[jaxrs-spec][quarkus] - Add CLI flag (useQuarkusSecurityAnnotations) to enable emitting security annotation (@authenticated, @RolesAllowed, @permitAll) (#23699)

* [jaxrs-spec][quarkus] Add useQuarkusSecurityAnnotations CLI option

Registers a new boolean generator option (default false, quarkus library only)
that will gate emission of Quarkus security annotations (@authenticated,
@RolesAllowed, @permitAll) in subsequent PRs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* [jaxrs-spec][quarkus] Test useQuarkusSecurityAnnotations CLI option registration

Covers: option registered with default false, readable as true for quarkus library,
and not processed for non-quarkus libraries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* added quarkus cli flag for security annotations

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Ignacio-Vidal

docs/generators/jaxrs-cxf-cdi.md

@@ -85,6 +85,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 |useMicroProfileOpenAPIAnnotations|Whether to generate Microprofile OpenAPI annotations. Only valid when library is set to quarkus.| |false|
 |useMutiny|Whether to use Smallrye Mutiny instead of CompletionStage for asynchronous computation. Only valid when library is set to quarkus.| |false|
 |useOneOfInterfaces|whether to use a java interface to describe a set of oneOf options, where each option is a class that implements the interface| |false|
+|useQuarkusSecurityAnnotations|Whether to generate Quarkus security annotations (@Authenticated, @RolesAllowed, @PermitAll). Only valid when library is set to quarkus.| |false|
 |useSwaggerAnnotations|Whether to generate Swagger annotations.| |true|
 |useSwaggerV3Annotations|Whether to generate Swagger v3 (OpenAPI v3) annotations.| |false|
 |useTags|use tags for creating interface and controller classnames| |false|

docs/generators/jaxrs-spec.md

@@ -86,6 +86,7 @@ These options may be applied as additional-properties (cli) or configOptions (pl
 |useMicroProfileOpenAPIAnnotations|Whether to generate Microprofile OpenAPI annotations. Only valid when library is set to quarkus.| |false|
 |useMutiny|Whether to use Smallrye Mutiny instead of CompletionStage for asynchronous computation. Only valid when library is set to quarkus.| |false|
 |useOneOfInterfaces|whether to use a java interface to describe a set of oneOf options, where each option is a class that implements the interface| |false|
+|useQuarkusSecurityAnnotations|Whether to generate Quarkus security annotations (@Authenticated, @RolesAllowed, @PermitAll). Only valid when library is set to quarkus.| |false|
 |useSwaggerAnnotations|Whether to generate Swagger annotations.| |true|
 |useSwaggerV3Annotations|Whether to generate Swagger v3 (OpenAPI v3) annotations.| |false|
 |useTags|use tags for creating interface and controller classnames| |false|

modules/openapi-generator/src/main/java/org/openapitools/codegen/languages/JavaJAXRSSpecServerCodegen.java

@@ -53,6 +53,7 @@ public class JavaJAXRSSpecServerCodegen extends AbstractJavaJAXRSServerCodegen {
     public static final String USE_MUTINY = "useMutiny";
     public static final String OPEN_API_SPEC_FILE_LOCATION = "openApiSpecFileLocation";
     public static final String GENERATE_JSON_CREATOR = "generateJsonCreator";
+    public static final String USE_QUARKUS_SECURITY_ANNOTATIONS = "useQuarkusSecurityAnnotations";
 
     public static final String QUARKUS_LIBRARY = "quarkus";
     public static final String THORNTAIL_LIBRARY = "thorntail";
@@ -68,6 +69,7 @@ public class JavaJAXRSSpecServerCodegen extends AbstractJavaJAXRSServerCodegen {
     private boolean useSwaggerV3Annotations = false;
     private boolean useMicroProfileOpenAPIAnnotations = false;
     private boolean useMutiny = false;
+    private boolean useQuarkusSecurityAnnotations = false;
 
