From 25432f05ca09aa4bd7ab393bd656ebf5b4eeb85b Mon Sep 17 00:00:00 2001
From: Michael Edgar <michael@xlate.io>
Date: Wed, 26 Nov 2025 07:34:15 -0500
Subject: [PATCH] OpenAPI: skip adding method references to model without
 OperationFilter

Signed-off-by: Michael Edgar <michael@xlate.io>
---
 .../deployment/SmallRyeOpenApiProcessor.java  | 21 ++++++-
 .../DisabledOperationFilterTestCase.java      | 56 +++++++++++++++++++
 2 files changed, 75 insertions(+), 2 deletions(-)
 create mode 100644 extensions/smallrye-openapi/deployment/src/test/java/io/quarkus/smallrye/openapi/test/jaxrs/DisabledOperationFilterTestCase.java

diff --git a/extensions/smallrye-openapi/deployment/src/main/java/io/quarkus/smallrye/openapi/deployment/SmallRyeOpenApiProcessor.java b/extensions/smallrye-openapi/deployment/src/main/java/io/quarkus/smallrye/openapi/deployment/SmallRyeOpenApiProcessor.java
index bb67e5e6aa477..5423fa6e52d45 100644
--- a/extensions/smallrye-openapi/deployment/src/main/java/io/quarkus/smallrye/openapi/deployment/SmallRyeOpenApiProcessor.java
+++ b/extensions/smallrye-openapi/deployment/src/main/java/io/quarkus/smallrye/openapi/deployment/SmallRyeOpenApiProcessor.java
@@ -121,6 +121,7 @@
 import io.quarkus.vertx.http.runtime.security.SecurityHandlerPriorities;
 import io.smallrye.openapi.api.OpenApiConfig;
 import io.smallrye.openapi.api.OpenApiDocument;
+import io.smallrye.openapi.api.OperationHandler;
 import io.smallrye.openapi.api.SmallRyeOpenAPI;
 import io.smallrye.openapi.api.constants.SecurityConstants;
 import io.smallrye.openapi.api.util.MergeUtil;
@@ -881,7 +882,13 @@ private void registerReflectionForApiResponseSchemaSerialization(BuildProducer<R
         }
     }
 
-    private void handleOperation(Operation operation, ClassInfo classInfo, MethodInfo method) {
+    /**
+     * Callback invoked by the smallrye-open-api annotation scanner for each discovered API
+     * operation. We use this to set a (private) extension in the OpenAPI model which is then
+     * used by the {@link OperationFilter} to match operations with the security and
+     * tag information discovered earlier in the build by this class.
+     */
+    private void addMethodReferenceExtension(Operation operation, ClassInfo classInfo, MethodInfo method) {
         String methodRef = createUniqueMethodReference(classInfo, method);
         operation.addExtension(OperationFilter.EXT_METHOD_REF, methodRef);
     }
@@ -906,6 +913,16 @@ public void build(BuildProducer<GeneratedResourceBuildItem> resourceBuildItemBui
                 .map(IgnoreStaticDocumentBuildItem::getUrlIgnorePattern)
                 .toList();
 
+        /*
+         * Only add method references if the OperationFilter is enabled. Otherwise,
+         * they are not needed.
+         */
+        OperationHandler operationHandler = openAPIBuildItems.stream()
+                .map(AddToOpenAPIDefinitionBuildItem::getOASFilter)
+                .anyMatch(OperationFilter.class::isInstance)
+                        ? this::addMethodReferenceExtension
+                        : OperationHandler.DEFAULT;
+
         SmallRyeOpenAPI.Builder builder = SmallRyeOpenAPI.builder()
                 .withConfig(config)
                 .withIndex(index)
@@ -926,7 +943,7 @@ public void build(BuildProducer<GeneratedResourceBuildItem> resourceBuildItemBui
                 .withScannerFilter(getScannerFilter(capabilities, index))
                 .withContextRootResolver(getContextRootResolver(config, capabilities, httpRootPathBuildItem))
                 .withTypeConverter(getTypeConverter(index, capabilities))
-                .withOperationHandler(this::handleOperation)
+                .withOperationHandler(operationHandler)
                 .enableUnannotatedPathParameters(capabilities.isPresent(Capability.RESTEASY_REACTIVE))
                 .enableStandardFilter(false)
                 .withFilters(openAPIBuildItems.stream()
diff --git a/extensions/smallrye-openapi/deployment/src/test/java/io/quarkus/smallrye/openapi/test/jaxrs/DisabledOperationFilterTestCase.java b/extensions/smallrye-openapi/deployment/src/test/java/io/quarkus/smallrye/openapi/test/jaxrs/DisabledOperationFilterTestCase.java
new file mode 100644
index 0000000000000..4bd3ee150057d
--- /dev/null
+++ b/extensions/smallrye-openapi/deployment/src/test/java/io/quarkus/smallrye/openapi/test/jaxrs/DisabledOperationFilterTestCase.java
@@ -0,0 +1,56 @@
+package io.quarkus.smallrye.openapi.test.jaxrs;
+
+import static org.hamcrest.Matchers.hasKey;
+import static org.hamcrest.Matchers.not;
+
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+
+import org.jboss.shrinkwrap.api.asset.StringAsset;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import io.quarkus.smallrye.openapi.deployment.filter.OperationFilter;
+import io.quarkus.test.QuarkusUnitTest;
+import io.restassured.RestAssured;
+
+/**
+ * Verify that method reference extensions are not added to the OpenAPI model when the
+ * {@link OperationFilter} is not in use (disabled via several configuration properties).
+ */
+class DisabledOperationFilterTestCase {
+    @RegisterExtension
+    static QuarkusUnitTest runner = new QuarkusUnitTest()
+            .withApplicationRoot(jar -> jar
+                    .addClasses(Endpoint.class)
+                    .add(new StringAsset("""
+                            quarkus.smallrye-openapi.auto-add-operation-summary=false
+                            quarkus.smallrye-openapi.auto-add-tags=false
+                            quarkus.smallrye-openapi.auto-add-security-requirement=false
+                            """), "application.properties"));
+
+    @Path("/api")
+    public static class Endpoint {
+        @Path("/op1")
+        @GET
+        public String op1() {
+            return null;
+        }
+
+        @Path("/op2")
+        @GET
+        public String op2() {
+            return null;
+        }
+    }
+
+    @Test
+    void testMethodRefExtensionsAbsent() {
+        RestAssured.given().header("Accept", "application/json")
+                .when().get("/q/openapi")
+                .then()
+                .log().ifValidationFails()
+                .body("paths.\"/api/op1\".get", not(hasKey(OperationFilter.EXT_METHOD_REF)))
+                .body("paths.\"/api/op2\".get", not(hasKey(OperationFilter.EXT_METHOD_REF)));
+    }
+}