuarkusA2AJSONRPCWithAuthJdkTest.java b/reference/jsonrpc/src/test/java/org/a2aproject/sdk/server/apps/quarkus/QuarkusA2AJSONRPCWithAuthJdkTest.java
@@ -7,6 +7,7 @@
 import org.a2aproject.sdk.client.transport.jsonrpc.JSONRPCTransportConfigBuilder;
 import org.a2aproject.sdk.client.transport.spi.interceptors.auth.AuthInterceptor;
 import org.a2aproject.sdk.server.apps.common.AbstractA2AServerWithAuthTest;
+import org.a2aproject.sdk.server.apps.common.AuthTestProfile;
 import org.a2aproject.sdk.spec.TransportProtocol;
 import io.quarkus.test.junit.QuarkusTest;
 import io.quarkus.test.junit.TestProfile;
diff --git a/reference/jsonrpc/src/test/java/org/a2aproject/sdk/server/apps/quarkus/QuarkusA2AJSONRPCWithAuthVertxTest.java b/reference/jsonrpc/src/test/java/org/a2aproject/sdk/server/apps/quarkus/QuarkusA2AJSONRPCWithAuthVertxTest.java
@@ -7,6 +7,7 @@
 import org.a2aproject.sdk.client.transport.jsonrpc.JSONRPCTransportConfigBuilder;
 import org.a2aproject.sdk.client.transport.spi.interceptors.auth.AuthInterceptor;
 import org.a2aproject.sdk.server.apps.common.AbstractA2AServerWithAuthTest;
+import org.a2aproject.sdk.server.apps.common.AuthTestProfile;
 import org.a2aproject.sdk.spec.TransportProtocol;
 import io.quarkus.test.junit.QuarkusTest;
 import io.quarkus.test.junit.TestProfile;
diff --git a/reference/jsonrpc/src/test/resources/application.properties b/reference/jsonrpc/src/test/resources/application.properties
@@ -4,10 +4,3 @@ quarkus.arc.selected-alternatives=org.a2aproject.sdk.server.apps.common.TestHttp
 quarkus.log.category."org.a2aproject.sdk.server.events".level=DEBUG
 quarkus.log.category."org.a2aproject.sdk.server.requesthandlers".level=DEBUG
 quarkus.log.category."org.a2aproject.sdk.server.tasks".level=DEBUG
-
-# Security configuration for regular tests
-# Provide a test identity provider that always authenticates
-# AuthTestProfile overrides this to require real HTTP Basic Auth
-%test.quarkus.test-security.test-enabled=true
-%test.quarkus.test-security.user=testuser
-%test.quarkus.test-security.roles=user
diff --git a/reference/rest/pom.xml b/reference/rest/pom.xml
@@ -114,11 +114,6 @@
             <artifactId>quarkus-elytron-security-properties-file</artifactId>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>io.quarkus</groupId>
-            <artifactId>quarkus-test-security</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 
     <build>
diff --git a/reference/rest/src/main/java/org/a2aproject/sdk/server/rest/quarkus/A2AServerRoutes.java b/reference/rest/src/main/java/org/a2aproject/sdk/server/rest/quarkus/A2AServerRoutes.java
@@ -253,7 +253,7 @@ private Handler<RoutingContext> authenticated(Consumer<RoutingContext> action) {
             try {
                 vertxSecurityHelper.runInRequestContext(ctx, () -> action.accept(ctx));
             } catch (UnauthorizedException | ForbiddenException e) {
-                VertxSecurityHelper.handleAuthError(ctx, e);
+                vertxSecurityHelper.handleAuthError(ctx, e);
             } catch (Exception e) {
                 VertxSecurityHelper.handleGenericError(ctx);
             }
diff --git a/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/AuthTestProfile.java b/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/AuthTestProfile.java
diff --git a/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/QuarkusA2ARestWithAuthJdkTest.java b/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/QuarkusA2ARestWithAuthJdkTest.java
@@ -6,6 +6,7 @@
 import org.a2aproject.sdk.client.transport.rest.RestTransportConfigBuilder;
 import org.a2aproject.sdk.client.transport.spi.interceptors.auth.AuthInterceptor;
 import org.a2aproject.sdk.server.apps.common.AbstractA2AServerWithAuthTest;
+import org.a2aproject.sdk.server.apps.common.AuthTestProfile;
 import org.a2aproject.sdk.spec.TransportProtocol;
 import io.quarkus.test.junit.QuarkusTest;
 import io.quarkus.test.junit.TestProfile;
diff --git a/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/QuarkusA2ARestWithAuthVertxTest.java b/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/QuarkusA2ARestWithAuthVertxTest.java
@@ -6,6 +6,7 @@
 import org.a2aproject.sdk.client.transport.rest.RestTransportConfigBuilder;
 import org.a2aproject.sdk.client.transport.spi.interceptors.auth.AuthInterceptor;
 import org.a2aproject.sdk.server.apps.common.AbstractA2AServerWithAuthTest;
+import org.a2aproject.sdk.server.apps.common.AuthTestProfile;
 import org.a2aproject.sdk.spec.TransportProtocol;
 import io.quarkus.test.junit.QuarkusTest;
 import io.quarkus.test.junit.TestProfile;
diff --git a/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/TestIdentityProvider.java b/reference/rest/src/test/java/org/a2aproject/sdk/server/rest/quarkus/TestIdentityProvider.java
diff --git a/reference/rest/src/test/resources/application.properties b/reference/rest/src/test/resources/application.properties
@@ -1,8 +1 @@
 quarkus.arc.selected-alternatives=org.a2aproject.sdk.server.apps.common.TestHttpClient
-
-# Security configuration for regular tests
-# Inject a test user automatically so @Authenticated checks pass without requiring credentials
-# AuthTestProfile overrides this to require REAL HTTP Basic Auth
-quarkus.test.security.auth.enabled=true
-quarkus.test.security.default-user=testuser
-quarkus.test.security.default-roles=user
diff --git a/tests/server-common/pom.xml b/tests/server-common/pom.xml
@@ -55,6 +55,16 @@
             <artifactId>quarkus-arc</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-security</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-junit5</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.a2aproject.sdk</groupId>
             <artifactId>a2a-java-sdk-client-transport-jsonrpc</artifactId>
diff --git a/tests/server-common/src/test/java/org/a2aproject/sdk/server/apps/common/AuthTestProfile.java b/tests/server-common/src/test/java/org/a2aproject/sdk/server/apps/common/AuthTestProfile.java
@@ -1,4 +1,4 @@
-package org.a2aproject.sdk.server.apps.quarkus;
+package org.a2aproject.sdk.server.apps.common;
 
