grape 2.4.0 → 4.0.1

data/lib/grape/endpoint.rb

@@ -8,138 +8,92 @@ module Grape
   class Endpoint
     extend Forwardable
     include Grape::DSL::Settings
+    include Grape::DSL::Headers
     include Grape::DSL::InsideRoute
 
-    attr_accessor :block, :source, :options
-    attr_reader :env, :request
+    attr_reader :env, :request, :source, :options, :endpoints
+    attr_accessor :options_route_enabled
 
     def_delegators :request, :params, :headers, :cookies
     def_delegator :cookies, :response_cookies
 
-    class << self
-      def new(...)
-        self == Endpoint ? Class.new(Endpoint).new(...) : super
-      end
+    # The API (a +Grape::API+ instance) this endpoint belongs to.
+    def_delegator :@config, :api
 
-      def before_each(new_setup = false, &block)
-        @before_each ||= []
-        if new_setup == false
-          return @before_each unless block
+    # The logger configured on the API this endpoint belongs to. Available
+    # inside route handlers, +before+/+after+/+after_validation+/+finally+
+    # filters, and +rescue_from+ blocks.
+    def_delegator :api, :logger
 
-          @before_each << block
-        else
-          @before_each = [new_setup]
-        end
-      end
+    # The Rack app or Grape API mounted at this endpoint, or +nil+ for a plain
+    # block endpoint. Prefer this over +options[:app]+, which is retained only
+    # for backwards compatibility.
+    def mounted_app
+      config.app
+    end
 
-      def run_before_each(endpoint)
-        superclass.run_before_each(endpoint) unless self == Endpoint
-        before_each.each { |blk| blk.try(:call, endpoint) }
-      end
+    class << self
+      def block_to_unbound_method(block)
+        return unless block
 
-      # @api private
-      #
-      # Create an UnboundMethod that is appropriate for executing an endpoint
-      # route.
-      #
-      # The unbound method allows explicit calls to +return+ without raising a
-      # +LocalJumpError+. The method will be removed, but a +Proc+ reference to
-      # it will be returned. The returned +Proc+ expects a single argument: the
-      # instance of +Endpoint+ to bind to the method during the call.
-      #
-      # @param [String, Symbol] method_name
-      # @return [Proc]
-      # @raise [NameError] an instance method with the same name already exists
-      def generate_api_method(method_name, &block)
-        raise NameError.new("method #{method_name.inspect} already exists and cannot be used as an unbound method name") if method_defined?(method_name)
-
-        define_method(method_name, &block)
-        method = instance_method(method_name)
-        remove_method(method_name)
-
-        proc do |endpoint_instance|
-          ActiveSupport::Notifications.instrument('endpoint_render.grape', endpoint: endpoint_instance) do
-            method.bind_call(endpoint_instance)
-          end
-        end
+        define_method :temp_unbound_method, block
+        method = instance_method(:temp_unbound_method)
+        remove_method :temp_unbound_method
+        method
       end
     end
 
     # Create a new endpoint.
     # @param new_settings [InheritableSetting] settings to determine the params,
     #   validations, and other properties from.
-    # @param options [Hash] attributes of this endpoint
-    # @option options path [String or Array] the path to this endpoint, within
-    #   the current scope.
-    # @option options method [String or Array] which HTTP method(s) can be used
-    #   to reach this endpoint.
+    # @param http_methods [String or Array] which HTTP method(s) can be used to
+    #   reach this endpoint.
+    # @param path [String or Array] the path to this endpoint, within the
+    #   current scope.
+    # @param api [Grape::API] the API this endpoint belongs to. Exposed as
+    #   {#api}.
+    # @param app [#call, nil] the Rack app or Grape API mounted at this
+    #   endpoint; +nil+ for a plain block endpoint. Exposed as {#mounted_app}.
+    # @param params [Hash] the declared params for this endpoint, keyed by name.
+    #   Kept out of +route_options+ and read via +config.params+.
+    # @param requirements [Hash, nil] regular-expression constraints for named
+    #   path params. Read via +config.requirements+.
+    # @param anchor [Boolean] whether the route anchors to the whole path
+    #   (default +true+). Read via +config.anchor+.
+    # @param options [Hash] attributes of this endpoint, normalized into a
+    #   +Grape::Endpoint::Options+ value object.
     # @option options route_options [Hash]
     # @note This happens at the time of API definition, so in this context the
     # endpoint does not know if it will be mounted under a different endpoint.
     # @yield a block defining what your API should do when this endpoint is hit
-    def initialize(new_settings, options = {}, &block)
-      require_option(options, :path)
-      require_option(options, :method)
-
-      self.inheritable_setting = new_settings.point_in_time_copy
-
-      # now +namespace_stackable(:declared_params)+ contains all params defined for
-      # this endpoint and its parents, but later it will be cleaned up,
-      # see +reset_validations!+ in lib/grape/dsl/validations.rb
-      route_setting(:declared_params, namespace_stackable(:declared_params).flatten)
-      route_setting(:saved_validations, namespace_stackable(:validations))
-
-      namespace_stackable(:representations, []) unless namespace_stackable(:representations)
-      namespace_inheritable(:default_error_status, 500) unless namespace_inheritable(:default_error_status)
+    def initialize(new_settings, http_methods:, path:, api:, app: nil, params: {}, requirements: nil, anchor: true, **options, &block)
+      self.inheritable_setting = new_settings.point_in_time_copy_for_endpoint
 
