Add path role inheritance by AoElite · Pull Request #2553 · javalin/javalin

AoElite · 2026-03-08T22:37:07Z

This pull request enhances the ApiBuilder in Javalin to support defining default route roles for endpoint groups. The main improvement is the ability to specify roles at the group (path) level, which are then automatically applied to all endpoints defined within that group, unless overridden. This change streamlines role management for grouped routes and reduces repetitive code.

Endpoint group role management:

Added a new overload for the path method that accepts a RouteRole... roles parameter, allowing default roles to be set for all endpoints within a group. Internally, a new routeRoleDeque is used to manage role context for nested groups. [1] [2]

Automatic role propagation to handlers:

Updated all HTTP verb methods (get, post, put, patch, delete, head, query), so that if roles are not explicitly provided, the roles in the current group context are automatically applied. This is achieved by calling a new routeRolesInScope() helper.

These changes make it easier and less error-prone to manage security roles for grouped endpoints in Javalin applications.

…ilder`.

codecov · 2026-03-08T22:48:08Z

Codecov Report

❌ Patch coverage is 74.35897% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.29%. Comparing base (edfb887) to head (81f9e78).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
...rc/main/java/io/javalin/apibuilder/ApiBuilder.java	74.35%	9 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2553      +/-   ##
============================================
- Coverage     86.39%   86.29%   -0.10%     
- Complexity     1525     1535      +10     
============================================
  Files           156      156              
  Lines          4409     4445      +36     
  Branches        537      542       +5     
============================================
+ Hits           3809     3836      +27     
- Misses          366      374       +8     
- Partials        234      235       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

AoElite · 2026-03-08T23:07:30Z

I'm not sure what Codecov is complaining about—the changes look fine to me.

Anyway, here's a usage example of the PR changes. You can still do the following:

path("/admin", () -> {
    get("/branches", adminRouter::listBranches, Role.ADMIN);
    get("/branches/{branch}", adminRouter::getBranch, Role.ADMIN);
    patch("/branches/{branch}", adminRouter::updateBranch, Role.ADMIN);
    post("/branches/{branch}/upload/{type}", adminRouter::uploadLoader, Role.ADMIN);
});

However, you can now optionally do this instead, allowing roles to be inherited from the path if any are specified:

path("/admin", () -> {
    get("/branches", adminRouter::listBranches);
    get("/branches/{branch}", adminRouter::getBranch);
    patch("/branches/{branch}", adminRouter::updateBranch);
    post("/branches/{branch}/upload/{type}", adminRouter::uploadLoader);
}, Role.ADMIN);

Makes working with roles much cleaner.

tipsy · 2026-03-12T18:27:55Z

augment review

augmentcode · 2026-03-12T18:32:06Z

🤖 Augment PR Summary

Summary: This PR adds role inheritance to Javalin’s static ApiBuilder so grouped routes can define default roles once and have them applied automatically.

Changes:

Introduces a new path(String, EndpointGroup, RouteRole...) overload to define roles at the path-group level.
Adds a ThreadLocal routeRoleDeque to track active role scopes across nested path(...) groups.
Updates all HTTP verb helpers (get, post, put, patch, delete, head, query) to apply roles from the current scope when roles aren’t explicitly provided.
Extends the same role propagation behavior to WebSockets (ws) and SSE (sse) registrations.
Updates crud(...) registration so generated endpoints inherit the current role scope in addition to any roles passed to crud.
Adds routeRolesInScope(...) helper to merge scoped roles with endpoint-specified roles.
Adds a new unit test (TestApiBuilderRouteRoles) verifying inheritance and nested group composition.

