grape 4.0.1 → 4.1.0

data/lib/grape/router/route_buckets.rb

@@ -0,0 +1,246 @@
+# frozen_string_literal: true
+
+module Grape
+  class Router
+    # Narrows the routes a request is matched against to the ones that can
+    # match its path, by one literal path segment.
+    #
+    # A route that spells out a literal at segment +k+ of its path -- with
+    # every segment ahead of it a literal or a lone +:param+ that cannot span
+    # a '/', and no '/' after it that its pattern makes optional -- matches
+    # only paths whose segment +k+ is that literal. Grouping
+    # the routes by it, and keeping every route that cannot be grouped in each
+    # group, gives each group the routes that could match a path with that
+    # segment, still in registration order, so the first of them to match is
+    # the route the full union would have picked.
+    #
+    # Mustermann lets a literal character match its percent-encoding, and a
+    # route's pattern ends in \Z, which also matches before a trailing
+    # newline, so a path holding either is left to the full union.
+    #
+    # For example, a method with these routes, in registration order:
+    #
+    #   /users  /users/:id  /users/:id/posts  /posts  /posts/:id
+    #   /comments/:id  /tags/:name  /:slug
+    #
+    # is split by segment 1, which names every route but +/:slug+:
+    #
+    #   "users"    => /users, /users/:id, /users/:id/posts, /:slug
+    #   "posts"    => /posts, /posts/:id, /:slug
+    #   "comments" => /comments/:id, /:slug
+    #   "tags"     => /tags/:name, /:slug
+    #   fallback   => /:slug
+    #
+    # A request for +/users/42+ is matched against the four routes under
+    # "users" instead of all eight, +/about+ names no bucket and is matched
+    # against the fallback, and +/users%2F42+ goes to the full union.
+    class RouteBuckets
+      # The routes one segment value can reach, with the number each one's
+      # group has in +union+: a route sits in several buckets, at a different
+      # position in each, so the numbers cannot be kept on the route.
+      class Bucket
+        def initialize(union, routes, groups, captures)
+          @union = union
+          @routes = routes
+          @groups = groups
+          @captures = captures
+          freeze
+        end
+
+        # Yields the route +input+ matched, the match, and that route's
+        # captures numbered for this union -- nil when a match cannot stand in
+        # for what Mustermann returns. Yields nothing when no route here
+        # matches.
+        def match(input)
+          @union&.match(input) do |m|
+            index = @groups.index { |group| m[group] }
+            yield(@routes[index], m, @captures[index])
+          end
+        end
+      end
+
+      NONE = Bucket.new(nil, [].freeze, [].freeze, [].freeze)
+      FULL_UNION_INPUT = /[%\n]/
+      # A segment ahead of the key: plain characters, or one +:param+.
+      LITERAL_SEGMENT = /\A[^:*?(){}|\\%]+\z/
+      CAPTURE_SEGMENT = /\A:(\w+)\z/
+      # The key itself is compared with a slice of the path cut at the first
+      # '.', so it holds no '.', and nothing a path could spell differently.
+      KEY_SEGMENT = /\A[^:*?(){}|\\%.+\s]+\z/
+      # Below this many routes the full union is already cheap to walk, and
+      # the extra unions would only lengthen boot.
+      MINIMUM_ROUTES = 8
+      private_constant :Bucket, :NONE, :FULL_UNION_INPUT, :LITERAL_SEGMENT, :CAPTURE_SEGMENT, :KEY_SEGMENT, :MINIMUM_ROUTES
+
+      class << self
+        # Buckets for +routes+ (with +regexps+, their union alternatives), or
+        # nil when no segment splits them well enough to be worth the unions.
+        # +unions+ is shared by a router's methods, so a bucket whose
+        # alternatives another method already compiled -- the HEAD routes
+        # mirroring GET's -- reuses that union.
+        #
+        # Every segment position is tried, and the one leaving the fewest
+        # routes to match wins. For the routes in the class example:
+        #
+        #   position 1: users x3, posts x2, comments, tags, nil  cost 1 + 3 = 4
+        #   position 2: nil for all eight                        cost 8
+        #   position 3: posts for /users/:id/posts, nil for 7    cost 7 + 1 = 8
+        #
+        # Position 1 wins, and a cost of 4 is within half of the 8 routes, so
+        # the buckets are built; at 5 they would not be.
+        def build(routes, regexps, unions)
+          return if routes.size < MINIMUM_ROUTES
+
+          position, keys = cheapest_position(routes)
+          return unless position && cost(keys) <= routes.size / 2
+
+          new(position, routes, regexps, keys, unions)
+        end
+
+        private
+
+        # The segment position leaving the fewest +routes+ to match, and the
+        # key of each route at it; nil when no route has a segment past the
+        # first.
+        def cheapest_position(routes)
+          keys_by_position = route_keys_by_position(routes)
+          candidates = (1...keys_by_position.size).map { |position| [position, keys_by_position[position]] }
+          candidates.min_by { |_, route_keys| cost(route_keys) }
+        end
+
+        # The key of each of +routes+ at every segment position, as far as
+        # the deepest of them goes (see #fill_keys).
+        def route_keys_by_position(routes)
+          segments = routes.map { |route| route.origin.split('/') }