       @options = options
-
-      @options[:path] = Array(options[:path])
-      @options[:path] << '/' if options[:path].empty?
-
-      @options[:method] = Array(options[:method])
-      @options[:route_options] ||= {}
-
-      @lazy_initialize_lock = Mutex.new
-      @lazy_initialized = nil
-      @block = nil
+      @config = Options.new(http_methods:, path:, api:, app:, params:, requirements:, anchor:, **options)
+      # +:app+ is still surfaced on the public options Hash for backwards
+      # compatibility (e.g. grape-swagger); prefer the +mounted_app+ reader.
+      @options[:app] = app if app
 
       @status = nil
       @stream = nil
       @body = nil
-      @proc = nil
-
-      return unless block
-
-      @source = block
-      @block = self.class.generate_api_method(method_name, &block)
+      @source = self.class.block_to_unbound_method(block)
+      @before_filter_passed = false
+      @options_route_enabled = false
+      @endpoints = @config.app.endpoints if @config.app.respond_to?(:endpoints)
     end
 
-    # Update our settings from a given set of stackable parameters. Used when
+    # Update our settings from a given parent settings instance. Used when
     # the endpoint's API is mounted under another one.
-    def inherit_settings(namespace_stackable)
-      parent_validations = namespace_stackable[:validations]
-      inheritable_setting.route[:saved_validations].concat(parent_validations) if parent_validations.any?
-      parent_declared_params = namespace_stackable[:declared_params]
-      inheritable_setting.route[:declared_params].concat(parent_declared_params.flatten) if parent_declared_params.any?
-
-      endpoints&.each { |e| e.inherit_settings(namespace_stackable) }
-    end
-
-    def require_option(options, key)
-      raise Grape::Exceptions::MissingOption.new(key) unless options.key?(key)
-    end
-
-    def method_name
-      [options[:method],
-       Namespace.joined_space(namespace_stackable(:namespace)),
-       (namespace_stackable(:mount_path) || []).join('/'),
-       options[:path].join('/')]
-        .join(' ')
+    # @param settings [Grape::Util::InheritableSetting]
+    def inherit_settings(settings)
+      inheritable_setting.inherit_route_params(settings)
+      endpoints&.each { |e| e.inherit_settings(settings) }
     end
 
     def routes
-      @routes ||= endpoints&.collect(&:routes)&.flatten || to_routes
+      @routes ||= endpoints&.flat_map(&:routes) || to_routes
     end
 
     def reset_routes!
@@ -149,74 +103,27 @@ module Grape
     end
 
     def mount_in(router)
-      return endpoints.each { |e| e.mount_in(router) } if endpoints
+      if endpoints
+        compile!
+        return endpoints.each { |e| e.mount_in(router) }
+      end
 
       reset_routes!
+      compile!
       routes.each do |route|
         router.append(route.apply(self))
-        next unless !namespace_inheritable(:do_not_route_head) && route.request_method == Rack::GET
+        next if inheritable_setting.do_not_route_head? || route.request_method != Rack::GET
 
-        route.dup.then do |head_route|
-          head_route.convert_to_head_request!
-          router.append(head_route.apply(self))
-        end
+        router.append(route.to_head.apply(self))
       end
     end
 