Technical Notes: Path/role scope state is managed via ThreadLocal deques and is unwound using try/finally to ensure cleanup even on exceptions.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-03-12T18:32:07Z

+     * the given roles to all endpoints in the group by default.
+     * All paths are normalized, so you can call both
+     * path("/path") or path("path") depending on your preference
+     */


The group-level roles are merged with any endpoint-provided roles via routeRolesInScope(...), so endpoints can add roles but can’t replace/remove inherited ones. Consider clarifying this merge/inheritance behavior in the Javadoc here to avoid confusion around “override” semantics.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-03-12T18:32:07Z

+    }
+
+    private static RouteRole[] routeRolesInScope(@NotNull RouteRole... roles) {
+        if (routeRoleDeque.get().isEmpty()) {


It looks like the routeRoleDeque.get().isEmpty() early-return path in routeRolesInScope(...) may be uncovered (matching the Codecov note). Consider adding a small apiBuilder test that registers a route without any surrounding path(..., roles) and asserts the resulting role set is unchanged/empty as expected.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

tipsy · 2026-03-13T08:43:58Z

@AoElite wouldn't passing the role before the route groups read nicer?

path("/api", Role.AUTHENTICATED) {
    path("/admin", Role.ADMIN) {
        ...
    }
}

path("/api", {
    path("/admin", {
        ...
    }, Role.ADMIN)
}, Role.AUTHENTICATED)

…date `TestApiBuilderRouteRoles` to include role collections in tests.

AoElite · 2026-03-20T03:17:32Z

@tipsy I've made changes to align more on what you wanted. You now specify the roles before the endpoint with a collection.

tipsy · 2026-03-22T15:41:51Z

Thanks @AoElite !

The current approach modifies every HTTP verb method in ApiBuilder to call routeRolesInScope(), which is ~40 methods touched for a single concern. Since all verb methods funnel through staticInstance(), we could instead intercept at addEndpoint with a thin decorator around JavalinDefaultRoutingApi. Have staticInstance() return the decorator when roles are in scope, and it merges scoped roles into the Roles metadata via endpoint.withMetadata(new Roles(merged)).

Also: the PR description says endpoints can "override" inherited roles, but it seems the implementation only accumulates — an endpoint inside a scoped path always gets the parent roles plus its own. The original path() method is missing try/finally cleanup for the deque, which this PR could fix while it's in there?

…rage for role clearing and merging logic.

tipsy · 2026-03-23T18:49:58Z

Looks good @AoElite, thanks !

