Allow adding and removing extensions from Dev UI

extensions/smallrye-health/deployment/pom.xml

@@ -66,6 +66,16 @@
             <artifactId>quarkus-smallrye-openapi-deployment</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-security-test-utils</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-web-client</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

extensions/smallrye-health/deployment/src/test/java/io/quarkus/smallrye/health/test/PathHandler.java

@@ -0,0 +1,29 @@
+package io.quarkus.smallrye.health.test;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+
+import io.quarkus.vertx.http.runtime.security.QuarkusHttpUser;
+import io.vertx.core.Handler;
+import io.vertx.ext.web.Router;
+import io.vertx.ext.web.RoutingContext;
+
+@ApplicationScoped
+public class PathHandler {
+
+    public void setup(@Observes Router router) {
+        router.route().handler(new Handler<RoutingContext>() {
+            @Override
+            public void handle(RoutingContext event) {
+                QuarkusHttpUser user = (QuarkusHttpUser) event.user();
+                StringBuilder ret = new StringBuilder();
+                if (user != null) {
+                    ret.append(user.getSecurityIdentity().getPrincipal().getName());
+                }
+                ret.append(":");
+                ret.append(event.normalizedPath());
+                event.response().end(ret.toString());
+            }
+        });
+    }
+}

extensions/smallrye-health/deployment/src/test/java/io/quarkus/smallrye/health/test/PathMatchingHttpSecurityPolicyTest.java

@@ -0,0 +1,101 @@
+package io.quarkus.smallrye.health.test;
+
+import static org.awaitility.Awaitility.await;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.net.URL;
+import java.time.Duration;
+
+import jakarta.inject.Inject;
+
+import org.jboss.shrinkwrap.api.asset.StringAsset;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import io.quarkus.security.test.utils.TestIdentityController;
+import io.quarkus.security.test.utils.TestIdentityProvider;
+import io.quarkus.test.QuarkusUnitTest;
+import io.quarkus.test.common.http.TestHTTPResource;
+import io.vertx.core.Vertx;
+import io.vertx.ext.web.client.WebClient;
+
+public class PathMatchingHttpSecurityPolicyTest {
+
+    private static final Duration REQUEST_TIMEOUT = Duration.ofSeconds(20);
+    private static final String APP_PROPS = """
+            quarkus.http.auth.permission.management.paths=/q/*
+            quarkus.http.auth.permission.management.policy=authenticated
+            """;
+    private static WebClient client;
+
+    @RegisterExtension
+    static QuarkusUnitTest runner = new QuarkusUnitTest()
+            .withApplicationRoot((jar) -> jar
+                    .addClasses(TestIdentityController.class, TestIdentityProvider.class, PathHandler.class)
+                    .addAsResource(new StringAsset(APP_PROPS), "application.properties"));
+
+    @BeforeAll
+    public static void setup() {
+        TestIdentityController.resetRoles()
+                .add("test", "test", "test");
+    }
+
+    @AfterAll
+    public static void cleanup() {
+        if (client != null) {
+            client.close();
+        }
+    }
+
+    @Inject
+    Vertx vertx;
+
+    @TestHTTPResource
+    URL url;
+
+    private WebClient getClient() {
+        if (client == null) {
+            client = WebClient.create(vertx);
+        }
+        return client;
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "/q/health", "/q/health/live", "/q/health/ready", "//q/health", "///q/health", "///q///health",
+            "/q/health/", "/q///health/", "/q///health////live"
+    })
+    public void testHealthCheckPaths(String path) {
+        assurePath(path, 401);
+        assurePathAuthenticated(path, "UP");
+    }
+
+    private void assurePath(String path, int expectedStatusCode) {
+        assurePath(path, expectedStatusCode, null, null, null);
+    }
+
+    private void assurePathAuthenticated(String path, String body) {
+        assurePath(path, 200, body, "test", null);
+    }
+
+    private void assurePath(String path, int expectedStatusCode, String body, String auth, String header) {
+        var req = getClient().get(url.getPort(), url.getHost(), path);
+        if (auth != null) {
+            req.basicAuthentication(auth, auth);
+        }
+        if (header != null) {
+            req.putHeader(header, header);
+        }
+        var result = req.send();
+        await().atMost(REQUEST_TIMEOUT).until(result::isComplete);
+        assertEquals(expectedStatusCode, result.result().statusCode(), path);
+
+        if (body != null) {
+            Assertions.assertTrue(result.result().bodyAsString().contains(body), path);
+        }
+    }
+}

extensions/smallrye-openapi/deployment/pom.xml

@@ -77,6 +77,16 @@
             <artifactId>quarkus-reactive-routes-deployment</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-security-test-utils</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-web-client</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-junit5-internal</artifactId>

extensions/smallrye-openapi/deployment/src/test/java/io/quarkus/smallrye/openapi/test/jaxrs/PathHandler.java