-    def to_routes
-      default_route_options = prepare_default_route_attributes
-
-      map_routes do |method, raw_path|
-        prepared_path = Path.new(raw_path, namespace, prepare_default_path_settings)
-        params = options[:route_options].present? ? options[:route_options].merge(default_route_options) : default_route_options
-        route = Grape::Router::Route.new(method, prepared_path.origin, prepared_path.suffix, params)
-        route.apply(self)
-      end.flatten
-    end
-
-    def prepare_routes_requirements
-      {}.merge!(*namespace_stackable(:namespace).map(&:requirements)).tap do |requirements|
-        endpoint_requirements = options.dig(:route_options, :requirements)
-        requirements.merge!(endpoint_requirements) if endpoint_requirements
-      end
-    end
-
-    def prepare_default_route_attributes
-      {
-        namespace: namespace,
-        version: prepare_version,
-        requirements: prepare_routes_requirements,
-        prefix: namespace_inheritable(:root_prefix),
-        anchor: options[:route_options].fetch(:anchor, true),
-        settings: inheritable_setting.route.except(:declared_params, :saved_validations),
-        forward_match: options[:forward_match]
-      }
-    end
-
-    def prepare_version
-      version = namespace_inheritable(:version)
-      return if version.blank?
-
-      version.length == 1 ? version.first : version
-    end
-
-    def map_routes
-      options[:method].map { |method| options[:path].map { |path| yield method, path } }
-    end
-
-    def prepare_default_path_settings
-      namespace_stackable_hash = inheritable_setting.namespace_stackable.to_hash
-      namespace_inheritable_hash = inheritable_setting.namespace_inheritable.to_hash
-      namespace_stackable_hash.merge!(namespace_inheritable_hash)
-    end
-
     def namespace
-      @namespace ||= Namespace.joined_space_path(namespace_stackable(:namespace))
+      @namespace ||= inheritable_setting.namespace_path
     end
 
     def call(env)
-      lazy_initialize!
-      dup.call!(env)
+      @prototype.dup.call!(env)
     end
 
     def call!(env)
@@ -225,14 +132,19 @@ module Grape
       @app.call(env)
     end
 
-    # Return the collection of endpoints within this endpoint.
-    # This is the case when an Grape::API mounts another Grape::API.
-    def endpoints
-      @endpoints ||= options[:app].try(:endpoints)
+    def ==(other)
+      other.is_a?(self.class) &&
+        config == other.config &&
+        inheritable_setting == other.inheritable_setting
     end
+    alias eql? ==
 
-    def equals?(endpoint)
-      (options == endpoint.options) && (inheritable_setting.to_hash == endpoint.inheritable_setting.to_hash)
+    # Mirrors #==. The class stays out: #== admits a subclass instance
+    # through is_a?, and such a pair must hash alike. The block (#source) is
+    # not part of either, matching the long-standing duplicate-route check in
+    # DSL::Routing#route.
+    def hash
+      [config, inheritable_setting].hash
     end
 
     # The purpose of this override is solely for stripping internals when an error occurs while calling
@@ -247,22 +159,21 @@ module Grape
     protected
 
     def run
-      ActiveSupport::Notifications.instrument('endpoint_run.grape', endpoint: self, env: env) do
-        @request = Grape::Request.new(env, build_params_with: namespace_inheritable(:build_params_with))
+      instrument_run do
+        @request = Grape::Request.new(env, build_params_with: @build_params_with)
         begin
-          self.class.run_before_each(self)
           run_filters befores, :before
+          @before_filter_passed = true
 
           if env.key?(Grape::Env::GRAPE_ALLOWED_METHODS)
             header['Allow'] = env[Grape::Env::GRAPE_ALLOWED_METHODS].join(', ')
             raise Grape::Exceptions::MethodNotAllowed.new(header) unless options?
 
-            header 'Allow', header['Allow']
             response_object = ''
             status 204
           else
             run_filters before_validations, :before_validation
-            run_validators validations, request
+            run_validators(request:)
             run_filters after_validations, :after_validation
             response_object = execute
           end
@@ -284,134 +195,263 @@ module Grape
     end
 
     def execute
-      @block&.call(self)
-    end
-
-    def helpers
-      lazy_initialize! && @helpers
-    end
-
-    def lazy_initialize!
-      return true if @lazy_initialized
-
-      @lazy_initialize_lock.synchronize do
-        return true if @lazy_initialized
-
-        @helpers = build_helpers&.tap { |mod| self.class.include mod }
-        @app = options[:app] || build_stack(@helpers)
+      return unless source
 
-        @lazy_initialized = true
+      instrument_render do
+        source.bind_call(self)
       end
     end
 
-    def run_validators(validators, request)
-      validation_errors = []
+    def run_validators(request:)
+      validators = inheritable_setting.route_validations
+      return if validators.blank?
 
