woods 1.6.1 → 2.0.0.beta2

data/lib/woods/extractors/controller_extractor.rb

@@ -28,8 +28,21 @@ module Woods
       include SharedDependencyScanner
       include RouteHelperResolver
 
+      # Matches everything between a `def foo_params` line and its
+      # params.require/permit or params.expect call, without crossing into
+      # a sibling method's body. Used by {#extract_permitted_params}.
+      PARAMS_METHOD_BODY = /(?:(?!\bdef\b)[\s\S])*?/
+
+      # @return [Array<String>] Warnings collected during extraction
+      #   (concern-inlining fallbacks). Drained by the orchestrator, which
+      #   collects warnings from every extractor that exposes them.
+      attr_reader :warnings
+
       def initialize
         @routes_map = build_routes_map
+        @concern_cache = {}
+        @concern_module_cache = {}
+        @warnings = []
         build_route_helper_map
       end
 
@@ -37,20 +50,56 @@ module Woods
       #
       # @return [Array<ExtractedUnit>] List of controller units
       def extract_all
-        controllers = ApplicationController.descendants
-
-        controllers = (controllers + ActionController::API.descendants).uniq if defined?(ActionController::API)
-
-        controllers.map do |controller|
+        discoverable_classes.map do |controller|
           extract_controller(controller)
         end.compact
       end
 
+      # The controller classes this extractor would extract from the running
+      # app. Shared with the incremental path's class reconciliation (#164).
+      #
+      # Discovery walks +ActionController::Base.descendants+ and
+      # +ActionController::API.descendants+ — not
+      # +ApplicationController.descendants+, which excludes the receiver
+      # (Class#descendants never includes the class itself, so
+      # ApplicationController — usually the richest controller in the app —
+      # was never indexed) and misses controllers inheriting straight from
+      # +ActionController::Base+ (#200). Each base is guarded with
+      # +defined?+ so a host missing one, or both (no NameError on hosts
+      # without an ApplicationController constant), simply contributes
+      # nothing.
+      #
+      # Framework-internal descendants (Rails::InfoController,
+      # ActiveStorage controllers, engine controllers) share this ancestry
+      # but live in gem source; {#app_defined_controller?} keeps them out.
+      # That filter is shared with {#extract_controller} so this set stays
+      # exactly the set extract_controller accepts — it is the incremental
+      # reconciliation input, and any class listed here that
+      # extract_controller rejects would be recomputed as a phantom
+      # "addition" on every incremental run (same reasoning as
+      # ViewComponentExtractor's preview filtering).
+      #
+      # @return [Array<Class>]
+      def discoverable_classes
+        controllers = []
+        controllers.concat(ActionController::Base.descendants) if defined?(ActionController::Base)
+        controllers.concat(ActionController::API.descendants) if defined?(ActionController::API)
+        controllers.uniq.select { |controller| app_defined_controller?(controller) }
+      end
+
       # Extract a single controller
       #
+      # Rejects classes the extractor does not own — anonymous classes and
+      # framework-internal controllers — via {#app_defined_controller?},
+      # the same gate {#discoverable_classes} applies, so the two stay in
+      # agreement for incremental class reconciliation.
+      #
       # @param controller [Class] The controller class
-      # @return [ExtractedUnit] The extracted unit
+      # @return [ExtractedUnit, nil] The extracted unit, or nil for classes
+      #   the extractor rejects
       def extract_controller(controller)
+        return nil unless app_defined_controller?(controller)
+
         unit = ExtractedUnit.new(
           type: :controller,
           identifier: controller.name,
@@ -61,8 +110,9 @@ module Woods
         source = source_path && File.exist?(source_path) ? File.read(source_path) : ''
 
         unit.namespace = extract_namespace(controller)
-        unit.source_code = build_composite_source(controller, source)
-        unit.metadata = extract_metadata(controller, source)
+        inlined_source, inlined_concerns = build_controller_source_with_concerns(controller, source)
+        unit.source_code = build_composite_source(controller, inlined_source)
+        unit.metadata = extract_metadata(controller, source, inlined_concerns: inlined_concerns)
         unit.dependencies = extract_dependencies(controller, source)
 
         # Controllers benefit from per-action chunks
@@ -116,6 +166,32 @@ module Woods
       # Source Building
       # ──────────────────────────────────────────────────────────────────────
 
+      # Whether a controller class belongs to the host application.
+      #
+      # Discovery starts from the ActionController bases (#200), which
+      # framework controllers (Rails::InfoController, ActiveStorage's
+      # controllers, engine controllers) also descend from. App-defined
+      # means: the class is named, and it resolves to an existing source
+      # file that {SharedUtilityMethods#app_source?} accepts (under
+      # +Rails.root+, outside vendor/ and node_modules/). Framework classes
+      # resolve to gem paths, so {#source_file_for} falls back to a
+      # convention path that does not exist and they are rejected.
+      #
+      # Shared by {#discoverable_classes} and {#extract_controller}; the
+      # two must agree or the incremental class reconciliation recomputes
+      # the same phantom "additions" every run.
+      #
+      # @param controller [Class] Candidate controller class
+      # @return [Boolean]
+      def app_defined_controller?(controller)
+        return false if controller.name.nil?
+
+        path = source_file_for(controller)
+        return false unless path
+
+        File.exist?(path) && app_source?(path, Rails.root.to_s)
+      end
+
       # Find the source file for a controller, validating paths are within Rails.root.
       #
       # Convention path first, then introspection via {#resolve_source_location}
@@ -130,15 +206,13 @@ module Woods
         resolve_source_location(controller, app_root: Rails.root.to_s, fallback: convention_path)
       end
 
