grape 3.3.4 → 4.0.0

data/lib/grape/middleware/error.rb

@@ -13,8 +13,6 @@ module Grape
         :grape_exceptions_rescue_handler, :internal_grape_exceptions_rescue_handler,
         :rescue_all, :rescue_grape_exceptions, :rescue_handlers, :rescue_options
       ) do
-        include Grape::Middleware::DeprecatedOptionsHashAccess
-
         def initialize(
           all_rescue_handler: nil, base_only_rescue_handlers: nil, content_types: nil,
           default_error_formatter: nil, default_message: '', default_status: 500,
@@ -23,19 +21,23 @@ module Grape
           rescue_all: false, rescue_grape_exceptions: false, rescue_handlers: nil,
           rescue_options: nil
         )
-          # `rescue_options:` arrives nil from `Endpoint#error_middleware_options`
-          # when no `rescue_from` has been called — fall back to the documented
-          # defaults rather than letting nil propagate to `def_delegator
-          # :rescue_options, :backtrace`.
-          rescue_options ||= Grape::DSL::RescueOptions.new
-          super
+          # `rescue_options:` and `default_error_formatter:` arrive nil from
+          # `Endpoint#error_middleware_options` when the API called no
+          # `rescue_from` and no `format` — and an explicit nil bypasses the
+          # keyword defaults above, so restore them here rather than letting nil
+          # propagate to `def_delegator :rescue_options, :backtrace` or to the
+          # formatter lookup in `#format_message`.
+          super(
+            rescue_options: rescue_options || Grape::DSL::RescueOptions.new,
+            default_error_formatter: default_error_formatter || Grape::ErrorFormatter::Txt,
+            all_rescue_handler:, base_only_rescue_handlers:, content_types:,
+            default_message:, default_status:, error_formatters:, format:,
+            grape_exceptions_rescue_handler:, internal_grape_exceptions_rescue_handler:,
+            rescue_all:, rescue_grape_exceptions:, rescue_handlers:
+          )
         end
       end
 
-      # @deprecated Kept as a frozen Hash representation of the {Options}
-      #   defaults for back-compat. Will be removed in a future release.
-      DEFAULT_OPTIONS = Options.new.to_h.freeze
-
       def_delegators :config,
                      :all_rescue_handler, :base_only_rescue_handlers, :default_error_formatter,
                      :default_message, :default_status, :error_formatters, :format,
@@ -48,6 +50,13 @@ module Grape
       def_delegator :rescue_options, :backtrace, :include_backtrace
       def_delegator :rescue_options, :original_exception, :include_original_exception
 
+      # Emitted by {#render_failsafe_response} once even the framework's own message
+      # could not be rendered. Deliberately built without a formatter, an i18n
+      # lookup or anything else that could be the thing that is broken.
+      FAILSAFE_STATUS = 500
+      FAILSAFE_MESSAGE = '500 Internal Server Error'
+      FAILSAFE_CONTENT_TYPE = 'text/plain'
+
       def call!(env)
         @env = env
         error_response(catch(:error) { return @app.call(@env) })
@@ -58,8 +67,8 @@ module Grape
       private
 
       def rack_response(status, headers, message)
-        message = Rack::Utils.escape_html(message) if html_content_type?(headers[Rack::CONTENT_TYPE])
-        Rack::Response.new(Array.wrap(message), Rack::Utils.status_code(status), Grape::Util::Header.new.merge(headers))
+        body = html_content_type?(headers[Rack::CONTENT_TYPE]) ? Rack::Utils.escape_html(message) : message
+        Rack::Response.new(Array.wrap(body), Rack::Utils.status_code(status), Grape::Util::Header.new.merge!(headers))
       end
 
       # Escaping must key off the media type only, case-insensitively. Comparing
@@ -73,21 +82,25 @@ module Grape
         Grape::ContentTypes.media_type(content_type).to_s.casecmp?('text/html')
       end
 
