RolesAllowed overrides OpenAPI definitions for 401 and 403 responses

[nderwin]

Describe the bug

I noticed the when I added APIResponse annotations to my REST endpoint to document the 401 and 403 responses, the OpenAPI documentation overrides my descriptions, and instead shows "Not Authorized" (401) and "Not Allowed" (403). I've traced this down to using the RolesAllowed annotation. If I use Authenticated, or no annotation at all, then the documentation reflects the APIResponse annotations.

Expected behavior

OpenAPI documentation should be using the provided APIResponse annotations to document the 401 and 403 endpoint responses.

Actual behavior

OpenAPI documentation is using hard-coded "Not Authorized" and "Not Allowed" response descriptions for the 401 and 403 response status codes. This appears to be coming from

quarkus/extensions/smallrye-openapi/deployment/src/main/java/io/quarkus/smallrye/openapi/deployment/filter/AutoRolesAllowedFilter.java

Line 80 in e21e338

for (APIResponseImpl response : getSecurityResponses()) {

How to Reproduce?

See attached reproducer.

1. Run in dev mode (./mvnw clean compile quarkus:dev)
2. check the OpenAPI documentation at http://localhost:8080/q/openapi.json
3. Note that the 401 and 403 documentation use the references
4. Change the GreetingResource class to use the RolesAllowed annotation (either at the class or method level, doesn't matter)
5. refresh the OpenAPI documentation
6. Note that the 401 and 403 documentation is now ignoring the references, and is instead hard-coded to "Not Authorized" and "Not Allowed"

Output of uname -a or ver

Linux laverne 5.11.0-40-generic #44~20.04.2-Ubuntu SMP Tue Oct 26 18:07:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

Output of java -version

openjdk version "11.0.13" 2021-10-19

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.7.1.Final

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)

Additional information

No response

[quarkus-bot]

/cc @EricWittmann, @MikeEdgar, @phillip-kruger

[nderwin]

Reproducer: openapi-example.zip

[phillip-kruger]

Thanks, I think this is the auto security that does this. I'll have a look a.s.a.p

[nderwin]

Created #25638 to address this.