Bumps `javalin.version` from 7.1.0 to 7.2.0. Updates `io.javalin:javalin-bundle` from 7.1.0 to 7.2.0 Release notes *Sourced from [io.javalin:javalin-bundle's releases](https://github.com/javalin/javalin/releases).* > 7.2.0 > ----- > > What's Changed > -------------- > > * [performance] Replace Stream API with List and reduce per-request allocations by [`@tipsy`](https://github.com/tipsy) in [javalin/javalin#2567](https://redirect.github.com/javalin/javalin/pull/2567) > * feat: introduce `JavalinJackson3` as an optional `JsonMapper` implementation for Jackson 3 by [`@yvasyliev`](https://github.com/yvasyliev) in [javalin/javalin#2548](https://redirect.github.com/javalin/javalin/pull/2548) > * [workflow]: Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the dependencies group by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2569](https://redirect.github.com/javalin/javalin/pull/2569) > * Add path role inheritance by [`@AoElite`](https://github.com/AoElite) in [javalin/javalin#2553](https://redirect.github.com/javalin/javalin/pull/2553) > * [deps]: Bump the dependencies group across 1 directory with 23 updates by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2575](https://redirect.github.com/javalin/javalin/pull/2575) > * [workflow]: Bump codecov/codecov-action from 5.5.3 to 6.0.0 in the dependencies group across 1 directory by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2570](https://redirect.github.com/javalin/javalin/pull/2570) > * [workflow]: Bump actions/github-script from 8 to 9 in the dependencies group by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2581](https://redirect.github.com/javalin/javalin/pull/2581) > * [cleanup] Remove JavalinTest.class by [`@vorburger`](https://github.com/vorburger) in [javalin/javalin#2584](https://redirect.github.com/javalin/javalin/pull/2584) > * [deps] Bump Jetty from 12.1.7 to 12.1.8 by [`@vorburger`](https://github.com/vorburger) in [javalin/javalin#2585](https://redirect.github.com/javalin/javalin/pull/2585) > * Add ability to emit plain data messages in SSE by [`@1cg`](https://github.com/1cg) in [javalin/javalin#2578](https://redirect.github.com/javalin/javalin/pull/2578) > * fix: sanitize newlines in SSE event and id fields by [`@eddieran`](https://github.com/eddieran) in [javalin/javalin#2580](https://redirect.github.com/javalin/javalin/pull/2580) > * [deps] Bump stable deps and sync OptionalDependency.kt by [`@tipsy`](https://github.com/tipsy) in [javalin/javalin#2588](https://redirect.github.com/javalin/javalin/pull/2588) > > New Contributors > ---------------- > > * [`@AoElite`](https://github.com/AoElite) made their first contribution in [javalin/javalin#2553](https://redirect.github.com/javalin/javalin/pull/2553) > * [`@vorburger`](https://github.com/vorburger) made their first contribution in [javalin/javalin#2584](https://redirect.github.com/javalin/javalin/pull/2584) > * [`@1cg`](https://github.com/1cg) made their first contribution in [javalin/javalin#2578](https://redirect.github.com/javalin/javalin/pull/2578) > * [`@eddieran`](https://github.com/eddieran) made their first contribution in [javalin/javalin#2580](https://redirect.github.com/javalin/javalin/pull/2580) > > **Full Changelog**: <javalin/javalin@javalin-parent-7.1.0...javalin-parent-7.2.0> Commits * [`c67b118`](javalin/javalin@c67b118) [maven-release-plugin] prepare release javalin-parent-7.2.0 * [`b89fdf7`](javalin/javalin@b89fdf7) [deps] Bump stable deps and sync OptionalDependency.kt ([#2588](https://redirect.github.com/javalin/javalin/issues/2588)) * [`a3ad657`](javalin/javalin@a3ad657) [sse] Sanitize newlines in event and id fields * [`e0f5458`](javalin/javalin@e0f5458) [sse] Add ability to emit plain data messages * [`fa51869`](javalin/javalin@fa51869) [deps] Bump Jetty from 12.1.7 to 12.1.8 ([#2585](https://redirect.github.com/javalin/javalin/issues/2585)) * [`4bc70e9`](javalin/javalin@4bc70e9) [cleanup] Remove JavalinTest.class ([#2584](https://redirect.github.com/javalin/javalin/issues/2584)) * [`1901feb`](javalin/javalin@1901feb) [workflow]: Bump actions/github-script in the dependencies group ([#2581](https://redirect.github.com/javalin/javalin/issues/2581)) * [`152f7b3`](javalin/javalin@152f7b3) [workflow]: Bump codecov/codecov-action in the dependencies group ([#2570](https://redirect.github.com/javalin/javalin/issues/2570)) * [`2c4d1ef`](javalin/javalin@2c4d1ef) [deps]: Bump the dependencies group across 1 directory with 23 updates ([#2575](https://redirect.github.com/javalin/javalin/issues/2575)) * [`64f3a75`](javalin/javalin@64f3a75) [apibuilder] Refactor role-scoping internals to Kotlin * Additional commits viewable in [compare view](javalin/javalin@7.1.0...javalin-parent-7.2.0) Updates `io.javalin.community.openapi:javalin-openapi-plugin` from 7.1.0 to 7.2.0 Release notes *Sourced from [io.javalin.community.openapi:javalin-openapi-plugin's releases](https://github.com/javalin/javalin-openapi/releases).