+      # The registry answers nil for a format nothing is registered for, and
+      # the API's +default_error_formatter+ — +ErrorFormatter::Txt+ unless the
+      # API set another — takes it from there, so this always has something
+      # callable. The +throw :error, 406+ that used to stand in for a missing
+      # formatter could not work anyway: nothing catches +:error+ around this
+      # call (+#call!+ has left its +catch+ by the time +error_response+ runs),
+      # so it raised +UncaughtThrowError+ and the request answered with the
+      # failsafe 500 rather than the 406 it named.
       def format_message(error)
         current_format = env[Grape::Env::API_FORMAT] || format
-        formatter = Grape::ErrorFormatter.formatter_for(current_format, error_formatters, default_error_formatter)
-        return formatter.call(error:, env:, include_backtrace:, include_original_exception:) if formatter
-
-        throw :error, Grape::Exceptions::ErrorResponse.new(
-          status: 406,
-          message: "The requested format '#{current_format}' is not supported.",
-          backtrace: error.backtrace,
-          original_exception: error.original_exception
-        )
+        formatter = Grape::ErrorFormatter.formatter_for(current_format, error_formatters) || default_error_formatter
+        formatter.call(error:, env:, include_backtrace:, include_original_exception:)
       end
 
       def find_handler(klass)
-        registered_rescue_handler(klass) ||
+        registered_entry = registered_rescue_handler_entry(klass)
+
+        grape_exceptions_precedence_handler(klass, registered_entry) ||
+          registered_entry&.last ||
           rescue_handler_for_grape_exception(klass) ||
           rescue_handler_for_any_class(klass) ||
           raise
@@ -101,10 +114,82 @@ module Grape
           status: raw.status || default_status,
           message: raw.message || default_message,
           headers:,
-          backtrace: raw.backtrace || raw.original_exception&.backtrace || []
+          backtrace: resolved_backtrace(raw)
         )
         env[Grape::Env::API_ENDPOINT].status(payload.status) # error! may not have been called
+        render_response(payload)
+      end
+
+      # The backtrace an error formatter is handed. Assembled only when the API
+      # asked for one with `rescue_from ..., backtrace: true`: reading it off
+      # the exception is not free — +Exception#backtrace+ builds the whole Array
+      # of location strings — and every built-in formatter drops it otherwise.
+      # A formatter that wants one regardless still has +original_exception+.
+      def resolved_backtrace(raw)
+        return [] unless include_backtrace
+
+        raw.backtrace || raw.original_exception&.backtrace || []
+      end
+
+      # Rendering runs inside #call!'s own rescue clause, so it is not covered by
+      # that rescue: an error formatter that raises on the payload it was handed
+      # takes the exception out through every middleware above Grape. By this
+      # point Grape has committed to answering with an error, so it answers with
+      # one that does not depend on the payload rather than dropping the request.
+      #
+      # +Grape.config.raise_rendering_errors+ opts back out, for an application
+      # that would rather have the exception propagate as it did before.
+      def render_response(payload)
         rack_response(payload.status, payload.headers, format_message(payload))
+      rescue StandardError => e
+        raise if Grape.config.raise_rendering_errors
+
+        record_rendering_failure(e)
+        render_failsafe_response
+      end
+
+      # The exception is published on the rack env (see {#expose_exception}) and
+      # written to +rack.errors+ so it reaches the log with no tracker installed.
+      # Rails writes to $stderr from its failsafe branch for the same reason:
+      # deferring the logging to the application is not an option when the
+      # application's own error rendering is what broke.
+      def record_rendering_failure(error)
+        expose_exception(error)
+        env[Rack::RACK_ERRORS]&.write("Grape could not render the error response: #{error.class}: #{error.message}\n")
+      end
+
+      # First retry the API's own format with the framework's InternalServerError,
+      # whose message is a static string and so cannot be what defeated the first
+      # attempt. Should even that fail — a wholesale broken formatter, rather than
+      # one payload it choked on — drop the formatter entirely. Both attempts call
+      # {#format_message} directly rather than re-entering {#error_response}, so
+      # this path cannot recurse.
+      def render_failsafe_response
+        headers = { Rack::CONTENT_TYPE => content_type }
+        rack_response(FAILSAFE_STATUS, headers, format_message(failsafe_payload(headers)))
+      rescue StandardError
+        rack_response(FAILSAFE_STATUS, { Rack::CONTENT_TYPE => FAILSAFE_CONTENT_TYPE }, FAILSAFE_MESSAGE)
+      end
+
+      # Publish an exception Grape swallowed, on both keys. +grape.exception+ is
+      # Grape's own and has been set on these paths all along; +rack.exception+ is
+      # what the ecosystem actually reads to find an exception that never
+      # propagated — sentry-ruby collects +env['rack.exception'] ||
+      # env['sinatra.error']+ — so a tracker mounted above Grape keeps reporting
+      # these with no application change.
+      def expose_exception(error)
+        env[Grape::Env::GRAPE_EXCEPTION] = error
+        env[Grape::Env::RACK_EXCEPTION] = error
+      end
+
+      def failsafe_payload(headers)
+        Grape::Exceptions::ErrorResponse.new(
+          status: FAILSAFE_STATUS,
+          message: Grape::Exceptions::InternalServerError.new.message,
+          headers:,
+          backtrace: [],
+          original_exception: nil
+        )
       end
 
