FusionAuth/fusionauth-jwt

Wrong module descriptor

XakepSDK opened this issue · 10 comments

XakepSDK commented

Jackson can't deserialize some classes because module doesn't open packages to jackson databind module.

io.fusionauth.jwks.JSONWebKeySetHelper$JSONWebKeySetResponse
Jackson can't access this class.

add-opens fixes this error. Should i make PR?

robotdan commented

Thanks for the report. Yes, feel free to submit a PR or I can take a look shortly.

robotdan commented

Looking at this further, I have some tests that utilize this code path, can you provide some recreate steps to see this error?

XakepSDK commented

This means tests are not running with enabled module system. I get this error when module system is enabled, otherwise there is no error.

robotdan commented

Thanks @XakepSDK - happy to look into this and fix it. Can you please some specific recreate steps?

XakepSDK commented

I made a simple reproducer, https://github.com/XakepSDK/fusionauth-testcase
How to use it:

  1. Clone
  2. Go to app dir
  3. Run run.sh, minimum java 9 required, if you are on windows, just run 2nd line from run.sh in cmd
  4. Get an error

Harder path:

  1. Install Intellij IDEA 2021.1.x. 2021.2.x has broken module handling. I have no idea about other IDEs
  2. Open project
  3. Launch Test class

Caveats:

  1. If you use gradle, then IDEA will use gradle to launch an app, looks like gradle 7 does not handle module launching at all and starts apps with classpath
  2. IDEA 2021.2 has broken module handling, it might work for this simple project, but in other project it didn't work

How to fix:

  1. Get rid of JSONWebKeySetResponse
  2. Or add opens io.fusionauth.jwks to com.fasterxml.jackson.databind
  3. Or make JSONWebKeySetResponse public with public constructor
robotdan commented

Thanks @XakepSDK - this is great, I'll take a look.

robotdan commented

For simplicity, I just changed JSONWebKeySetResponse to be public.

robotdan commented

Fix is available in version 4.3.1. I tested version 4.3.1 in your test project to confirm.

Thanks for the assist @XakepSDK !

XakepSDK commented

You can also fix this by adding opens <package> to <jackson.databind.module> in a module descriptor

robotdan commented

You can also fix this by adding opens to <jackson.databind.module> in a module descriptor

Yes, I did try that, and it does work.

However the class really doesn't need to be private, so that seemed like the more correct fix from my perspective.

I suppose I could also just use a TypeLiteral with Jackson indicate how I want to de-serialize the response, then I could just delete the class. Perhaps I'll revisit how I am marshaling this object at some point.

If you run into any other issues with the library, please do open another GH issue. Thanks for the help!