* > 7.2.0 > ----- > > **Changes** > > * Bumped Javalin to 7.2.0 > > **Sponsors** > Thanks to everyone who supported me this month 💜 > > **Minimal requirements** > > * Java 17+ / Kotlin 2.3+ > * Javalin 7.2.0 > > 7.1.1-rc.1 > ---------- > > **Changes** > > * [javalin/javalin-openapi#275](https://redirect.github.com/javalin/javalin-openapi/issues/275) [Make ClassLoader used for loading resources configurable](javalin/javalin-openapi@de1b6b7) > > **Sponsors** > Thanks to everyone who supported me this month 💜 ... (truncated) Commits * [`123e727`](javalin/javalin-openapi@123e727) [GH-279](https://redirect.github.com/javalin/javalin-openapi/issues/279) Adjust to Javalin's breaking changed in InternalRouter * [`3ea0e98`](javalin/javalin-openapi@3ea0e98) [GH-279](https://redirect.github.com/javalin/javalin-openapi/issues/279) Release 7.2.0 (Resolves [#279](https://redirect.github.com/javalin/javalin-openapi/issues/279)) * [`0471f8a`](javalin/javalin-openapi@0471f8a) [GH-277](https://redirect.github.com/javalin/javalin-openapi/issues/277) Release 7.1.1-rc.2 * [`3831f78`](javalin/javalin-openapi@3831f78) [GH-277](https://redirect.github.com/javalin/javalin-openapi/issues/277) Cover handling of complex types in query parameters (Resolves [#277](https://redirect.github.com/javalin/javalin-openapi/issues/277)) * See full diff in [compare view](javalin/javalin-openapi@7.1.0...7.2.0) Updates `io.javalin.community.openapi:javalin-swagger-plugin` from 7.1.0 to 7.2.0 Release notes *Sourced from [io.javalin.community.openapi:javalin-swagger-plugin's releases](https://github.com/javalin/javalin-openapi/releases).* > 7.2.0 > ----- > > **Changes** > > * Bumped Javalin to 7.2.0 > > **Sponsors** > Thanks to everyone who supported me this month 💜 > > **Minimal requirements** > > * Java 17+ / Kotlin 2.3+ > * Javalin 7.2.0 > > 7.1.1-rc.1 > ---------- > > **Changes** > > * [javalin/javalin-openapi#275](https://redirect.github.com/javalin/javalin-openapi/issues/275) [Make ClassLoader used for loading resources configurable](javalin/javalin-openapi@de1b6b7) > > **Sponsors** > Thanks to everyone who supported me this month 💜 ... (truncated) Commits * [`123e727`](javalin/javalin-openapi@123e727) [GH-279](https://redirect.github.com/javalin/javalin-openapi/issues/279) Adjust to Javalin's breaking changed in InternalRouter * [`3ea0e98`](javalin/javalin-openapi@3ea0e98) [GH-279](https://redirect.github.com/javalin/javalin-openapi/issues/279) Release 7.2.0 (Resolves [#279](https://redirect.github.com/javalin/javalin-openapi/issues/279)) * [`0471f8a`](javalin/javalin-openapi@0471f8a) [GH-277](https://redirect.github.com/javalin/javalin-openapi/issues/277) Release 7.1.1-rc.2 * [`3831f78`](javalin/javalin-openapi@3831f78) [GH-277](https://redirect.github.com/javalin/javalin-openapi/issues/277) Cover handling of complex types in query parameters (Resolves [#277](https://redirect.github.com/javalin/javalin-openapi/issues/277)) * See full diff in [compare view](javalin/javalin-openapi@7.1.0...7.2.0) Updates `io.javalin:javalin-micrometer` from 7.1.0 to 7.2.0 Release notes *Sourced from [io.javalin:javalin-micrometer's releases](https://github.com/javalin/javalin/releases).