Skip to content

Use Bindable in @ConfigurationProperties to improve the Generated JSON Schema with default values - #2189

Draft
sdelamo wants to merge 2 commits into
5.1.xfrom
use-bindable
Draft

Use Bindable in @ConfigurationProperties to improve the Generated JSON Schema with default values#2189
sdelamo wants to merge 2 commits into
5.1.xfrom
use-bindable

Conversation

@sdelamo

@sdelamo sdelamo commented May 21, 2026

Copy link
Copy Markdown
Member

No description provided.

Copilot AI review requested due to automatic review settings May 21, 2026 09:24
@sdelamo sdelamo added the type: bug Something isn't working label May 21, 2026
@sdelamo
sdelamo marked this pull request as draft May 21, 2026 09:27
@graemerocher graemerocher moved this from Backlog to In progress in 5.0.1 Release May 21, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR improves Micronaut Security’s generated JSON Schemas for @ConfigurationProperties by annotating setters with @Bindable(defaultValue = ...), and adds tests/utilities to verify that schema defaults are emitted as expected across several modules.

Changes:

  • Added @Bindable(defaultValue = ...) to many configuration-property setters so generated JSON Schemas include default values.
  • Introduced a small test utility to load and assert generated configuration schema JSON, and added new JUnit tests across modules to validate defaults.
  • Updated a few module test/build dependencies and moved the Micronaut platform version to 5.0.0.

Reviewed changes

Copilot reviewed 54 out of 54 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
test-suite-utils/src/main/java/io/micronaut/security/testutils/ConfigurationSchemaUtils.java New helper to load generated configuration schema JSON and assert defaults/metadata.
test-suite-utils/build.gradle Adds dependencies needed by the new schema test utility (JSON + JUnit API).
security/src/test/java/io/micronaut/security/ConfigurationPropertiesSchemaTest.java New tests asserting defaults for multiple Security configuration schemas.
security/src/main/java/io/micronaut/security/authentication/BasicAuthAuthenticationConfiguration.java Adds @Bindable defaults for schema generation on enabled.
security/src/main/java/io/micronaut/security/config/RedirectConfigurationProperties.java Adds @Bindable defaults across redirect config setters for schema defaults.
security/src/main/java/io/micronaut/security/config/SecurityConfigurationProperties.java Adds @Bindable defaults for core security settings to surface defaults in schema.
security/src/main/java/io/micronaut/security/endpoints/ControllerConfigurationProperties.java Adds @Bindable defaults for common endpoint controller properties.
security/src/main/java/io/micronaut/security/endpoints/LoginControllerConfigurationProperties.java Adds @Bindable default for login endpoint path via overridden setter.
security/src/main/java/io/micronaut/security/endpoints/LogoutControllerConfigurationProperties.java Adds @Bindable defaults for logout endpoint settings.
security/src/main/java/io/micronaut/security/endpoints/OauthControllerConfigurationProperties.java Adds @Bindable defaults for oauth endpoint settings.
security/src/main/java/io/micronaut/security/endpoints/introspection/IntrospectionConfigurationProperties.java Adds @Bindable defaults for introspection endpoint settings.
security/src/main/java/io/micronaut/security/filters/SecurityFilterConfigurationProperties.java Adds @Bindable defaults for security filter enabled/path settings.
security/src/main/java/io/micronaut/security/token/bearer/BearerTokenConfigurationProperties.java Adds @Bindable defaults for bearer token header/prefix/enabled.
security/src/main/java/io/micronaut/security/token/config/TokenConfigurationProperties.java Adds @Bindable defaults for token config keys and enabled flag.
security/src/main/java/io/micronaut/security/token/cookie/AbstractAccessTokenCookieConfigurationProperties.java Adds @Bindable defaults for cookie settings used in schema generation.
security/src/main/java/io/micronaut/security/token/cookie/TokenCookieConfigurationProperties.java Adds @Bindable defaults for JWT cookie config values.
security/src/main/java/io/micronaut/security/token/cookie/RefreshTokenCookieConfigurationProperties.java Adds @Bindable defaults for refresh-token cookie config values.
security/src/main/java/io/micronaut/security/token/generator/AccessTokenConfigurationProperties.java Adds @Bindable default for access token expiration.
security/src/main/java/io/micronaut/security/token/propagation/TokenPropagationConfigurationProperties.java Adds @Bindable defaults for token propagation enabled/path.
security/src/main/java/io/micronaut/security/token/propagation/HttpHeaderTokenPropagatorConfigurationProperties.java Adds @Bindable defaults for header propagator enabled/prefix/header-name.
security/src/main/java/io/micronaut/security/x509/X509ConfigurationProperties.java Adds @Bindable defaults for X509 config values (enabled/regex).
security-session/src/test/java/io/micronaut/security/session/SecuritySessionConfigurationPropertiesSchemaTest.java New test asserting schema defaults for session module config.
security-session/src/main/java/io/micronaut/security/session/SecuritySessionConfigurationProperties.java Adds @Bindable default for enabled to surface in schema.
security-session/build.gradle.kts Ensures JUnit 5 dependencies are present for new schema tests.
security-oauth2/src/test/java/io/micronaut/security/oauth2/configuration/OauthConfigurationPropertiesSchemaTest.java New tests asserting schema defaults across OAuth2 configuration types.
security-oauth2/src/main/java/io/micronaut/security/oauth2/configuration/OauthConfigurationProperties.java Adds @Bindable defaults for OAuth2 configuration properties.
security-oauth2/src/main/java/io/micronaut/security/oauth2/configuration/OauthClientConfigurationProperties.java Adds @Bindable defaults for client properties and nested configs.
security-oauth2/src/main/java/io/micronaut/security/oauth2/configuration/endpoints/DefaultSecureEndpointConfiguration.java Adds @Bindable default for authentication-method.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/AbstractCookieConfiguration.java Adds @Bindable defaults for cookie configuration setters.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/authorization/pkce/PkceConfigurationProperties.java Adds @Bindable defaults for PKCE configuration.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/authorization/pkce/persistence/cookie/CookiePkcePersistenceConfiguration.java Adds @Bindable default for cookie name.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/authorization/state/DefaultStateConfiguration.java Adds @Bindable defaults for state persistence/enabled.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/authorization/state/persistence/cookie/CookieStatePersistenceConfiguration.java Adds @Bindable default for cookie name.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/nonce/DefaultNonceConfiguration.java Adds @Bindable defaults for nonce persistence/enabled.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/nonce/persistence/cookie/CookieNoncePersistenceConfiguration.java Adds @Bindable default for cookie name.
security-oauth2/src/main/java/io/micronaut/security/oauth2/metadata/ProtectedResourceMetadataConfigurationProperties.java Adds @Bindable default for enabled.
security-ldap/src/test/java/io/micronaut/security/ldap/configuration/LdapConfigurationSchemaTest.java New tests asserting schema defaults for LDAP configuration types.
security-ldap/src/main/java/io/micronaut/security/ldap/configuration/LdapConfiguration.java Adds @Bindable defaults for LDAP config and nested configs.
security-ldap/build.gradle.kts Ensures JUnit 5 + test-suite-utils are present for new schema tests.
security-jwt/src/test/java/io/micronaut/security/token/jwt/JwtConfigurationPropertiesSchemaTest.java New tests asserting schema defaults for JWT configuration types.
security-jwt/src/main/java/io/micronaut/security/token/jwt/config/JwtConfigurationProperties.java Adds @Bindable defaults for JWT enabled flag.
security-jwt/src/main/java/io/micronaut/security/token/jwt/endpoints/KeysControllerConfigurationProperties.java Adds @Bindable defaults for keys endpoint enabled/path.
security-jwt/src/main/java/io/micronaut/security/token/jwt/encryption/secret/SecretEncryptionConfiguration.java Adds @Bindable default for base64.
security-jwt/src/main/java/io/micronaut/security/token/jwt/generator/RefreshTokenConfigurationProperties.java Adds @Bindable defaults for refresh token config setters.
security-jwt/src/main/java/io/micronaut/security/token/jwt/nimbus/NimbusJsonWebTokenValidatorConfigurationProperties.java Adds @Bindable defaults for validator toggles.
security-jwt/src/main/java/io/micronaut/security/token/jwt/signature/jwks/JwksSignatureConfigurationProperties.java Adds @Bindable defaults for JWKS settings.
security-jwt/src/main/java/io/micronaut/security/token/jwt/signature/secret/SecretSignatureConfiguration.java Adds @Bindable defaults for signature config setters.
security-jwt/src/main/java/io/micronaut/security/token/jwt/validator/JwtClaimsValidatorConfigurationProperties.java Adds @Bindable defaults for claim validation flags.
security-csrf/src/test/java/io/micronaut/security/csrf/CsrfConfigurationPropertiesSchemaTest.java New tests asserting schema defaults/metadata for CSRF configuration.
security-csrf/src/main/java/io/micronaut/security/csrf/CsrfConfigurationProperties.java Adds @Bindable defaults to CSRF config setters to improve schema default output.
security-csrf/src/main/java/io/micronaut/security/csrf/filter/CsrfFilterConfigurationProperties.java Adds @Bindable defaults for filter configuration.
security-csrf/build.gradle.kts Adds test-suite-utils dependency used by new schema tests.
gradle/libs.versions.toml Updates Micronaut platform version to 5.0.0.
.agents/skills/coding/SKILL.md Documents guardrail to avoid wildcard imports.
Comments suppressed due to low confidence (1)