+          keys_by_position = Array.new(segments.map(&:size).max) { Array.new(routes.size) }
+          routes.each_with_index { |route, index| fill_keys(keys_by_position, index, route, segments[index]) }
+          keys_by_position
+        end
+
+        # Writes into +keys_by_position+, at +index+, the literal +route+
+        # requires at each segment position, leaving nil where that segment
+        # cannot tell it apart. One walk over +segments+: a segment that does
+        # not span exactly one path segment ends it, as no position past that
+        # segment can tell the route apart either.
+        def fill_keys(keys_by_position, index, route, segments)
+          last = segments.size - 1
+          run_on = run_on_position(route, last)
+          position = 1
+          while position <= last
+            segment = segments[position]
+            keys_by_position[position][index] = segment if position != run_on && key?(segment)
+            return unless single_segment?(route, segment)
+
+            position += 1
+          end
+        end
+
+        def key?(segment)
+          segment.match?(KEY_SEGMENT) && segment.ascii_only?
+        end
+
+        # The position of the segment a path can run on from without a '/', or
+        # nil. Pattern#build_path_from_pattern makes the '/' ahead of a
+        # trailing +*path+ optional, and follows an unanchored route's last
+        # segment with '/?*path', so either segment can be the start of a
+        # longer one in the path.
+        def run_on_position(route, last)
+          return last - 1 if route.origin.end_with?('*path')
+
+          last unless route.anchor
+        end
+
+        def single_segment?(route, segment)
+          return true if segment.match?(LITERAL_SEGMENT)
+
+          name = segment[CAPTURE_SEGMENT, 1]
+          return false unless name
+          return Array(route.version).none? { |version| version.to_s.include?('/') } if name == 'version'
+
+          requirements = route.requirements
+          !(requirements && (requirements.key?(name.to_sym) || requirements.key?(name)))
+        end
+
+        # The most routes one request can still be matched against.
+        def cost(keys)
+          keys.count(nil) + (keys.compact.tally.values.max || 0)
+        end
+      end
+
+      def initialize(position, routes, regexps, keys, unions)
+        @position = position
+        ungrouped, grouped = split_indices(keys)
+        # Every bucket holds the routes no segment tells apart, so none can be
+        # built before the whole of +ungrouped+ is known.
+        grouped.transform_values! { |indices| bucket(routes, regexps, (indices + ungrouped).sort!, unions) }
+        @buckets = grouped.freeze
+        @fallback = ungrouped.empty? ? NONE : bucket(routes, regexps, ungrouped, unions)
+        freeze
+      end
+
+      # The bucket for +input+, or nil when it has to go through the full union.
+      # With the class example's buckets:
+      #
+      #   /users/42, /users.json, /users/42.json  => "users"
+      #   /about, /                                => the fallback
+      #   /users%2F42, "/users\n"                  => nil
+      def bucket_for(input)
+        return if input.match?(FULL_UNION_INPUT)
+
+        key = segment_key(input)
+        (key && @buckets[key]) || @fallback
+      end
+
+      private
+
+      # The indices of the routes no key names, and the indices each key does
+      # name, in one pass over +keys+ -- +keys[n]+ being the key of the route
+      # at +n+, or nil when no segment tells that route apart.
+      def split_indices(keys)
+        ungrouped = []
+        grouped = {}
+        keys.each_with_index do |key, index|
+          next ungrouped << index if key.nil?
+
+          (grouped[key] ||= []) << index
+        end
+        [ungrouped, grouped]
+      end
+
+      def bucket(routes, regexps, indices, unions)
+        alternatives = regexps.values_at(*indices).freeze
+        members = routes.values_at(*indices).freeze
+        union, groups = unions[alternatives] ||= compile_union(alternatives, members)
+        # A member sits at a different group here than it does in the router's
+        # union, which is what its own captures are numbered for.
+        captures = members.map.with_index { |route, index| route.union_captures_at(groups[index]) }.freeze
+        Bucket.new(union, members, groups, captures)
+      end
+
+      # The union of +alternatives+ and the group each of +members+ has in it.
+      # Each alternative names its group after its route's position, so equal
+      # alternatives spell out the same union with the same groups, whichever
+      # method's routes they came from.
+      def compile_union(alternatives, members)
+        union = Regexp.union(alternatives)
+        named_captures = union.named_captures
+        [union, members.map { |route| named_captures.fetch(route.regexp_capture_index).first }.freeze].freeze
+      end
+
+      # Segment +@position+ of +input+, cut at its first '.'.
+      def segment_key(input)
+        start = 0
+        @position.times do
+          start = input.index('/', start)
+          return unless start
+
+          start += 1
+        end
+        stop = input.index('/', start) || input.length
+        dot = input.index('.', start)
+        stop = dot if dot && dot < stop
+        input[start, stop - start]
+      end
+    end
+  end
+end