-      ActiveSupport::Notifications.instrument('endpoint_run_validators.grape', endpoint: self, validators: validators, request: request) do
-        validators.each do |validator|
-          validator.validate(request)
-        rescue Grape::Exceptions::Validation => e
-          validation_errors << e
-          break if validator.fail_fast?
-        rescue Grape::Exceptions::ValidationArrayErrors => e
-          validation_errors.concat e.errors
-          break if validator.fail_fast?
+      validation_exceptions = nil
+
+      Grape::Validations::ParamScopeTracker.track do
+        instrument_run_validators(validators, request) do
+          validators.each do |validator|
+            validator.validate(request)
+          rescue Grape::Exceptions::Validation, Grape::Exceptions::ValidationArrayErrors => e
+            (validation_exceptions ||= []) << e
+            break if validator.fail_fast?
+          end
         end
       end
 
-      validation_errors.any? && raise(Grape::Exceptions::ValidationErrors.new(errors: validation_errors, headers: header))
+      raise Grape::Exceptions::ValidationErrors.new(exceptions: validation_exceptions, headers: header) if validation_exceptions
     end
 
     def run_filters(filters, type = :other)
-      ActiveSupport::Notifications.instrument('endpoint_run_filters.grape', endpoint: self, filters: filters, type: type) do
-        filters&.each { |filter| instance_eval(&filter) }
+      return if filters.blank?
+
+      instrument_run_filters(filters, type) do
+        filters.each { |filter| instance_eval(&filter) }
       end
-      post_extension = DSL::InsideRoute.post_filter_methods(type)
-      extend post_extension if post_extension
     end
 
-    %i[befores before_validations after_validations afters finallies].each do |method|
-      define_method method do
-        namespace_stackable(method)
-      end
+    attr_reader :befores, :before_validations, :after_validations, :afters, :finallies, :config
+
+    def options?
+      options_route_enabled && env[Rack::REQUEST_METHOD] == Rack::OPTIONS
     end
 
-    def validations
-      return enum_for(:validations) unless block_given?
+    private
+
+    attr_reader :before_filter_passed
+
+    # Instrument helpers. Each guards on +listening?+ so that with no subscriber
+    # the payload Hash and notification machinery are skipped and the block runs
+    # directly (no added allocations); the block is forwarded anonymously so
+    # nothing is allocated unless a subscriber is present.
+    def instrument_run(&)
+      return yield unless ActiveSupport::Notifications.notifier.listening?('endpoint_run.grape')
+
+      ActiveSupport::Notifications.instrument('endpoint_run.grape', endpoint: self, env:, &)
+    end
+
+    def instrument_render(&)
+      return yield unless ActiveSupport::Notifications.notifier.listening?('endpoint_render.grape')
+
+      ActiveSupport::Notifications.instrument('endpoint_render.grape', endpoint: self, &)
+    end
+
+    def instrument_run_validators(validators, request, &)
+      return yield unless ActiveSupport::Notifications.notifier.listening?('endpoint_run_validators.grape')
+
+      ActiveSupport::Notifications.instrument('endpoint_run_validators.grape', endpoint: self, validators:, request:, &)
+    end
+
+    def instrument_run_filters(filters, type, &)
+      return yield unless ActiveSupport::Notifications.notifier.listening?('endpoint_run_filters.grape')
+
+      ActiveSupport::Notifications.instrument('endpoint_run_filters.grape', endpoint: self, filters:, type:, &)
+    end
+
+    def compile!
+      @app = config.app || build_stack
+      warn_unauthenticated_mounted_app
+      @helpers = build_helpers
+      callbacks = inheritable_setting.callbacks
+      @befores            = callbacks.fetch(:before)
+      @before_validations = callbacks.fetch(:before_validation)
+      @after_validations  = callbacks.fetch(:after_validation)
+      @afters             = callbacks.fetch(:after)
+      @finallies          = callbacks.fetch(:finally)
+      @build_params_with  = inheritable_setting.build_params_with
+      @prototype          = build_prototype
+    end
+
+    # The object each request is copied from.
+    #
+    # Helpers reach an endpoint by module inclusion, and +Object#dup+ does not
+    # carry a singleton class over — so including them on the per-request copy
+    # meant giving every request a brand-new singleton class, whose method
+    # cache then started cold for the helpers, the route block and every DSL
+    # method the endpoint answers. Include them once into a subclass owned by
+    # this endpoint instead, and copy this endpoint's state onto an instance of
+    # it: the per-request copy already answers to the helpers, against a class
+    # that has been warm since boot. It also keeps request handling free of
+    # class mutation.
+    #
+    # Endpoints with no helpers are their own prototype, exactly as before.
+    #
+    # +allocate+ rather than +new+ because the constructor rebuilds state from
+    # the DSL's arguments — a fresh settings copy, a fresh +@config+, another
+    # +block_to_unbound_method+ — and would still not hold what +compile!+ has
+    # just computed. What is wanted is what +dup+ itself does (allocate, then
+    # copy the ivars over) across a class boundary, which neither +dup+ nor
+    # +initialize_copy+ will do: both insist on the receiver's own class. So
+    # the copy is written out here. Taking all of them is safe because
+    # everything set past this point (+routes+, +namespace+) is route-building
+    # memoization the request path never reads.
+    def build_prototype
+      return self unless @helpers
+
+      klass = Class.new(self.class)
+      # Anonymous classes answer nil to +name+ and render as a bare address,
+      # which would reach anything that reports on the endpoint — +inspect+
+      # here, a logger or an error tracker elsewhere. The annotation is what
+      # +set_temporary_name+ is for; a plain constant path is rejected, which
+      # is right, since this class is not reachable under that name.
+      klass.set_temporary_name("#{self.class}(helpers)")
+      klass.include(@helpers)
+      prototype = klass.allocate
+      # Everything but the prototype slot itself, so that recompiling (a
+      # remount) does not leave the new prototype holding the one it replaces.
+      (instance_variables - [:@prototype]).each { |name| prototype.instance_variable_set(name, instance_variable_get(name)) }
+      prototype
+    end
 