       def default_rescue_handler(exception)
@@ -118,16 +203,51 @@ module Grape
       end
 
       def registered_rescue_handler(klass)
-        rescue_handler_from(base_only_rescue_handlers) { |err| klass == err } ||
-          rescue_handler_from(rescue_handlers) { |err| klass <= err }
+        registered_rescue_handler_entry(klass)&.last
       end
 
-      def rescue_handler_from(handlers)
+      # The matched entry rather than just its handler, so callers can tell
+      # *which* class matched — see {#grape_exceptions_precedence_handler}.
+      # @return [Array(Class, #call), nil]
+      def registered_rescue_handler_entry(klass)
+        rescue_handler_entry_from(base_only_rescue_handlers) { |err| klass == err } ||
+          rescue_handler_entry_from(rescue_handlers) { |err| klass <= err }
+      end
+
+      def rescue_handler_entry_from(handlers)
         error, handler = handlers&.find { |err, _handler| yield(err) }
 
         return unless error
 
-        handler || method(:default_rescue_handler)
+        [error, handler || method(:default_rescue_handler)]
+      end
+
+      # +rescue_from :grape_exceptions+ is an opt-in to keep Grape's own errors
+      # rendering with their own status — a validation failure stays a 400
+      # instead of becoming whatever the app's catch-all returns.
+      #
+      # It only ever worked against +rescue_from :all+, which lives in
+      # +all_rescue_handler+ and is consulted last. Spelled as a class instead,
+      # +rescue_from StandardError+ is a *registered* handler, matched first,
+      # and Grape's exceptions are StandardErrors — so the opt-in silently did
+      # nothing and validation errors came back as 500s either way.
+      #
+      # Let it win over a handler that only matched through a non-Grape
+      # ancestor. One registered for a Grape exception class is more specific
+      # than the opt-in and still wins, so an explicit
+      # +rescue_from Grape::Exceptions::ValidationErrors+ keeps its handler.
+      #
+      # InvalidVersionHeader is left alone: it must keep reaching Rack so the
+      # next versioned route is tried.
+      def grape_exceptions_precedence_handler(klass, registered_entry)
+        return unless rescue_grape_exceptions
+        return unless klass <= Grape::Exceptions::Base
+        return if klass == Grape::Exceptions::InvalidVersionHeader
+
+        matched, = registered_entry
+        return if matched.nil? || matched <= Grape::Exceptions::Base
+
+        grape_exceptions_rescue_handler || method(:error_response)
       end
 