-      # Build composite source with routes and filters as headers
-      def build_composite_source(controller, source = nil)
-        if source.nil?
-          source_path = source_file_for(controller)
-          return '' unless source_path && File.exist?(source_path)
-
-          source = File.read(source_path)
-        end
-
+      # Build composite source with routes and filters as headers.
+      #
+      # The sole caller ({#extract_controller}) always passes the
+      # already concern-inlined source (see
+      # {#build_controller_source_with_concerns}), which returns '' rather
+      # than nil for a missing file — so this never sees a nil source.
+      def build_composite_source(controller, source)
         # Prepend route information
         routes_comment = build_routes_comment(controller)
 
@@ -207,12 +281,222 @@ module Woods
         end
       end
 
+      # ──────────────────────────────────────────────────────────────────────
+      # Concern Detection & Inlining
+      # ──────────────────────────────────────────────────────────────────────
+
+      # Modules included in the controller that are application-defined
+      # concerns.
+      #
+      # Detection is by membership, not name (#175): Rails does not
+      # namespace controller concerns — app/controllers/concerns/
+      # requires_author.rb defines top-level +RequiresAuthor+ — so the old
+      # name-substring check ('Concern'/'Concerns') never matched idiomatic
+      # controller concerns and +included_concerns+ came back empty while
+      # the concern's effects (filters) were captured.
+      #
+      # @param controller [Class] The controller class
+      # @return [Array<Module>] App-defined concern modules
+      def detect_included_concerns(controller)
+        controller.included_modules.select { |mod| app_concern_module?(mod) }
+      end
+
+      # Whether a module included in a controller is an application-defined
+      # concern.
+      #
+      # A module counts when it extends +ActiveSupport::Concern+ (the
+      # idiomatic case) OR its resolved source file sits under an
+      # app/**/concerns directory (a plain module mixed in from concerns/
+      # without the extend). Framework modules are excluded first: many gem
+      # modules extend +ActiveSupport::Concern+ too
+      # (ActionController::MimeResponds et al.), so any module whose source
+      # resolves outside the app ({SharedUtilityMethods#app_source?}) is
+      # rejected before either positive check runs. Verdicts are memoized
+      # per module name — ApplicationController's includes recur in every
+      # controller of the app.
+      #
+      # @param mod [Module] A module from the controller's included_modules
+      # @return [Boolean]
+      def app_concern_module?(mod)
+        return false unless mod.name
+
+        return @concern_module_cache[mod.name] if @concern_module_cache.key?(mod.name)
+
+        @concern_module_cache[mod.name] = compute_app_concern_module(mod)
+      end
+
+      # Uncached concern verdict for a named module (see
+      # {#app_concern_module?} for the detection rules).
+      #
+      # @param mod [Module] A named module
+      # @return [Boolean]
+      def compute_app_concern_module(mod)
+        path = module_source_path(mod)
+        return false if path && !app_source?(path, Rails.root.to_s)
+
+        activesupport_concern?(mod) || concerns_directory_path?(path)
+      end
+
+      # Resolve a module's defining source file via const_source_location.
+      #
+      # @param mod [Module] A named module
+      # @return [String, nil] Absolute path, or nil when unresolvable
+      def module_source_path(mod)
+        return nil unless Object.respond_to?(:const_source_location)
+
+        Object.const_source_location(mod.name)&.first
+      rescue StandardError
+        nil
+      end
+
+      # Whether a module extends ActiveSupport::Concern (the idiomatic
+      # concern marker). Membership lives on the singleton class.
+      #
+      # @param mod [Module] A module to test
+      # @return [Boolean]
+      def activesupport_concern?(mod)
+        return false unless defined?(ActiveSupport::Concern)
+
+        mod.singleton_class.include?(ActiveSupport::Concern)
+      end
+
+      # Whether a resolved source path sits under an app/**/concerns
+      # directory (e.g. app/controllers/concerns/, app/models/concerns/).
+      # Callers guarantee the path, when present, is app source.
+      #
+      # @param path [String, nil] Absolute path under Rails.root, or nil
+      # @return [Boolean]
+      def concerns_directory_path?(path)
+        return false unless path
+
+        relative = path.delete_prefix("#{Rails.root}/")
+        relative.match?(%r{\Aapp/(?:[^/]+/)*concerns/})
+      end
+
+      # Read controller source and inline all detected concerns, mirroring
+      # ModelExtractor's approach: concern code is inserted as '#'-prefixed
+      # comment lines right after the class declaration (nested or compact
+      # style), falling back to appending at end-of-source with a warning
+      # rather than silently dropping the block.
+      #
+      # An empty source (missing file) is returned untouched — inlining
+      # into nothing would fabricate source_code out of comments.
+      #
+      # @param controller [Class] The controller class