 import java.util.Map;
 
@@ -19,12 +19,18 @@ public class AuthTestProfile implements QuarkusTestProfile {
     @Override
     public Map<String, String> getConfigOverrides() {
         return Map.ofEntries(
-                // Disable the TestIdentityProvider - we want real authentication
+                // Disable TestIdentityProvider auto-authentication
                 Map.entry("test.identity.auto-auth", "false"),
 
+                // Disable Quarkus test security
+                Map.entry("quarkus.test.security.auth.enabled", "false"),
+
                 // Enable security in AgentCard (server advertises Basic Auth support)
                 Map.entry("test.agent.security.enabled", "true"),
 
+                // Enable authorization so @Authenticated is enforced (used by gRPC)
+                Map.entry("test.authorization.enabled", "true"),
+
                 // Enable embedded user store
                 Map.entry("quarkus.security.users.embedded.enabled", "true"),
                 Map.entry("quarkus.security.users.embedded.plain-text", "true"),
diff --git a/tests/server-common/src/test/java/org/a2aproject/sdk/server/apps/common/TestIdentityProvider.java b/tests/server-common/src/test/java/org/a2aproject/sdk/server/apps/common/TestIdentityProvider.java
@@ -1,4 +1,4 @@
-package org.a2aproject.sdk.server.apps.quarkus;
+package org.a2aproject.sdk.server.apps.common;
 
 import jakarta.enterprise.context.ApplicationScoped;
 

Original file line number	Diff line number	Diff line change
`@@ -216,7 +216,7 @@ void setupRoutes(@Observes Router router) {`
`216`	`216`	`invokeJSONRPCHandler(ctx.body().asString(), ctx);`
`217`	`217`	`});`
`218`	`218`	`} catch (UnauthorizedException \| ForbiddenException e) {`
`219`		`- VertxSecurityHelper.handleAuthError(ctx, e);`
	`219`	`+ vertxSecurityHelper.handleAuthError(ctx, e);`
`220`	`220`	`} catch (Exception e) {`
`221`	`221`	`VertxSecurityHelper.handleGenericError(ctx);`
`222`	`222`	`}`