Quarkus Cache Key Generator Not Instantiable
ID |
java.quarkus_cache_key_generator_instantiable |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
quarkus, reliability |
Description
Reports a class implementing Quarkus’s CacheKeyGenerator interface that the caching subsystem has no way to instantiate: it declares at least one constructor, none of them a public no-arg one, and carries no CDI scope annotation. CacheKeyGenerator is matched by simple name; an unrelated interface sharing that name is an accepted, rare false positive.
Rationale
Quarkus instantiates a custom CacheKeyGenerator in one of two ways: through the CDI container, if the class is a managed bean (@ApplicationScoped, @Singleton, @RequestScoped, @SessionScoped or @Dependent), or through reflection, by calling a public no-arg constructor. A class that only offers a constructor taking dependencies, and no scope annotation, satisfies neither path — the framework cannot create it, and the failure only shows up when a cache operation actually calls the generator, not at build time.
class TenantAwareKeyGen implements CacheKeyGenerator {
private final TenantResolver tenantResolver;
TenantAwareKeyGen(TenantResolver tenantResolver) { // the framework cannot call this
this.tenantResolver = tenantResolver;
}
}Remediation
Turn the class into a CDI bean by adding a scope annotation, which lets dependencies keep being injected through the constructor while Quarkus manages the instance.
@ApplicationScoped
class TenantAwareKeyGen implements CacheKeyGenerator {
private final TenantResolver tenantResolver;
TenantAwareKeyGen(TenantResolver tenantResolver) {
this.tenantResolver = tenantResolver;
}
}