data/lib/grape/router.rb

@@ -6,30 +6,29 @@ module Grape
       @neutral_map = []
       @neutral_regexes = []
       # Plain hashes with no auto-vivifying default: a lookup for an HTTP method
-      # that has no routes must not insert a key. `compile!` freezes both maps,
+      # that has no routes must not insert a key. `compile!` freezes them all,
       # so request-time reads never mutate shared state (see #match? / #rotation).
       @map = {}
       @optimized_map = {}
+      # Per HTTP method, the greedy routes still worth trying once that method's
+      # own routes have missed a path (see #compile_neighbour_map).
+      @neighbour_map = {}
     end
 
     def compile!
       return if @compiled
 
       @union = resolve_capture_groups(Regexp.union(@neutral_regexes), @neutral_map)
+      compile_optimized_map
+      compile_neighbour_map
       @neutral_regexes = nil
-      # Compiled from the routes actually registered rather than from
-      # Grape::HTTP_SUPPORTED_METHODS. A route declared with any other verb
-      # (`route :purge, '/cache'`) is accepted at definition time and is
-      # already collected into the resource's Allow header, so skipping it here
-      # left it in @map but out of @optimized_map — the only map #match? reads.
-      # The resource then advertised a method that could never be matched and
-      # answered every request for it with 405.
-      @map.each do |method, routes|
-        optimized_map = routes.map.with_index { |route, index| route.to_regexp(index) }
-        @optimized_map[method] = resolve_capture_groups(Regexp.union(optimized_map), routes)
-      end
       @map.freeze
       @optimized_map.freeze
+      @neighbour_map.freeze
+      # A route whose path holds a non-ASCII literal compiles to a UTF-8
+      # regexp, which raises when matched against a binary string holding
+      # non-ASCII bytes (see #utf8_path).
+      @utf8_patterns = @union.fixed_encoding? || @optimized_map.each_value.any? { |union, _| union.fixed_encoding? }
       @compiled = true
     end
 