-      route_setting(:saved_validations)&.each do |saved_validation|
-        yield Grape::Validations::ValidatorFactory.create_validator(saved_validation)
+    def to_routes
+      route_options = config.route_options
+      params = config.params
+      path_settings = inheritable_setting.path_settings
+      forward_match = bare_rack_app?
+      version = prepare_version(inheritable_setting.version)
+      prefix = inheritable_setting.root_prefix
+      requirements = prepare_routes_requirements(config.requirements)
+      anchor = config.anchor
+      settings = inheritable_setting.route_settings
+
+      config.http_methods.flat_map do |method|
+        config.path.map do |path|
+          pattern = Grape::Router::Pattern.build(
+            path:,
+            namespace:,
+            settings: path_settings,
+            anchor:,
+            params:,
+            version:,
+            requirements:
+          )
+          Grape::Router::Route.new(self, method, pattern, route_options, forward_match:, params:, namespace:, prefix:, settings:)
+        end
       end
     end
 
-    def options?
-      options[:options_route_enabled] &&
-        env[Rack::REQUEST_METHOD] == Rack::OPTIONS
+    # True when a bare Rack app (anything that isn't a Grape app) is mounted at
+    # this endpoint. Such an app is called directly and matched by path prefix
+    # rather than an anchored route.
+    def bare_rack_app?
+      config.app && !config.app.is_a?(Grape::Mountable)
     end
 
-    private
+    def prepare_routes_requirements(route_options_requirements)
+      namespace_requirements = inheritable_setting.namespace_requirements
+      namespace_requirements << route_options_requirements if route_options_requirements.present?
+      namespace_requirements.reduce({}, :merge)
+    end
 
-    def build_stack(helpers)
+    def prepare_version(namespace_inheritable_version)
+      return if namespace_inheritable_version.blank?
+
+      namespace_inheritable_version.length == 1 ? namespace_inheritable_version.first : namespace_inheritable_version
+    end
+
+    def build_stack
       stack = Grape::Middleware::Stack.new
 