       def rescue_handler_for_grape_exception(klass)
@@ -146,9 +266,9 @@ module Grape
       end
 
       def run_rescue_handler(handler, error, endpoint, redispatched: false)
-        handler = endpoint.public_method(handler) if handler.is_a?(Symbol)
+        callable = handler.is_a?(Symbol) ? endpoint.public_method(handler) : handler
         response = catch(:error) do
-          handler.arity.zero? ? endpoint.instance_exec(&handler) : endpoint.instance_exec(error, &handler)
+          callable.arity.zero? ? endpoint.instance_exec(&callable) : endpoint.instance_exec(error, &callable)
         rescue StandardError => e
           return redispatch(e, endpoint, redispatched)
         end
@@ -191,7 +311,7 @@ module Grape
       # message. The framework deliberately does no logging of its own
       # here; that's the application's call.
       def safe_default(error, endpoint)
-        env[Grape::Env::GRAPE_EXCEPTION] = error
+        expose_exception(error)
         return run_rescue_handler(internal_grape_exceptions_rescue_handler, error, endpoint, redispatched: true) if internal_grape_exceptions_rescue_handler
 
         framework_default(endpoint)
@@ -211,20 +331,7 @@ module Grape
       end
 
       def error?(response)
-        case response
-        when Grape::Exceptions::ErrorResponse
-          true
-        when Hash
-          return false unless response.key?(:message) && response.key?(:status) && response.key?(:headers)
-
-          Grape.deprecator.warn(
-            'Returning or throwing a Hash from a rescue handler is deprecated. ' \
-            'Use `error!(...)` or a `Grape::Exceptions::ErrorResponse` instead.'
-          )
-          true
-        else
-          false
-        end
+        response.is_a?(Grape::Exceptions::ErrorResponse)
       end
     end
   end

data/lib/grape/middleware/formatter.rb

@@ -3,24 +3,40 @@
 module Grape
   module Middleware
     class Formatter < Base
-      extend Forwardable
       include PrecomputedContentTypes
 
       Options = Data.define(:content_types, :default_format, :format, :formatters, :parsers) do
-        include Grape::Middleware::DeprecatedOptionsHashAccess
-
         def initialize(content_types: nil, default_format: :txt, format: nil, formatters: nil, parsers: nil)
           super
         end
       end
 
-      # @deprecated Kept as a frozen Hash representation of the {Options}
-      #   defaults for back-compat. Will be removed in a future release.
-      DEFAULT_OPTIONS = Options.new.to_h.freeze
-
       ALL_MEDIA_TYPES = '*/*'
 
-      def_delegators :config, :default_format, :format, :formatters, :parsers
+      # The request methods that can carry a body worth parsing. See
+      # {#read_body_input?}, which tests the env against this before anything
+      # asks for a Rack::Request. QUERY is here because its content *is* the
+      # query (RFC 10008, Section 2), not an optional payload.
+      BODY_CARRYING_METHODS = [Rack::POST, Rack::PUT, Rack::PATCH, Rack::DELETE, Grape::QUERY].freeze
+
+      # Read off ivars rather than delegated into +config+ on every request:
+      # +negotiate_content_type+ asks for +format+ and +default_format+ per
+      # request and +fetch_formatter+ for +formatters+, and each delegator cost
+      # a Forwardable frame plus a Data reader for a value that was frozen when
+      # the middleware was built.
+      attr_reader :default_format, :format, :formatters, :parsers
+
+      # The formatter is the only middleware that maps an incoming media type
+      # back to a format, so it warms +mime_types+ itself rather than making
+      # every content-type-aware middleware build a table none of them read.
+      def initialize(app, **options)
+        super
+        @default_format = config.default_format
+        @format = config.format
+        @formatters = config.formatters
+        @parsers = config.parsers
+        mime_types
+      end
 
       def before
         negotiate_content_type
@@ -40,7 +56,7 @@ module Grape
       private
 
       def build_formatted_response(status, headers, bodies)
-        headers = ensure_content_type(headers)
+        ensure_content_type!(headers)
 
