Security roles checked after constraints validation with quarkus-resteasy-reactive

Describe the bug

I noticed something weird while migrating a project from quarkus-resteasy to quarkus-resteasy-reactive:

• with quarkus-resteasy, security roles are checked before constraints validation when the request content type is JSON
• with quarkus-resteasy-reactive, security roles are checked after constraints validation when the request content type is JSON

There’s no difference between the two extensions when the content type is text.

Expected behavior

I would expect the same behavior with both versions of quarkus-resteasy*.

Actual behavior

Different behavior.

To Reproduce

https://github.com/gwenneg/quarkus-resteasy-reactive-security

It contains two folders with the exact same code with one exception: the quarkus-resteasy* dependency.

Steps to reproduce the behavior:

1. cd quarkus-resteasy
2. ./mvnw clean test > BUILD SUCCESS
3. cd quarkus-resteasy-reactive
4. ./mvnw clean test > BUILD FAILURE

Environment (please complete the following information):

Output of java -version

openjdk version "11.0.9.1" 2020-11-04
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.9.1+1)
OpenJDK 64-Bit Server VM AdoptOpenJDK (build 11.0.9.1+1, mixed mode)

Quarkus version or git rev

1.13.3.Final

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)

[geoand]

I wonder if it makes sense to this sort of thing with other kinds of interceptors as well - like Caching for example

[sberyozkin]

Hey @geoand Enjoy the long weekend, I thought it was a JAX-RS filter but it is a CDI interceptor