@@ -43,17 +42,28 @@ module Grape
     end
 
     def call(env)
+      request_method = env[Rack::REQUEST_METHOD]
       with_optimization do
+        input = Grape::Util::PathNormalizer.call(env[Rack::PATH_INFO])
+        if @utf8_patterns && !input.ascii_only?
+          input = utf8_path(input)
+          next unless input
+        end
+
         # Published on the env so the middleware the matched route runs -- the
         # path versioner above all -- reads the path this routed on instead of
         # normalizing PATH_INFO a second time.
-        input = env[Grape::Env::GRAPE_NORMALIZED_PATH] = Grape::Util::PathNormalizer.call(env[Rack::PATH_INFO])
-        transaction(input, env[Rack::REQUEST_METHOD], env)
+        env[Grape::Env::GRAPE_NORMALIZED_PATH] = input
+        transaction(input, request_method, env)
       end
     end
 
     def recognize_path(input)
-      any = with_optimization { greedy_match?(input) }
+      any = with_optimization do
+        input = utf8_path(input) if @utf8_patterns && !input.ascii_only?
+        # A path that is not valid UTF-8 comes back nil and matches nothing.
+        greedy_match?(input)
+      end
       return if any == default_response
 
       any.endpoint
@@ -64,20 +74,74 @@ module Grape
 
     private
 
+    # +path+ tagged UTF-8 when its bytes are UTF-8, or nil when they are not.
+    #
+    # Rack hands PATH_INFO over binary, and a binary string holding non-ASCII
+    # bytes raises Encoding::CompatibilityError when matched against a UTF-8
+    # regexp -- so once one route held a non-ASCII literal (`/café/:id`),
+    # every path carrying raw non-ASCII bytes raised, whichever route it was
+    # meant for. Tagged UTF-8, such a path routes the way its percent-encoded
+    # spelling does. Bytes that are not UTF-8 cannot be matched against these
+    # routes at all, so the router answers them as a path nothing matched.
+    #
+    # A copy, so PATH_INFO itself stays binary as Rack requires.
+    def utf8_path(path)
+      utf8 = String.new(path, encoding: Encoding::UTF_8)
+      utf8 if utf8.valid_encoding?
+    end
+
     # Resolve +input+ against the compiled routes, in priority order:
     #
     # 1. the routes registered for +method+ — the compiled-union match first,
     #    then, when that route cascades, its siblings (see #rotation);
     # 2. the ANY (+'*'+) routes;
-    # 3. the greedy neighbour, which answers auto-OPTIONS and 405.
+    # 3. the greedy neighbour, which answers 405 — and auto-OPTIONS, ahead of
+    #    the ANY routes.
     #
     # Returns nil when nothing answered, leaving the caller to 404. A response
     # that cascades is never final: it is returned only once every later
     # candidate has declined too, so the caller (or a mounting app upstream)
     # can keep looking.
     def transaction(input, method, env)
-      exact_route = match?(input, method)
-      response = process_route(exact_route, input, env) if exact_route
+      union, routes, buckets, static_routes = @optimized_map[method]
+      if (static = static_routes&.[](input))
+        exact_route, captures = static
+        settle(input, method, env, process_static_route(exact_route, captures, env), exact_route)
+      elsif (bucket = buckets&.bucket_for(input))
+        bucket_transaction(bucket, input, method, env)
+      else
+        union_transaction(union, routes, input, method, env)
+      end
+    end
+
+    # #transaction for a path a bucket narrowed the routes for. A bucket
+    # numbers its groups its own way, so it hands over the captures numbered
+    # for its own union along with the match.
+    def bucket_transaction(bucket, input, method, env)
+      exact_route = nil
+      response = bucket.match(input) do |route, m, captures|
+        exact_route = route
+        process_route(route, input, env, m, captures)
+      end
+      settle(input, method, env, response, exact_route)
+    end
+
+    # #transaction for a path matched against all the routes for +method+.
+    # Matched here rather than through #match? so the MatchData survives: the
+    # route's path captures are groups of it (see Route#params_for).
+    def union_transaction(union, routes, input, method, env)
+      exact_route = nil
+      response = union&.match(input) do |m|
+        exact_route = matched_route(routes, m)
+        process_route(exact_route, input, env, m, exact_route.union_captures)
+      end
+      settle(input, method, env, response, exact_route)
+    end
+
+    # What #transaction answers once +exact_route+ answered with +response+:
+    # that response, unless it cascades. A route that declined (+response+
+    # cascades), or none matching (+response+ is nil), leaves the rest to try.
+    def settle(input, method, env, response, exact_route)
       return response if halt?(response)
 