         if bodies.is_a?(Grape::ServeStream::StreamResponse)
           Grape::ServeStream::SendfileResponse.new([], status, headers) do |resp|
@@ -52,7 +68,13 @@ module Grape
           bodymap = instrument_format_response(formatter) do
             bodies.map { |body| formatter.call(body, env) }
           end
-          Rack::Response.new(bodymap, status, headers)
+          # A bare Rack tuple rather than a Rack::Response: +headers+ is already
+          # a Grape::Util::Header (a Rack::Headers on Rack 3), so wrapping only
+          # re-normalizes the same keys into a second Headers hash that
+          # +Middleware::Base#call+ unwraps again with +to_a+ on the way out.
+          # The 204/304 bodies Rack::Response#finish would blank are returned
+          # above, before this point.
+          [status, headers, bodymap]
         end
       rescue Grape::Exceptions::InvalidFormatter => e
         throw :error, Grape::Exceptions::ErrorResponse.new(status: 500, message: e.message, backtrace: e.backtrace, original_exception: e)
@@ -74,19 +96,23 @@ module Grape
 
       # Set the content type header for the API format if it is not already present.
       #
-      # @param headers [Hash]
-      # @return [Hash]
-      def ensure_content_type(headers)
-        return headers if headers[Rack::CONTENT_TYPE]
+      # Written into +headers+ rather than returned as a copy, hence the +!+:
+      # this runs on every response, and copying the hash costs an allocation
+      # per request for a header the caller is about to send anyway.
+      #
+      # @param headers [Hash] the response headers, mutated in place
+      # @return [void]
+      def ensure_content_type!(headers)
+        return if headers[Rack::CONTENT_TYPE]
 
         headers[Rack::CONTENT_TYPE] = content_type_for(env[Grape::Env::API_FORMAT])
-        headers
       end
 
       def read_body_input
+        return unless read_body_input?
+
         input = rack_request.body # reads RACK_INPUT
         return if input.nil?
-        return unless read_body_input?
 
         rewind = input.respond_to?(:rewind)
 
@@ -103,6 +129,13 @@ module Grape
         return if body.empty?
 
         media_type = rack_request.media_type
+
+        # RFC 10008, Sections 2 and 2.1: a QUERY carries its query in the
+        # content, so a request that never says what that content is cannot be
+        # interpreted and must fail rather than be read as the default format.
+        # Every other method keeps that fallback.
+        throw :error, Grape::Exceptions::ErrorResponse.new(status: 400, message: 'The QUERY method requires a content-type.') if media_type.nil? && env[Rack::REQUEST_METHOD] == Grape::QUERY
+
         fmt = media_type ? mime_types[media_type] : default_format
 
         throw :error, Grape::Exceptions::ErrorResponse.new(status: 415, message: "The provided content-type '#{media_type}' is not supported.") unless content_type_for(fmt)
@@ -110,12 +143,12 @@ module Grape
         return env[Grape::Env::API_REQUEST_BODY] = body unless parser
 
         begin
-          body = (env[Grape::Env::API_REQUEST_BODY] = parser.call(body, env))
-          if body.is_a?(Hash)
+          parsed = (env[Grape::Env::API_REQUEST_BODY] = parser.call(body, env))
+          if parsed.is_a?(Hash)
             if (form_hash = env[Rack::RACK_REQUEST_FORM_HASH])
-              form_hash.merge!(body)
+              form_hash.merge!(parsed)
             else
-              env[Rack::RACK_REQUEST_FORM_HASH] = body
+              env[Rack::RACK_REQUEST_FORM_HASH] = parsed
             end
             env[Rack::RACK_REQUEST_FORM_INPUT] = env[Rack::RACK_INPUT]
           end
@@ -133,34 +166,70 @@ module Grape
       # - multipart/related
       # - multipart/mixed
       def read_body_input?
-        return false unless rack_request.post? || rack_request.put? || rack_request.patch? || rack_request.delete?
+        # Read off the env rather than through Rack::Request's predicates: this
+        # is what decides the question for every request, and on the GET, HEAD
+        # and OPTIONS majority it is the only thing the formatter would have
+        # built a Rack::Request for.
+        return false unless BODY_CARRYING_METHODS.include?(env[Rack::REQUEST_METHOD])
         return false if rack_request.form_data? && rack_request.content_type
         return false if rack_request.parseable_data?
 