* > 7.2.0 > ----- > > What's Changed > -------------- > > * [performance] Replace Stream API with List and reduce per-request allocations by [`@tipsy`](https://github.com/tipsy) in [javalin/javalin#2567](https://redirect.github.com/javalin/javalin/pull/2567) > * feat: introduce `JavalinJackson3` as an optional `JsonMapper` implementation for Jackson 3 by [`@yvasyliev`](https://github.com/yvasyliev) in [javalin/javalin#2548](https://redirect.github.com/javalin/javalin/pull/2548) > * [workflow]: Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the dependencies group by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2569](https://redirect.github.com/javalin/javalin/pull/2569) > * Add path role inheritance by [`@AoElite`](https://github.com/AoElite) in [javalin/javalin#2553](https://redirect.github.com/javalin/javalin/pull/2553) > * [deps]: Bump the dependencies group across 1 directory with 23 updates by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2575](https://redirect.github.com/javalin/javalin/pull/2575) > * [workflow]: Bump codecov/codecov-action from 5.5.3 to 6.0.0 in the dependencies group across 1 directory by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2570](https://redirect.github.com/javalin/javalin/pull/2570) > * [workflow]: Bump actions/github-script from 8 to 9 in the dependencies group by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2581](https://redirect.github.com/javalin/javalin/pull/2581) > * [cleanup] Remove JavalinTest.class by [`@vorburger`](https://github.com/vorburger) in [javalin/javalin#2584](https://redirect.github.com/javalin/javalin/pull/2584) > * [deps] Bump Jetty from 12.1.7 to 12.1.8 by [`@vorburger`](https://github.com/vorburger) in [javalin/javalin#2585](https://redirect.github.com/javalin/javalin/pull/2585) > * Add ability to emit plain data messages in SSE by [`@1cg`](https://github.com/1cg) in [javalin/javalin#2578](https://redirect.github.com/javalin/javalin/pull/2578) > * fix: sanitize newlines in SSE event and id fields by [`@eddieran`](https://github.com/eddieran) in [javalin/javalin#2580](https://redirect.github.com/javalin/javalin/pull/2580) > * [deps] Bump stable deps and sync OptionalDependency.kt by [`@tipsy`](https://github.com/tipsy) in [javalin/javalin#2588](https://redirect.github.com/javalin/javalin/pull/2588) > > New Contributors > ---------------- > > * [`@AoElite`](https://github.com/AoElite) made their first contribution in [javalin/javalin#2553](https://redirect.github.com/javalin/javalin/pull/2553) > * [`@vorburger`](https://github.com/vorburger) made their first contribution in [javalin/javalin#2584](https://redirect.github.com/javalin/javalin/pull/2584) > * [`@1cg`](https://github.com/1cg) made their first contribution in [javalin/javalin#2578](https://redirect.github.com/javalin/javalin/pull/2578) > * [`@eddieran`](https://github.com/eddieran) made their first contribution in [javalin/javalin#2580](https://redirect.github.com/javalin/javalin/pull/2580) > > **Full Changelog**: <javalin/javalin@javalin-parent-7.1.0...javalin-parent-7.2.0> Commits * [`c67b118`](javalin/javalin@c67b118) [maven-release-plugin] prepare release javalin-parent-7.2.0 * [`b89fdf7`](javalin/javalin@b89fdf7) [deps] Bump stable deps and sync OptionalDependency.kt ([#2588](https://redirect.github.com/javalin/javalin/issues/2588)) * [`a3ad657`](javalin/javalin@a3ad657) [sse] Sanitize newlines in event and id fields * [`e0f5458`](javalin/javalin@e0f5458) [sse] Add ability to emit plain data messages * [`fa51869`](javalin/javalin@fa51869) [deps] Bump Jetty from 12.1.7 to 12.1.8 ([#2585](https://redirect.github.com/javalin/javalin/issues/2585)) * [`4bc70e9`](javalin/javalin@4bc70e9) [cleanup] Remove JavalinTest.class ([#2584](https://redirect.github.com/javalin/javalin/issues/2584)) * [`1901feb`](javalin/javalin@1901feb) [workflow]: Bump actions/github-script in the dependencies group ([#2581](https://redirect.github.com/javalin/javalin/issues/2581)) * [`152f7b3`](javalin/javalin@152f7b3) [workflow]: Bump codecov/codecov-action in the dependencies group ([#2570](https://redirect.github.com/javalin/javalin/issues/2570)) * [`2c4d1ef`](javalin/javalin@2c4d1ef) [deps]: Bump the dependencies group across 1 directory with 23 updates ([#2575](https://redirect.github.com/javalin/javalin/issues/2575)) * [`64f3a75`](javalin/javalin@64f3a75) [apibuilder] Refactor role-scoping internals to Kotlin * Additional commits viewable in [compare view](javalin/javalin@7.1.0...javalin-parent-7.2.0) Updates `io.javalin:javalin-testtools` from 7.1.0 to 7.2.0 Release notes *Sourced from [io.javalin:javalin-testtools's releases](https://github.com/javalin/javalin/releases).