       # A cascading route has only declined this request. Its siblings — the
@@ -91,34 +155,49 @@ module Grape
         return response if response && !cascade?(response)
       end
 
-      last_neighbor_route = greedy_match?(input)
+      neighbours(input, method, env, response, cascaded)
+    end
+
+    # The ANY ('*') routes and the greedy neighbour, tried once the routes for
+    # +method+ have declined. +cascaded+ says whether any of them matched: the
+    # auto-OPTIONS and 405 answers are only right when none did.
+    def neighbours(input, method, env, response, cascaded)
+      # Only ever read while nothing for +method+ has matched, so once a route
+      # has -- and cascaded -- there is no neighbour to look for.
+      last_neighbor_route = neighbour_match?(input, method) unless cascaded
 
       # If last_neighbor_route exists and request method is OPTIONS,
       # return response by using #include_allow_header.
-      return process_route(last_neighbor_route, input, env, include_allow_header: true) if !cascaded && method == Rack::OPTIONS && last_neighbor_route
+      return process_route(last_neighbor_route, input, env, include_allow_header: true) if last_neighbor_route && method == Rack::OPTIONS
 
       star_route = match?(input, '*')
-
       if star_route
-        close_body(response) if response # superseded by the ANY route
-        response = process_route(star_route, input, env)
-        return response if halt?(response)
-
-        cascaded ||= !response.nil?
+        response = process_star_route(star_route, input, env, response)
+        # Halting or cascading, the ANY route's answer is the one returned.
+        return response if response
       end
 
-      return process_route(last_neighbor_route, input, env, include_allow_header: true) if !cascaded && last_neighbor_route
+      return process_route(last_neighbor_route, input, env, include_allow_header: true) if last_neighbor_route
 
       response
     end
 
+    # The ANY route's answer, superseding +response+. A cascading one has its
+    # body closed, as #halt? closes it, and is still what #neighbours returns.
+    def process_star_route(star_route, input, env, response)
+      close_body(response) if response
+      star_response = process_route(star_route, input, env)
+      close_body(star_response) if cascade?(star_response)
+      star_response
+    end
+
     # The routes registered for +method+ other than +exact_route+, tried in
     # registration order until one answers without cascading. Returns the last
     # response processed — a cascading one when every sibling declined, so the
     # caller can hand it back — or nil when no sibling matched.
     def rotation(input, method, env, exact_route)
       response = nil
-      @map[method]&.each do |route|
+      @map[method].each do |route|
         next if exact_route == route
         next unless route.match?(input)
 
@@ -151,16 +230,81 @@ module Grape
     # Routing args are rebuilt for every attempt: when a route cascades
     # (X-Cascade pass), the next candidate must not observe the previous
     # attempt's +route_info+ or path captures.
-    def process_route(route, input, env, include_allow_header: false)
+    def process_route(route, input, env, match = nil, captures = nil, include_allow_header: false)
       # The path captures are the hash: +route_info+ is written into them
-      # rather than merged in from a second one.
-      routing_args = route.params_for(input) || {}
+      # rather than merged in from a second one. +captures+ names the groups of
+      # +match+ that hold them: the router's union numbers them one way, a
+      # bucket's another.
+      routing_args = route.params_for(input, match, captures) || {}
       routing_args[:route_info] = route
       env[Grape::Env::GRAPE_ROUTING_ARGS] = routing_args
       env[Grape::Env::GRAPE_ALLOWED_METHODS] = route.allow_header if include_allow_header
       route.call(env)
     end
 