-        rack_request.content_length.to_i.positive? || rack_request.env['HTTP_TRANSFER_ENCODING'] == 'chunked'
+        rack_request.content_length.to_i.positive? || env['HTTP_TRANSFER_ENCODING'] == 'chunked'
       end
 
       def negotiate_content_type
-        fmt = format_from_extension || query_params['format'] || format || format_from_header || default_format
+        fmt = format_from_extension || format_from_query || format || format_from_header || default_format
         return env[Grape::Env::API_FORMAT] = fmt.to_sym if content_type_for(fmt)
 
         throw :error, Grape::Exceptions::ErrorResponse.new(status: 406, message: "The requested format '#{fmt}' is not supported.")
       end
 
+      # Only the extension is scrubbed, and only once the path turns out to have
+      # one: +String#rindex+ takes a byte offset and never raises on an invalid
+      # sequence, and a +.+ byte cannot be part of a multi-byte one, so the dot
+      # sits at the same place before and after scrubbing. The overwhelming
+      # majority of paths carry no extension and now skip the scrub entirely.
       def format_from_extension
-        request_path = try_scrub(rack_request.path)
+        request_path = path_for_extension
         dot_pos = request_path.rindex('.')
         return unless dot_pos
 
-        extension = request_path[(dot_pos + 1)..]
+        extension = try_scrub(request_path[(dot_pos + 1)..])
         extension if content_type_for(extension)
       end
 
+      # The extension is the tail of the request path, so PATH_INFO answers it
+      # on its own whenever there is one: a dot in SCRIPT_NAME is followed by
+      # the slash that opens PATH_INFO, and no registered extension holds a
+      # slash. Only an empty PATH_INFO needs +Rack::Request#path+ — and with it
+      # the String its concatenation allocates. Tested with +empty?+ rather
+      # than +blank?+: the path is not scrubbed yet, and a regexp match on an
+      # invalid byte sequence raises.
+      def path_for_extension
+        path_info = env[Rack::PATH_INFO]
+        return rack_request.path if path_info.nil? || path_info.empty?
+
+        path_info
+      end
+
+      # +?format=+ can only be there when there is a query string at all, so
+      # the common query-less request skips parsing one.
+      def format_from_query
+        query_string = env[Rack::QUERY_STRING]
+        return if query_string.nil? || query_string.empty?
+
+        query_params['format']
+      end
+
+      # Media types are case-insensitive (RFC 9110 §8.3.1) but the registered
+      # ones are spelled in lower case and Rack matches them literally, so an
+      # `Accept: TEXT/PLAIN` found nothing and fell through to the default
+      # format — the client quietly got something other than what it asked for.
       def format_from_header
         accept_header = try_scrub(env['HTTP_ACCEPT'])
         return if accept_header.blank? || accept_header == ALL_MEDIA_TYPES
 
-        media_type = Rack::Utils.best_q_match(accept_header, mime_types.keys)
+        media_type = Rack::Utils.best_q_match(accept_header.downcase, mime_types.keys)
         mime_types[media_type] if media_type
       end
     end