* > 7.2.0 > ----- > > What's Changed > -------------- > > * [performance] Replace Stream API with List and reduce per-request allocations by [`@tipsy`](https://github.com/tipsy) in [javalin/javalin#2567](https://redirect.github.com/javalin/javalin/pull/2567) > * feat: introduce `JavalinJackson3` as an optional `JsonMapper` implementation for Jackson 3 by [`@yvasyliev`](https://github.com/yvasyliev) in [javalin/javalin#2548](https://redirect.github.com/javalin/javalin/pull/2548) > * [workflow]: Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the dependencies group by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2569](https://redirect.github.com/javalin/javalin/pull/2569) > * Add path role inheritance by [`@AoElite`](https://github.com/AoElite) in [javalin/javalin#2553](https://redirect.github.com/javalin/javalin/pull/2553) > * [deps]: Bump the dependencies group across 1 directory with 23 updates by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2575](https://redirect.github.com/javalin/javalin/pull/2575) > * [workflow]: Bump codecov/codecov-action from 5.5.3 to 6.0.0 in the dependencies group across 1 directory by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2570](https://redirect.github.com/javalin/javalin/pull/2570) > * [workflow]: Bump actions/github-script from 8 to 9 in the dependencies group by [`@dependabot`](https://github.com/dependabot)[bot] in [javalin/javalin#2581](https://redirect.github.com/javalin/javalin/pull/2581) > * [cleanup] Remove JavalinTest.class by [`@vorburger`](https://github.com/vorburger) in [javalin/javalin#2584](https://redirect.github.com/javalin/javalin/pull/2584) > * [deps] Bump Jetty from 12.1.7 to 12.1.8 by [`@vorburger`](https://github.com/vorburger) in [javalin/javalin#2585](https://redirect.github.com/javalin/javalin/pull/2585) > * Add ability to emit plain data messages in SSE by [`@1cg`](https://github.com/1cg) in [javalin/javalin#2578](https://redirect.github.com/javalin/javalin/pull/2578) > * fix: sanitize newlines in SSE event and id fields by [`@eddieran`](https://github.com/eddieran) in [javalin/javalin#2580](https://redirect.github.com/javalin/javalin/pull/2580) > * [deps] Bump stable deps and sync OptionalDependency.kt by [`@tipsy`](https://github.com/tipsy) in [javalin/javalin#2588](https://redirect.github.com/javalin/javalin/pull/2588) > > New Contributors > ---------------- > > * [`@AoElite`](https://github.com/AoElite) made their first contribution in [javalin/javalin#2553](https://redirect.github.com/javalin/javalin/pull/2553) > * [`@vorburger`](https://github.com/vorburger) made their first contribution in [javalin/javalin#2584](https://redirect.github.com/javalin/javalin/pull/2584) > * [`@1cg`](https://github.com/1cg) made their first contribution in [javalin/javalin#2578](https://redirect.github.com/javalin/javalin/pull/2578) > * [`@eddieran`](https://github.com/eddieran) made their first contribution in [javalin/javalin#2580](https://redirect.github.com/javalin/javalin/pull/2580) > > **Full Changelog**: <javalin/javalin@javalin-parent-7.1.0...javalin-parent-7.2.0> Commits * [`c67b118`](javalin/javalin@c67b118) [maven-release-plugin] prepare release javalin-parent-7.2.0 * [`b89fdf7`](javalin/javalin@b89fdf7) [deps] Bump stable deps and sync OptionalDependency.kt ([#2588](https://redirect.github.com/javalin/javalin/issues/2588)) * [`a3ad657`](javalin/javalin@a3ad657) [sse] Sanitize newlines in event and id fields * [`e0f5458`](javalin/javalin@e0f5458) [sse] Add ability to emit plain data messages * [`fa51869`](javalin/javalin@fa51869) [deps] Bump Jetty from 12.1.7 to 12.1.8 ([#2585](https://redirect.github.com/javalin/javalin/issues/2585)) * [`4bc70e9`](javalin/javalin@4bc70e9) [cleanup] Remove JavalinTest.class ([#2584](https://redirect.github.com/javalin/javalin/issues/2584)) * [`1901feb`](javalin/javalin@1901feb) [workflow]: Bump actions/github-script in the dependencies group ([#2581](https://redirect.github.com/javalin/javalin/issues/2581)) * [`152f7b3`](javalin/javalin@152f7b3) [workflow]: Bump codecov/codecov-action in the dependencies group ([#2570](https://redirect.github.com/javalin/javalin/issues/2570)) * [`2c4d1ef`](javalin/javalin@2c4d1ef) [deps]: Bump the dependencies group across 1 directory with 23 updates ([#2575](https://redirect.github.com/javalin/javalin/issues/2575)) * [`64f3a75`](javalin/javalin@64f3a75) [apibuilder] Refactor role-scoping internals to Kotlin * Additional commits viewable in [compare view](javalin/javalin@7.1.0...javalin-parent-7.2.0)

