Provide a way to observe security events

[michalvavrik]

closes: #26549

[github-actions]

🙈 The PR is closed and the preview is expired.

[sberyozkin]

@michalvavrik Very nice, nearly ready to be merged

[michalvavrik]

@Ladicek @mkouba @manovotn You are right, I'll rewrite this PR so that only CDI events are used and there will be no API. I had following reasons to define API:

• one place to disable security events at runtime
• options for users to provide their own implementation of the SecurityEventProducer
• I tried to optimize as you saw too well :-)

@mkouba suggested on Zulip way to do all that I want to do and as you explained, handling of CDI events is already optimized and user can just observe events and then fire events with Kafka or whatever he wants.

I'll put this to draft, rework the PR and ask all of you for review when I'm done.

BTW @sberyozkin I'm sure you have opinions as well, but let me rework this first so that you can see what I have in mind this time. Thanks

[sberyozkin]

@michalvavrik I think we have agreed in all the pending/open comments, including keeping an interface and configuration property (even if we look at when to use it a bit differently), and IMHO this PR is nearly ready to be merged, thanks for your effort

[sberyozkin]

Thanks @michalvavrik

[manovotn]

My comments are just minor nitpicks, otherwise the CDI bits and the event-firing optimization look good to me.

[quarkus-bot]

Failing Jobs - Building c06cf1e

Status	Name	Step	Failures	Logs	Raw logs	Build scan
✔️	JVM Tests - JDK 17					🚧
✖	JVM Tests - JDK 21	Build	Failures	Logs	Raw logs	🚧
✖	Maven Tests - JDK 17	Build	Failures	Logs	Raw logs	🚧
✔️	Maven Tests - JDK 17 Windows					🚧
✖	Native Tests - Data1	Build	Failures	Logs	Raw logs	🚧

Full information is available in the Build summary check run.

Failures

⚙️ JVM Tests - JDK 21 #

- Failing: extensions/vertx-http/deployment 
! Skipped: devtools/cli extensions/agroal/deployment extensions/amazon-lambda-http/deployment and 364 more

📦 extensions/vertx-http/deployment

✖ io.quarkus.vertx.http.testrunner.includes.IncludePatternTestCase.checkTestsAreRun line 65 - More details - Source on GitHub

org.awaitility.core.ConditionTimeoutException: Failed to wait for test run 3 State{lastRun=2, running=true, inProgress=false, run=2, passed=2, failed=0, skipped=0, isBrokenOnly=false, isTestOutput=false, isInstrumentationBasedReload=false, isLiveReload=true}
	at io.quarkus.test.ContinuousTestingTestUtils.waitForNextCompletion(ContinuousTestingTestUtils.java:44)
	at io.quarkus.vertx.http.testrunner.includes.IncludePatternTestCase.checkTestsAreRun(IncludePatternTestCase.java:65)

---

⚙️ Maven Tests - JDK 17 #

- Failing: integration-tests/maven 

📦 integration-tests/maven

✖ io.quarkus.maven.it.DevMojoIT.testThatNewResourcesAreServed line 967 - More details - Source on GitHub

org.awaitility.core.ConditionTimeoutException: io.quarkus.maven.it.DevMojoIT expected "077fb8af-e91a-4074-bd9a-975119608bd4" but was "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua." within 2 minutes.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AbstractHamcrestCondition.await(AbstractHamcrestCondition.java:86)

✖ io.quarkus.maven.it.DevMojoIT.testThatNewResourcesAreServed line 967 - More details - Source on GitHub

org.awaitility.core.ConditionTimeoutException: io.quarkus.maven.it.DevMojoIT expected "077fb8af-e91a-4074-bd9a-975119608bd4" but was "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua." within 2 minutes.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.AbstractHamcrestCondition.await(AbstractHamcrestCondition.java:86)

---

⚙️ Native Tests - Data1 #

- Failing: integration-tests/hibernate-orm-tenancy/connection-resolver 

📦 integration-tests/hibernate-orm-tenancy/connection-resolver

✖ io.quarkus.it.hibernate.multitenancy.fruit.HibernateTenancyFunctionalityInGraalITCase.testAddDeleteDefaultTenant - More details - Source on GitHub

java.lang.AssertionError: 
1 expectation failed.
Expected status code is <201> but was <500>.

✖ io.quarkus.it.hibernate.multitenancy.fruit.HibernateTenancyFunctionalityInGraalITCase.testGetFruitsDefaultTenant - More details - Source on GitHub

java.lang.AssertionError: 
1 expectation failed.
Expected status code is <200> but was <500>.

✖ io.quarkus.it.hibernate.multitenancy.fruit.HibernateTenancyFunctionalityInGraalITCase.testGetFruitsTenantMycompany - More details - Source on GitHub

java.lang.AssertionError: 
1 expectation failed.
Expected status code is <200> but was <500>.

✖ io.quarkus.it.hibernate.multitenancy.fruit.HibernateTenancyFunctionalityInGraalITCase.testPostFruitDefaultTenant - More details - Source on GitHub

java.lang.AssertionError: 
1 expectation failed.
Expected status code is <201> but was <500>.

✖ io.quarkus.it.hibernate.multitenancy.fruit.HibernateTenancyFunctionalityInGraalITCase.testUpdateFruitDefaultTenant - More details - Source on GitHub

java.lang.AssertionError: 
1 expectation failed.
Expected status code is <201> but was <500>.

[michalvavrik]

Checked CI failures:

integration-tests/hibernate-orm-tenancy/connection-resolver

contains no security and it didn't fail before latest changes

IncludePatternTestCase.checkTestsAreRun

same as above plus works on JDK 17 and I can't see what is wrong from logs, it looks flaky

[sberyozkin]

I believe we can merge, thanks everyone