@@ -0,0 +1,29 @@
+package io.quarkus.smallrye.openapi.test.jaxrs;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+
+import io.quarkus.vertx.http.runtime.security.QuarkusHttpUser;
+import io.vertx.core.Handler;
+import io.vertx.ext.web.Router;
+import io.vertx.ext.web.RoutingContext;
+
+@ApplicationScoped
+public class PathHandler {
+
+    public void setup(@Observes Router router) {
+        router.route().handler(new Handler<RoutingContext>() {
+            @Override
+            public void handle(RoutingContext event) {
+                QuarkusHttpUser user = (QuarkusHttpUser) event.user();
+                StringBuilder ret = new StringBuilder();
+                if (user != null) {
+                    ret.append(user.getSecurityIdentity().getPrincipal().getName());
+                }
+                ret.append(":");
+                ret.append(event.normalizedPath());
+                event.response().end(ret.toString());
+            }
+        });
+    }
+}

extensions/smallrye-openapi/deployment/src/test/java/io/quarkus/smallrye/openapi/test/jaxrs/PathMatchingHttpSecurityPolicyTest.java

@@ -0,0 +1,100 @@
+package io.quarkus.smallrye.openapi.test.jaxrs;
+
+import static org.awaitility.Awaitility.await;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.net.URL;
+import java.time.Duration;
+
+import jakarta.inject.Inject;
+
+import org.jboss.shrinkwrap.api.asset.StringAsset;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import io.quarkus.security.test.utils.TestIdentityController;
+import io.quarkus.security.test.utils.TestIdentityProvider;
+import io.quarkus.test.QuarkusUnitTest;
+import io.quarkus.test.common.http.TestHTTPResource;
+import io.vertx.core.Vertx;
+import io.vertx.ext.web.client.WebClient;
+
+public class PathMatchingHttpSecurityPolicyTest {
+
+    private static final Duration REQUEST_TIMEOUT = Duration.ofSeconds(20);
+    private static final String APP_PROPS = """
+            quarkus.http.auth.permission.management.paths=/q/*
+            quarkus.http.auth.permission.management.policy=authenticated
+            """;
+    private static WebClient client;
+
+    @RegisterExtension
+    static QuarkusUnitTest runner = new QuarkusUnitTest()
+            .withApplicationRoot((jar) -> jar
+                    .addClasses(TestIdentityController.class, TestIdentityProvider.class, PathHandler.class)
+                    .addAsResource(new StringAsset(APP_PROPS), "application.properties"));
+
+    @BeforeAll
+    public static void setup() {
+        TestIdentityController.resetRoles()
+                .add("test", "test", "test");
+    }
+
+    @AfterAll
+    public static void cleanup() {
+        if (client != null) {
+            client.close();
+        }
+    }
+
+    @Inject
+    Vertx vertx;
+
+    @TestHTTPResource
+    URL url;
+
+    private WebClient getClient() {
+        if (client == null) {
+            client = WebClient.create(vertx);
+        }
+        return client;
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "/q/openapi", "///q/openapi", "/q///openapi", "/q/openapi/", "/q/openapi///"
+    })
+    public void testOpenApiPath(String path) {
+        assurePath(path, 401);
+        assurePathAuthenticated(path, "openapi");
+    }
+
+    private void assurePath(String path, int expectedStatusCode) {
+        assurePath(path, expectedStatusCode, null, null, null);
+    }
+
+    private void assurePathAuthenticated(String path, String body) {
+        assurePath(path, 200, body, "test", null);
+    }
+
+    private void assurePath(String path, int expectedStatusCode, String body, String auth, String header) {
+        var req = getClient().get(url.getPort(), url.getHost(), path);
+        if (auth != null) {
+            req.basicAuthentication(auth, auth);
+        }
+        if (header != null) {
+            req.putHeader(header, header);
+        }
+        var result = req.send();
+        await().atMost(REQUEST_TIMEOUT).until(result::isComplete);
+        assertEquals(expectedStatusCode, result.result().statusCode(), path);
+
+        if (body != null) {
+            Assertions.assertTrue(result.result().bodyAsString().contains(body), path);
+        }
+    }
+}

extensions/vertx-http/deployment/pom.xml

@@ -76,7 +76,17 @@
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jdk8</artifactId>
         </dependency>
-
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-devtools-common</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.maven.resolver</groupId>
+                    <artifactId>maven-resolver-connector-basic</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+
         <!-- Test dependencies -->
         <dependency>
             <groupId>io.quarkus</groupId>