AoElite added 2 commits March 8, 2026 18:29

Add route role inheritance for nested API paths in ApiBuilder.

c4ccc75

Refactor TestApiBuilderRouteRoles to use static imports from `ApiBu…

5add723

…ilder`.

augmentcode Bot reviewed Mar 12, 2026

View reviewed changes

tipsy force-pushed the master branch 2 times, most recently from b661c76 to 338c402 Compare March 18, 2026 13:20

AoElite added 2 commits March 19, 2026 22:52

Merge remote-tracking branch 'origin/master' into path-role-inheritance

ec4eaa1

Refactor ApiBuilder path methods to use Collection<RouteRole>. Up…

135d592

…date `TestApiBuilderRouteRoles` to include role collections in tests.

AoElite added 2 commits March 22, 2026 16:45

Merge branch 'master' into path-role-inheritance

e8af2ad

Refactor ApiBuilder to simplify role handling and improve test cove…

81f9e78

…rage for role clearing and merging logic.

tipsy merged commit cd8e454 into javalin:master Mar 23, 2026
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add path role inheritance#2553

Add path role inheritance#2553
tipsy merged 6 commits into
javalin:masterfrom
AoElite:path-role-inheritance

AoElite commented Mar 8, 2026

Uh oh!

codecov Bot commented Mar 8, 2026 •

edited

Loading

Uh oh!

AoElite commented Mar 8, 2026

Uh oh!

tipsy commented Mar 12, 2026

Uh oh!

augmentcode Bot commented Mar 12, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Mar 12, 2026

Uh oh!

augmentcode Bot Mar 12, 2026

Uh oh!

tipsy commented Mar 13, 2026

Uh oh!

AoElite commented Mar 20, 2026

Uh oh!

tipsy commented Mar 22, 2026

Uh oh!

Uh oh!

tipsy commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

AoElite commented Mar 8, 2026

Uh oh!

codecov Bot commented Mar 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

AoElite commented Mar 8, 2026

Uh oh!

tipsy commented Mar 12, 2026

Uh oh!

augmentcode Bot commented Mar 12, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

tipsy commented Mar 13, 2026

Uh oh!

AoElite commented Mar 20, 2026

Uh oh!

tipsy commented Mar 22, 2026

Uh oh!

Uh oh!

tipsy commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Mar 8, 2026 •

edited

Loading