GoRouteGroupScope
Inherits PrefixScope
Shared Go route-group scope resolution for the Go framework taggers.
Both go_auth and go_security answer the same question: a middleware
registration (x.Use(...)) appears on some line — which URL prefix does it
guard? Go routers express grouping two structurally different ways, and they
have to be tracked differently:
- assignment groups —
api := r.Group("/api"). The variable carries the prefix; the group is NOT delimited by braces, soapi.Use(...)may sit anywhere below, and a siblingadmin := r.Group("/admin")is a separate scope, not a nested one. - closure groups —
r.Route("/api", func(r chi.Router) { ... }). The prefix applies to everything inside the closure, so it is delimited by brace depth.
Modelling both with a single push/pop stack makes sibling assignment groups
accumulate: /api then /admin resolves the second group's middleware to
/api/admin. That is both a false negative (the real /admin/* routes lose
their tag) and — worse for a security tool — a false positive (/api/admin/*
routes are reported as guarded when they are not).
The third case is a group whose path is not a string literal
(r.Group(cfg.APIBase + "/v1")). Its prefix is genuinely unknowable to a
line-based scanner, and it must NOT collapse to "global": a real app that
builds every group that way would have every endpoint — including its
explicitly public ones — tagged from whichever .Use(auth) happened to be
scanned first. Unknown keeps that case distinguishable from Global so
callers can decline to tag, matching spring_security's treatment of a
filter chain scoped only by a matcher it cannot resolve.
Constants
name := parent.Group("/seg") — assignment group with a literal path.
The same assignment shape with any first argument, literal or not. Used to tell "this variable is a route group whose prefix we can't read" from "this variable is not a route group at all".
r.Group("/api").Use(auth) — the group is created and the middleware
registered in one chained expression, so it is neither an assignment nor a
closure group. USE_CALL cannot see the receiver here (the character
before .Use is )), so match the chain directly.
parent.Group("/seg", func(...) / .Route / .Party closure group.
A .Use(...) / .Pre(...) middleware registration call.
Class methods
Instance methods
Walk content line by line, maintaining the route-group state, and yield
each stripped line alongside it. Callers resolve a middleware registration
with resolve_use_scope.