+    # {#process_route} for an entry of {#static_routes_for}. Its captures were
+    # read when the table was built; each request gets its own copy of each,
+    # the way it gets fresh strings out of a match.
+    def process_static_route(route, captures, env)
+      routing_args = captures&.transform_values(&:dup) || {}
+      routing_args[:route_info] = route
+      env[Grape::Env::GRAPE_ROUTING_ARGS] = routing_args
+      route.call(env)
+    end
+
+    # A request for a path a route spells out in full -- no param in it, its
+    # version filled in -- is answered from this table rather than by the
+    # union. The union tries its alternatives one after another, and finding
+    # which one matched scans every route ahead of it, so a request costs more
+    # the later its route was registered; a Hash lookup does not.
+    #
+    # Each path is resolved here the way a request for it is, through the
+    # union and the scan, so an entry holds whichever route answers it -- an
+    # earlier route with a param where the path has a segment included -- and
+    # the captures it hands over. Only paths worked out from the routes are
+    # keys, so a client cannot grow the table, and a path that is not in it,
+    # or whose captures are not all plain Strings, is matched as before.
+    def static_routes_for(union, routes)
+      routes.each_with_object({}) do |route, table|
+        static_paths(route).each do |path|
+          next if table.key?(path)
+
+          entry = static_route_entry(union, routes, path)
+          table[path] = entry if entry
+        end
+      end.freeze
+    end
+
+    # The route a request for +path+ resolves to and the captures it hands
+    # over, frozen for every such request to share; nil when a capture is not
+    # a String.
+    def static_route_entry(union, routes, path)
+      union.match(path) do |m|
+        matched = matched_route(routes, m)
+        captures = matched.params_for(path, m)
+        # Only a String is frozen whole below; any other capture would be
+        # shared across requests with its insides open to change.
+        next unless captures.nil? || captures.each_value.all?(String)
+
+        [matched, captures.presence&.each_value(&:freeze)&.freeze].freeze
+      end
+    end
+
+    STATIC_PATH_EXCLUDED = /[:*?(){}|\\%]/
+    private_constant :STATIC_PATH_EXCLUDED
+
+    # The request paths +route+ spells out in full: its origin, with each
+    # version it declares filled in under path versioning. A path still
+    # holding pattern syntax or a '%', or one the normalizer would rewrite, is
+    # left out, since no request routes on it spelled that way. This only
+    # picks the paths worth resolving; what answers them is up to the union.
+    def static_paths(route)
+      origin = route.origin
+      version_segment = Grape::Router::Pattern::Path::VERSION_SEGMENT
+      paths = origin.include?(version_segment) ? Array(route.version).map { |version| origin.sub(version_segment, version.to_s) } : [origin]
+      paths.select { |path| !path.match?(STATIC_PATH_EXCLUDED) && Grape::Util::PathNormalizer.call(path) == path }
+    end
+
     # Tells each route the number of the group it ended up as in +union+. The
     # numbering is a property of the union rather than of the route's own
     # pattern -- every route ahead of it contributes however many groups its
@@ -177,6 +321,8 @@ module Grape
       yield || default_response
     end
 
+    # The 404 answered when nothing matched. The Rack::Head the API wraps
+    # around the router strips its body from a HEAD request.
     def default_response
       [404, DEFAULT_RESPONSE_HEADERS.dup, DEFAULT_RESPONSE_BODY.dup]
     end
@@ -187,13 +333,97 @@ module Grape
     # name sends MatchData through the pattern's name table on every lookup,
     # a number indexes the match region directly.
     def match?(input, method)
-      @optimized_map[method]&.match(input) { |m| @map[method].detect { |route| m[route.regexp_capture_group] } }
+      union, routes = @optimized_map[method]
+      union&.match(input) { |m| routes.detect { |route| m[route.regexp_capture_group] } }
     end
 
     def greedy_match?(input)
       @union.match(input) { |m| @neutral_map.detect { |route| m[route.regexp_capture_group] } }
     end
 