security-csrf/src/main/java/io/micronaut/security/csrf/CsrfConfigurationProperties.java:287

  • @Bindable(defaultValue = "" + AccessTokenConfigurationProperties.DEFAULT_EXPIRATION) is applied to a Duration setter, but the default string omits units even though the Javadoc describes seconds and other tests/config use unit-suffixed values (e.g. 5s). Prefer an explicit duration default (e.g. 3600s/PT3600S) to avoid ambiguity and keep the default format consistent.
    /**
     * Sets the maximum age of the cookie. Default value ({@value AccessTokenConfigurationProperties#DEFAULT_EXPIRATION} seconds).
     *
     * @param cookieMaxAge The maximum age of the cookie
     */
    @Bindable(defaultValue = "" + AccessTokenConfigurationProperties.DEFAULT_EXPIRATION)
    public void setCookieMaxAge(Duration cookieMaxAge) {
        this.cookieMaxAge = cookieMaxAge;
    }

Comment on lines 67 to 71
@Override
@Bindable(defaultValue = "" + DEFAULT_ENABLED)
public void setEnabled(boolean enabled) {
super.setEnabled(true);
}
*
* @param cookieMaxAge The maximum age of the cookie
*/
@Bindable(defaultValue = "300")
* @param advancedExpiration Number of seconds for a token obtained via client credentials grant to be considered expired
* prior to its expiration date. Default value (30 seconds).
*/
@Bindable(defaultValue = "30")
Comment on lines 215 to 223
/**
* Sets whether the cookie is secured. Defaults to the secure status of the request.
*
* @param cookieSecure True if the cookie is secure
*/
@Bindable(defaultValue = "" + true)
public void setCookieSecure(Boolean cookieSecure) {
this.cookieSecure = cookieSecure;
}
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
3.1% Duplication on New Code (required ≤ 3%)
1 New Critical Issues (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type: bug Something isn't working

Projects

Status: Backlog

Development

Successfully merging this pull request may close these issues.

3 participants