module

SpringModuleScope

Which build units' Spring beans serve an endpoint. A SecurityFilterChain, a csrf setting or a CORS mapping lives in one Maven / Gradle module and applies only to the apps whose runtime classpath holds that module, so spring_auth and spring_security judge an endpoint once per app that serves it (per_serving_classpath). Both read a chain's request matchers the same way (chain_scope, matcher_patterns).

Constants

BOOT_APP_MARKERS = {"@SpringBootApplication", "@SpringBootConfiguration", "SpringApplication.run", "runApplication<"}
BUILD_FILE = /\A(?:pom\.xml|build\.gradle(?:\.kts)?)\z/
CONFIG_LIST_GETTER = /\A(?:this\s*\.\s*)?([a-z_$][\w$]*)\s*\.\s*(?:get([A-Z][\w$]*)|([a-z][\w$]*))\s*\(\s*\)(?:\s*\.\s*stream\s*\(\s*\))?(?:\s*\.\s*toArray\s*\([^()]*\))?\z/
CONFIGURATION_PROPERTIES = /@ConfigurationProperties\s*\(\s*(?:(?:prefix|value)\s*=\s*)?"([^"]*)"/
CONSTANT_REFERENCE = /\A[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\z/
GRADLE_BUILD_LOGIC_DIR = /\/(?:buildSrc|build-logic)\//

Precompiled convention plugins.

GRADLE_CONFIGURATION = /\A\s*([A-Za-z_]\w*)/
GRADLE_COORDINATE = /["'][\w.-]+:([\w.-]+)(?::[^"'\s]*)?["']/

A coordinate "group:name[:version]": a module of another build in the scan when name is that module's directory or Maven artifactId.

GRADLE_DEPENDENCY_LINE = /\b(?:implementation|api|compile|runtime|runtimeOnly|developmentOnly|add)\b/

A line that adds a dependency, not a version constraint (force, includeVersion) or a plugin classpath.

GRADLE_PROJECT_ACCESSOR = /\bprojects\s*\.\s*([A-Za-z_][\w.]*)/
GRADLE_PROJECT_DIR = /\bproject\s*\(\s*["']([^"']+)["']\s*\)\s*\.\s*projectDir\s*=\s*(?:file\s*\(|(?:new\s+)?File\s*\(\s*\w+\s*,)\s*["']([^"']+)["']/

project(":x").projectDir = file("libs/x") (or File(rootDir, "libs/x")).

GRADLE_PROJECT_MENTION = /\bproject\s*\(|\bprojects\s*\.\s*[A-Za-z_]/

Any project dependency, read or not (project(mapOf("path" to ":a"))).

GRADLE_PROJECT_REF = /\bproject\s*\(\s*(?:path\s*[:=]\s*)?["']([^"']+)["']/

project(":a:b"), project(path: ':a'), and the type-safe accessor projects.a.b.

GRADLE_ROOT_PROJECT_NAME = /\brootProject\.name\s*=\s*["']([^"']+)["']/
GRADLE_SCRIPT_EXTENSION = /\.gradle(?:\.kts)?\z/
GRADLE_SETTINGS = /\Asettings\.gradle(?:\.kts)?\z/
GRADLE_SPRING_SECURITY = /spring[-._]?(?:boot[-._]?starter[-._]?(?:security|oauth2)|security(?![-._]?(?:test|bom)\b))/i

Spring Security named by a coordinate or a version-catalog accessor (libs.spring.boot.starter.security), not its test kit or BOM.

INLINE_STRING_ARRAY = /\A(?:new\s+String\s*\[\s*\]\s*)?\{(.*)\}\z/m
JAVA_STRING_LITERAL = /\A"((?:[^"\\]|\\.)*)"\z/
MATCHER_FACTORY_CALL = /\A(?:new\s+)?(?:[\w$]+\s*(?:\([^()]*\))?\s*\.\s*)*(?:antMatcher|AntPathRequestMatcher|MvcRequestMatcher|matcher|pattern)\s*\((.*)\)\z/m

Calls that build a request matcher from their (pattern) arguments, so requestMatchers(antMatcher(X)) reads X. Regex matchers are not ant patterns and are deliberately absent.

MATCHERS_CALL = /\.\s*(antMatchers|requestMatchers|mvcMatchers|pathMatchers)\s*\(/

Authorization rule matchers: servlet requestMatchers(...) and the WebFlux pathMatchers(...).

MAVEN_ARTIFACT_ID = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/
MAVEN_DEPENDENCY = /<dependency>(.*?)<\/dependency>/m
MAVEN_NOISE = /<!--.*?-->|<dependencyManagement>.*?<\/dependencyManagement>|<build>.*?<\/build>|<exclusions>.*?<\/exclusions>/m

Comments, version pins (dependencyManagement), plugin dependencies (build) and exclusions name no dependency of the module.

MAVEN_PARENT = /<parent>(.*?)<\/parent>/m
NO_BUILDERS = Hash(String, String | ::Nil).new
QUALIFIED_CONSTANT = /\b([A-Z][\w$]*)\.[A-Z_][A-Z0-9_$]*\b/
RECEIVER_VARIABLE = /\A\s*([A-Za-z_$][\w$]*)\s*\./
SCOPE_MATCHER_CALL = /\b(securityMatchers?)\s*\(|(?<!AntPathRequestMatcher)\.\s*(antMatcher)\s*\(/

A chain is "scoped" when restricted by securityMatcher(...), securityMatchers(m -> m.requestMatchers(...)) or Spring 5's http.antMatcher(...). The plural antMatchers(...) / requestMatchers(...) forms are authorization rules, and antMatcher(...) as a static factory (requestMatchers(antMatcher("/h2/**")), AntPathRequestMatcher.antMatcher(X)) builds a rule's matcher — only the HttpSecurity method (.antMatcher( on anything but the factory class) scopes the chain.

SERVLET_PATH_BUILDER = /\b([A-Za-z_$][\w$]*)\s*=\s*[^;=]*?\.\s*(?:servletPath|basePath)\s*\(([^()]*)\)/
SERVLET_PATH_CALL = /\.\s*(?:servletPath|basePath)\s*\(([^()]*)\)/

The servlet path (MvcRequestMatcher.Builder) or base path (PathPatternRequestMatcher.Builder) in a factory's receiver chain, and a builder variable that carries one (Builder mvc = new MvcRequestMatcher.Builder(i).servletPath("/ws")).

SPRING_SECURITY_ARTIFACT = /\A(?:spring-boot-starter-security|spring-security-(?!test\z)[\w.-]+|spring-boot-starter-oauth2-[\w.-]+)\z/

Nested types