     @Getter @Setter
     protected boolean generateJsonCreator = true;
@@ -147,6 +149,7 @@ public JavaJAXRSSpecServerCodegen() {
         cliOptions.add(CliOption.newString(OPEN_API_SPEC_FILE_LOCATION, "Location where the file containing the spec will be generated in the output folder. No file generated when set to null or empty string."));
         cliOptions.add(CliOption.newBoolean(SUPPORT_ASYNC, "Wrap responses in CompletionStage type, allowing asynchronous computation (requires JAX-RS 2.1).", supportAsync));
         cliOptions.add(CliOption.newBoolean(USE_MUTINY, "Whether to use Smallrye Mutiny instead of CompletionStage for asynchronous computation. Only valid when library is set to quarkus.", useMutiny));
+        cliOptions.add(CliOption.newBoolean(USE_QUARKUS_SECURITY_ANNOTATIONS, "Whether to generate Quarkus security annotations (@Authenticated, @RolesAllowed, @PermitAll). Only valid when library is set to quarkus.", useQuarkusSecurityAnnotations));
         cliOptions.add(CliOption.newBoolean(GENERATE_JSON_CREATOR, "Whether to generate @JsonCreator constructor for required properties.", generateJsonCreator));
     }
 
@@ -189,6 +192,10 @@ public void processOpts() {
             convertPropertyToBooleanAndWriteBack(USE_MUTINY, value -> useMutiny = value);
         }
 
+        if (QUARKUS_LIBRARY.equals(library)) {
+            convertPropertyToBooleanAndWriteBack(USE_QUARKUS_SECURITY_ANNOTATIONS, value -> useQuarkusSecurityAnnotations = value);
+        }
+
         convertPropertyToBooleanAndWriteBack(GENERATE_JSON_CREATOR, this::setGenerateJsonCreator);
 
         if (additionalProperties.containsKey(OPEN_API_SPEC_FILE_LOCATION)) {

modules/openapi-generator/src/test/java/org/openapitools/codegen/java/jaxrs/JavaJAXRSSpecServerCodegenTest.java

@@ -1545,4 +1545,45 @@ public void generateQuarkusConcreteClassDoesNotAddResponseStatusAnnotation() thr
                 "@ResponseStatus",
                 "import org.jboss.resteasy.reactive.ResponseStatus");
     }
+
+    @Test
+    public void useQuarkusSecurityAnnotationsIsRegisteredWithDefaultFalse() {
+        final JavaJAXRSSpecServerCodegen codegen = new JavaJAXRSSpecServerCodegen();
+        Assert.assertTrue(
+            codegen.cliOptions().stream()
+                .anyMatch(opt -> USE_QUARKUS_SECURITY_ANNOTATIONS.equals(opt.getOpt()) && "false".equals(opt.getDefault())),
+            "useQuarkusSecurityAnnotations should be a registered CLI option defaulting to false"
+        );
+    }
+
+    @Test
+    public void useQuarkusSecurityAnnotationsDefaultsToFalseForQuarkusLibrary() {
+        codegen.setLibrary(QUARKUS_LIBRARY);
+        codegen.processOpts();
+
+        Assert.assertFalse(
+            (boolean) codegen.additionalProperties().getOrDefault(USE_QUARKUS_SECURITY_ANNOTATIONS, false)
+        );
+    }
+
+    @Test
+    public void useQuarkusSecurityAnnotationsCanBeEnabledForQuarkusLibrary() {
+        codegen.setLibrary(QUARKUS_LIBRARY);
+        codegen.additionalProperties().put(USE_QUARKUS_SECURITY_ANNOTATIONS, true);
+        codegen.processOpts();
+
+        new ConfigAssert(codegen.additionalProperties())
+            .assertValue(USE_QUARKUS_SECURITY_ANNOTATIONS, true);
+    }
+
+    @Test
+    public void useQuarkusSecurityAnnotationsNotProcessedForNonQuarkusLibrary() {
+        // flag is only consumed when library=quarkus; for other libraries the block is skipped
+        codegen.additionalProperties().put(USE_QUARKUS_SECURITY_ANNOTATIONS, true);
+        codegen.processOpts();
+
+        // convertPropertyToBooleanAndWriteBack was never called, so the value was never
+        // written back as a boolean — the key holds the raw Object we put in, not false
+        Assert.assertNotEquals(false, codegen.additionalProperties().get(USE_QUARKUS_SECURITY_ANNOTATIONS));
+    }
 }