data/lib/grape/middleware/precomputed_content_types.rb

@@ -7,8 +7,14 @@ module Grape
     # +content_type+ resolved from +config.content_types+ and
     # +config.format+ — so the consuming middleware's +Options+ Data class
     # must declare both fields. Warms those caches on the parent instance
-    # at initialization so per-request +dup+s inherit them (avoiding
-    # ~1 µs/request of +with_indifferent_access+ recomputation).
+    # at initialization so per-request +dup+s inherit them rather than
+    # rebuilding them.
+    #
+    # +mime_types+ is not warmed here: Formatter is the only middleware that
+    # reads it, and it warms it itself. The tables behind +mime_types+ and
+    # +content_type_for+ are shared process-wide per content-type registry
+    # (see Grape::ContentTypes), so the ivars below memoize a lookup, not a
+    # copy.
     #
     # Opt-in: plain +Grape::Middleware::Base+ subclasses that don't need
     # content-type-aware helpers don't pay for them.
@@ -16,8 +22,7 @@ module Grape
       def initialize(app, **options)
         super
         content_types
-        mime_types
-        content_types_indifferent_access
+        content_types_lookup
       end
 
       def content_types
@@ -29,7 +34,7 @@ module Grape
       end
 
       def content_type_for(format)
-        content_types_indifferent_access[format]
+        content_types_lookup[format]
       end
 
       def content_type
@@ -38,8 +43,8 @@ module Grape
 
       private
 
-      def content_types_indifferent_access
-        @content_types_indifferent_access ||= ActiveSupport::HashWithIndifferentAccess.new(content_types)
+      def content_types_lookup
+        @content_types_lookup ||= Grape::ContentTypes.lookup_for(content_types)
       end
     end
   end

data/lib/grape/middleware/stack.rb

@@ -30,6 +30,15 @@ module Grape
         end
         alias eql? ==
 
+        # Keyed on the wrapped class, so two Middleware wrapping the same
+        # class hash alike — and so does the class itself, which #== also
+        # accepts. The superclass fallback above can't be honoured here (a
+        # class and its superclass hash differently); it only ever serves
+        # #index / #include?, which compare with #== rather than by hash.
+        def hash
+          klass.hash
+        end
+
         def inspect
           klass.to_s
         end
@@ -55,15 +64,15 @@ module Grape
       end
 
       def insert(index, klass, *args, &block)
-        index = assert_index(index, :before)
-        middlewares.insert(index, self.class::Middleware.new(klass, args, block))
+        at = assert_index(index, :before)
+        middlewares.insert(at, self.class::Middleware.new(klass, args, block))
       end
 
       alias insert_before insert
 
       def insert_after(index, ...)
-        index = assert_index(index, :after)
-        insert(index + 1, ...)
+        at = assert_index(index, :after)
+        insert(at + 1, ...)
       end
 
       def use(klass, *args, &block)

data/lib/grape/middleware/versioner/base.rb

@@ -8,22 +8,16 @@ module Grape
         include Grape::Middleware::PrecomputedContentTypes
 
         Options = Data.define(
-          :content_types, :format, :mount_path, :pattern, :prefix, :version_options, :versions
+          :content_types, :format, :mount_path, :prefix, :version_options, :versions
         ) do
-          include Grape::Middleware::DeprecatedOptionsHashAccess
-
           def initialize(
-            content_types: nil, format: nil, mount_path: nil, pattern: /.*/i, prefix: nil,
+            content_types: nil, format: nil, mount_path: nil, prefix: nil,
             version_options: Grape::DSL::VersionOptions.new, versions: nil
           )
             super
           end
         end
 
-        # @deprecated Kept as a frozen Hash representation of the {Options}
-        #   defaults for back-compat. Will be removed in a future release.
-        DEFAULT_OPTIONS = Options.new.to_h.freeze
-
         CASCADE_PASS_HEADER = { 'X-Cascade' => 'pass' }.freeze
 
         def self.inherited(klass)
@@ -33,7 +27,7 @@ module Grape
 
         attr_reader :available_media_types, :error_headers, :versions
 
-        def_delegators :config, :mount_path, :pattern, :prefix, :version_options
+        def_delegators :config, :mount_path, :prefix, :version_options
         def_delegators :version_options, :cascade, :parameter, :strict, :vendor
 
         def initialize(app, **options)