From 3272df2f1558543203f5c4ad85194da35e4b657d Mon Sep 17 00:00:00 2001
From: Maxim Muzafarov <mmuzaf@apache.org>
Date: Mon, 27 Jul 2026 17:19:33 +0200
Subject: [PATCH] fix npe when auth cache is not registered

---
 .../org/apache/cassandra/auth/jmx/AuthorizationProxy.java | 3 +++
 src/java/org/apache/cassandra/tools/NodeProbe.java        | 3 +++
 .../management/InternalNodeMBeanAccessorTest.java         | 8 ++++++++
 3 files changed, 14 insertions(+)

diff --git a/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java b/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java
index 9d28e1a84d..7bfe922b3f 100644
--- a/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java
+++ b/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java
@@ -46,6 +46,7 @@ import org.slf4j.LoggerFactory;
 import org.apache.cassandra.audit.AuditLogManager;
 import org.apache.cassandra.auth.AuthCache;
 import org.apache.cassandra.auth.AuthCacheMBean;
+import org.apache.cassandra.auth.AuthCacheService;
 import org.apache.cassandra.auth.AuthenticatedUser;
 import org.apache.cassandra.auth.JMXResource;
 import org.apache.cassandra.auth.Permission;
@@ -596,6 +597,8 @@ public class AuthorizationProxy implements InvocationHandler
                   () -> true);
 
             MBeanWrapper.instance.registerMBean(this, MBEAN_NAME_BASE + DEPRECATED_CACHE_NAME);
+            // Registration makes this cache discovearble by the management transport MBean accessor
+            AuthCacheService.instance.register(this);
         }
 
         public void invalidatePermissions(String roleName)
diff --git a/src/java/org/apache/cassandra/tools/NodeProbe.java b/src/java/org/apache/cassandra/tools/NodeProbe.java
index d649637eac..1f18dd1dd2 100644
--- a/src/java/org/apache/cassandra/tools/NodeProbe.java
+++ b/src/java/org/apache/cassandra/tools/NodeProbe.java
@@ -2535,6 +2535,9 @@ public class NodeProbe implements AutoCloseable
                 }
             }
 
+            if (delegate == null)
+                throw new RuntimeException(new InstanceNotFoundException(mbeanClass.getSimpleName() + " is not available on this node"));
+
             try
             {
                 return method.invoke(delegate, args);
diff --git a/test/unit/org/apache/cassandra/management/InternalNodeMBeanAccessorTest.java b/test/unit/org/apache/cassandra/management/InternalNodeMBeanAccessorTest.java
index 6f65712d95..80c95a09dd 100644
--- a/test/unit/org/apache/cassandra/management/InternalNodeMBeanAccessorTest.java
+++ b/test/unit/org/apache/cassandra/management/InternalNodeMBeanAccessorTest.java
@@ -20,6 +20,7 @@ package org.apache.cassandra.management;
 
 import org.junit.Test;
 
+import org.apache.cassandra.auth.jmx.AuthorizationProxy;
 import org.apache.cassandra.cql3.CQLTester;
 import org.apache.cassandra.db.ColumnFamilyStoreMBean;
 
@@ -69,6 +70,13 @@ public class InternalNodeMBeanAccessorTest extends CQLTester
         .noneSatisfy(e -> assertThat(e.getValue().getTableName()).isEqualTo(indexStoreName));
     }
 
+    @Test
+    public void testFindMBeanResolvesJmxPermissionsCache()
+    {
+        AuthorizationProxy.JmxPermissionsCache expected = AuthorizationProxy.jmxPermissionsCache;
+        assertThat(accessor.findMBean(AuthorizationProxy.JmxPermissionsCacheMBean.class)).isSameAs(expected);
+    }
+
     @Test
     public void testFindCompressionDictionaryContract()
     {