@IfBuildProfile/@UnlessBuildProfile bean selection is fixed at Maven build time and baked into the artifact — Quarkus's own CDI reference states runtime profile has no effect on @IfBuildProfile bean resolution. calm-hub's CI builds one artifact with no -Dquarkus.profile flag (mvn -P integration clean package, .github/workflows/docker-publish-calm-hub.yml), and calm-hub/deploy/docker-compose.yml documents selecting the auth profile at container runtime instead — "For a production deployment select an appropriate auth profile (secure, proxy-auth)" via -Dquarkus.profile=... in JAVA_OPTS.
Under that documented deployment path, a bean gated @IfBuildProfile(anyOf = {"secure", "proxy-auth"}) — or any other specific profile list — never activates for any runtime-selected profile, because the artifact was built under the default profile regardless of which profile is chosen at launch.
org.finos.calm.security.UserAccessValidator was exactly this case until #3065 (fixed there by removing the annotation): its absence under the documented deployment model silently made SearchResource, DomainResource, NamespaceResource, and the MCP SearchTools.searchHub fall through to "no filtering, see everything" for every namespace/domain, regardless of the caller's actual grants — in every profile that relied on it, not only the oidc profile added in that PR.
Fix
- Audit every
@IfBuildProfile/@UnlessBuildProfile usage in calm-hub (grep -rn "@IfBuildProfile\|@UnlessBuildProfile" calm-hub/src/main/java) for the same trap.
- For each: confirm the affected deployment actually builds a per-profile artifact (and document that build/release process — it does not currently exist for calm-hub); or replace the annotation with a runtime-evaluated equivalent —
@LookupIfProperty for Instance<T>-mediated lookup (already used correctly for the GitHub-backend beans in store/github/util), or an unconditional bean plus an explicit runtime config check, matching the fix applied to UserAccessValidator.
Out of scope
- Re-architecting calm-hub's build/release pipeline to produce per-profile artifacts (an alternative fix, not adopted here).
@IfBuildProfile/@UnlessBuildProfilebean selection is fixed at Maven build time and baked into the artifact — Quarkus's own CDI reference states runtime profile has no effect on@IfBuildProfilebean resolution.calm-hub's CI builds one artifact with no-Dquarkus.profileflag (mvn -P integration clean package,.github/workflows/docker-publish-calm-hub.yml), andcalm-hub/deploy/docker-compose.ymldocuments selecting the auth profile at container runtime instead — "For a production deployment select an appropriate auth profile (secure, proxy-auth)" via-Dquarkus.profile=...inJAVA_OPTS.Under that documented deployment path, a bean gated
@IfBuildProfile(anyOf = {"secure", "proxy-auth"})— or any other specific profile list — never activates for any runtime-selected profile, because the artifact was built under the default profile regardless of which profile is chosen at launch.org.finos.calm.security.UserAccessValidatorwas exactly this case until #3065 (fixed there by removing the annotation): its absence under the documented deployment model silently madeSearchResource,DomainResource,NamespaceResource, and the MCPSearchTools.searchHubfall through to "no filtering, see everything" for every namespace/domain, regardless of the caller's actual grants — in every profile that relied on it, not only theoidcprofile added in that PR.Fix
@IfBuildProfile/@UnlessBuildProfileusage incalm-hub(grep -rn "@IfBuildProfile\|@UnlessBuildProfile" calm-hub/src/main/java) for the same trap.@LookupIfPropertyforInstance<T>-mediated lookup (already used correctly for the GitHub-backend beans instore/github/util), or an unconditional bean plus an explicit runtime config check, matching the fix applied toUserAccessValidator.Out of scope