+    # The route of +routes+ whose alternative of their union produced +match+,
+    # found as #match? finds it.
+    def matched_route(routes, match)
+      routes.detect { |route| match[route.regexp_capture_group] }
+    end
+
+    # The greedy route for +input+ once the routes for +method+ have all missed
+    # it, from the ones #compile_neighbour_map left to try. A method with no
+    # routes of its own covers no path, so it still walks the whole of @union.
+    def neighbour_match?(input, method)
+      return greedy_match?(input) unless @map.key?(method)
+
+      union, routes, groups = @neighbour_map[method]
+      union&.match(input) do |m|
+        routes[groups.index { |group| m[group] }]
+      end
+    end
+
+    # Compiled from the routes actually registered rather than from
+    # Grape::HTTP_SUPPORTED_METHODS. A route declared with any other verb
+    # (`route :purge, '/cache'`) is accepted at definition time and is
+    # already collected into the resource's Allow header, so skipping it here
+    # left it in @map but out of @optimized_map — the only map #match? reads.
+    # The resource then advertised a method that could never be matched and
+    # answered every request for it with 405.
+    def compile_optimized_map
+      # Shared by the methods below: HEAD's routes mirror GET's, so their
+      # buckets compile to the same unions.
+      bucket_unions = {}
+      @map.each do |method, routes|
+        @optimized_map[method] = optimized_routes(routes, bucket_unions)
+      end
+    end
+
+    # The union of +routes+, paired with the routes it was built from, so a
+    # request reads everything it can be matched with through a single
+    # lookup: the buckets that narrow those routes by a path segment (nil
+    # when no segment splits them well), and the table of the paths they
+    # spell out in full -- nil when none does, so a request for their method
+    # goes straight to the union rather than missing a lookup first.
+    def optimized_routes(routes, bucket_unions)
+      regexps = routes.map.with_index { |route, index| route.to_regexp(index) }
+      union = resolve_capture_groups(Regexp.union(regexps), routes)
+      static_routes = static_routes_for(union, routes)
+      [union, routes, RouteBuckets.build(routes, regexps, bucket_unions), (static_routes unless static_routes.empty?)].freeze
+    end
+
+    # After a miss, #neighbours looks for a greedy route to answer 405 with.
+    # Walking the whole of @union for it would cost a 404 a second walk over
+    # every path, and most of that walk cannot succeed: a greedy route shares
+    # its pattern with the routes it was collected from (see
+    # API::Instance#collect_route_config_per_pattern), so once the union for
+    # +method+ has missed a path, the greedy route of every path +method+ has a
+    # route on has missed it too. What is left to try is the paths +method+ has
+    # no route on -- in an API where every path answers GET, none at all for a
+    # GET.
+    #
+    # Built from the same members as @union, in the same order, so a path
+    # resolves to the same greedy route either way. Methods that leave the same
+    # paths uncovered -- PUT and DELETE on a member, say -- share one union.
+    def compile_neighbour_map
+      unions = {}
+      @map.each do |method, routes|
+        covered = routes.to_set(&:pattern_regexp)
+        uncovered = @neutral_map.each_index.reject { |index| covered.include?(@neutral_map[index].pattern_regexp) }
+        @neighbour_map[method] = unions[uncovered] ||= neighbour_union(uncovered) unless uncovered.empty?
+      end
+    end
+
+    # The union of the greedy routes at +indices+ of @neutral_map, those
+    # routes, and the group each of them occupies in the union: a subset of
+    # @union numbers its groups differently, so the ones
+    # #resolve_capture_groups recorded do not apply. Routes and groups are
+    # parallel Arrays for #neighbour_match? to walk with Array#index, as
+    # Enumerable#find over a Hash allocates on every call.
+    def neighbour_union(indices)
+      union = Regexp.union(@neutral_regexes.values_at(*indices))
+      named_captures = union.named_captures
+      routes = @neutral_map.values_at(*indices).freeze
+      groups = routes.map { |route| named_captures.fetch(route.regexp_capture_index).first }.freeze
+      [union, routes, groups].freeze
+    end
+
     def cascade?(response)
       response && response[1]['X-Cascade'] == 'pass'
     end

data/lib/grape/util/endpoint_configuration.rb

@@ -2,7 +2,13 @@
 
 module Grape
   module Util
-    class EndpointConfiguration < Lazy::ValueHash
+    # The +with:+ Hash a mount supplies, read as a {Grape::Util::Lazy::Value} so
+    # that reads taken before the mount happened can be replayed against it
+    # afterwards. Keys are indifferent at every depth.
+    class EndpointConfiguration < Lazy::Value
+      def initialize(config)
+        super(config.with_indifferent_access)
+      end
     end
   end
 end