-      content_types = namespace_stackable_with_hash(:content_types)
-      format = namespace_inheritable(:format)
+      content_types = inheritable_setting.content_types
+      format = inheritable_setting.format
 
       stack.use Rack::Head
       stack.use Rack::Lint if lint?
-      stack.use Class.new(Grape::Middleware::Error),
-                helpers: helpers,
-                format: format,
-                content_types: content_types,
-                default_status: namespace_inheritable(:default_error_status),
-                rescue_all: namespace_inheritable(:rescue_all),
-                rescue_grape_exceptions: namespace_inheritable(:rescue_grape_exceptions),
-                default_error_formatter: namespace_inheritable(:default_error_formatter),
-                error_formatters: namespace_stackable_with_hash(:error_formatters),
-                rescue_options: namespace_stackable_with_hash(:rescue_options),
-                rescue_handlers: namespace_reverse_stackable_with_hash(:rescue_handlers),
-                base_only_rescue_handlers: namespace_stackable_with_hash(:base_only_rescue_handlers),
-                all_rescue_handler: namespace_inheritable(:all_rescue_handler),
-                grape_exceptions_rescue_handler: namespace_inheritable(:grape_exceptions_rescue_handler)
-
-      stack.concat namespace_stackable(:middleware)
-
-      if namespace_inheritable(:version).present?
-        stack.use Grape::Middleware::Versioner.using(namespace_inheritable(:version_options)[:using]),
-                  versions: namespace_inheritable(:version).flatten,
-                  version_options: namespace_inheritable(:version_options),
-                  prefix: namespace_inheritable(:root_prefix),
-                  mount_path: namespace_stackable(:mount_path).first
+      stack.use Grape::Middleware::Error, **error_middleware_options(format, content_types)
+
+      stack.concat inheritable_setting.middleware
+
+      if inheritable_setting.version.present?
+        version_options = inheritable_setting.version_options
+        stack.use Grape::Middleware::Versioner.using(version_options.using),
+                  versions: inheritable_setting.version.flatten,
+                  version_options:,
+                  prefix: inheritable_setting.root_prefix,
+                  mount_path: inheritable_setting.mount_path
       end
 
       stack.use Grape::Middleware::Formatter,
-                format: format,
-                default_format: namespace_inheritable(:default_format) || :txt,
-                content_types: content_types,
-                formatters: namespace_stackable_with_hash(:formatters),
-                parsers: namespace_stackable_with_hash(:parsers)
+                format:,
+                default_format: inheritable_setting.default_format || :txt,
+                content_types:,
+                formatters: inheritable_setting.formatters,
+                parsers: inheritable_setting.parsers
 
       builder = stack.build
       builder.run ->(env) { env[Grape::Env::API_ENDPOINT].run }
       builder.to_app
     end
 
+    def error_middleware_options(format, content_types)
+      setting = inheritable_setting
+      {
+        format:,
+        content_types:,
+        default_status: setting.default_error_status,
+        rescue_all: setting.rescue_all?,
+        rescue_grape_exceptions: setting.rescue_grape_exceptions?,
+        default_error_formatter: setting.default_error_formatter,
+        error_formatters: setting.error_formatters,
+        rescue_options: setting.rescue_options,
+        rescue_handlers: setting.rescue_handlers,
+        base_only_rescue_handlers: setting.base_only_rescue_handlers,
+        all_rescue_handler: setting.all_rescue_handler,
+        grape_exceptions_rescue_handler: setting.grape_exceptions_rescue_handler,
+        internal_grape_exceptions_rescue_handler: setting.internal_grape_exceptions_rescue_handler
+      }
+    end
+
     def build_helpers
-      helpers = namespace_stackable(:helpers)
+      helpers = inheritable_setting.helpers
       return if helpers.empty?
 
       Module.new { helpers.each { |mod_to_include| include mod_to_include } }
     end
 
+    # A bare Rack app mounted with +mount+ is called directly (see +compile!+):
+    # it does not go through +build_stack+, so the API's authentication
+    # middleware never runs and the mount is reachable unauthenticated. Mounted
+    # Grape APIs are unaffected because they rebuild their own stack from the
+    # inherited settings. Warn so this bypass isn't silent.
+    def warn_unauthenticated_mounted_app
+      return unless bare_rack_app?
+      return unless inheritable_setting.auth
+
+      warn "Grape: #{config.app} is mounted under an API that declares authentication, but authentication " \
+           'middleware does not wrap mounted Rack applications. Requests to this mount are not authenticated by Grape.'
+    end
+
     def build_response_cookies
+      return unless request.cookies?
+
       response_cookies do |name, value|
-        cookie_value = value.is_a?(Hash) ? value : { value: value }
+        cookie_value = value.is_a?(Hash) ? value : { value: }
         Rack::Utils.set_cookie_header! header, name, cookie_value
       end
     end
 
     def lint?
-      namespace_inheritable(:lint) || Grape.config.lint
+      inheritable_setting.lint? || Grape.config.lint
     end
   end
 end