+      # @param source [String, nil] Pre-read controller source (read from
+      #   disk when nil)
+      # @return [Array(String, Array<String>)] The concern-inlined source
+      #   and the demodulized names of the concerns actually inlined into
+      #   it. Returning the pair keeps metadata[:inlined_concerns] truthful
+      #   — it is derived from the insertion result, never recomputed
+      #   independently of what the composite source carries.
+      def build_controller_source_with_concerns(controller, source = nil)
+        if source.nil?
+          source_path = source_file_for(controller)
+          return ['', []] unless source_path && File.exist?(source_path)
+
+          source = File.read(source_path)
+        end
+
+        return [source, []] if source.empty?
+
+        concern_sources = resolved_concern_sources(controller)
+        return [source, []] if concern_sources.empty?
+
+        [insert_concern_block(controller, source, build_concern_block(concern_sources)),
+         concern_sources.map { |name, _code| name.demodulize }]
+      end
+
+      # Resolve [name, code] pairs for every detected concern whose source
+      # file can be located.
+      #
+      # @param controller [Class] The controller class
+      # @return [Array<Array(String, String)>]
+      def resolved_concern_sources(controller)
+        detect_included_concerns(controller).filter_map { |mod| concern_source(mod) }
+      end
+
+      # Get the source code for a concern, with caching. Resolution reuses
+      # {#module_source_path} — the same location detection validated — so
+      # a concern detected purely by ActiveSupport::Concern membership with
+      # no resolvable file keeps its edge and metadata entry but is not
+      # inlined.
+      #
+      # @param mod [Module] A detected concern module
+      # @return [Array(String, String), nil] [name, code] or nil
+      def concern_source(mod)
+        return @concern_cache[mod.name] if @concern_cache.key?(mod.name)
+
+        path = module_source_path(mod)
+        return nil unless path && File.exist?(path)
+
+        @concern_cache[mod.name] = [mod.name, File.read(path)]
+      end
+
+      # Render concern sources as a '#'-commented display block showing
+      # what's mixed in (same display form as ModelExtractor).
+      #
+      # @param concern_sources [Array<Array(String, String)>] [name, code] pairs
+      # @return [String]
+      def build_concern_block(concern_sources)
+        concern_sources.map do |name, code|
+          indented = code.lines.map { |l| "  # #{l.rstrip}" }.join("\n")
+          <<~CONCERN
+            # ┌─────────────────────────────────────────────────────────────────────┐
+            # │ Included from: #{name.ljust(54)}│
+            # └─────────────────────────────────────────────────────────────────────┘
+            #{indented}
+            # ─────────────────────────── End #{name} ───────────────────────────
+          CONCERN
+        end.join("\n\n")
+      end
+
+      # Insert the concern block after the controller's class declaration
+      # line. Falls back to appending at end-of-source (recording a
+      # warning) when no declaration matches — dropping the block silently
+      # would leave source_code contradicting metadata[:inlined_concerns].
+      #
+      # @param controller [Class] The controller class
+      # @param source [String] The controller source
+      # @param concern_block [String] Commented concern block to insert
+      # @return [String]
+      def insert_concern_block(controller, source, concern_block)
+        pattern = class_declaration_pattern(controller)
+        return source.sub(pattern) { "#{::Regexp.last_match(1)}\n\n#{concern_block}" } if source.match?(pattern)
+
+        @warnings << "[#{controller.name}] No class declaration matched for concern inlining; " \
+                     'appending inlined concern block at end of source'
+        "#{source.chomp}\n\n#{concern_block}"
+      end
+
+      # Regexp matching the controller's class declaration in either nested
+      # (+class PostsController+) or compact
+      # (+class Admin::PostsController+) style. The word boundary stops
+      # +class PostsControllerError+ from claiming the block; the +(?!::)+
+      # lookahead stops a nested +class PostsController::Error+ from
+      # claiming it either.
+      #
+      # @param controller [Class] The controller class
+      # @return [Regexp]
+      def class_declaration_pattern(controller)
+        /(class\s+(?:[\w:]+::)?#{Regexp.escape(controller.name.demodulize)}\b(?!::).*$)/
+      end
+
       # ──────────────────────────────────────────────────────────────────────
       # Metadata Extraction
       # ──────────────────────────────────────────────────────────────────────
 
       # Extract comprehensive metadata
-      def extract_metadata(controller, source = nil)
+      #
+      # @param controller [Class] The controller class
+      # @param source [String, nil] The raw controller source code
+      # @param inlined_concerns [Array<String>, nil] Demodulized names of
+      #   the concerns actually inlined into the unit's source_code (from
+      #   {#build_controller_source_with_concerns}). When nil, derived by
+      #   running the same inlining — the metadata must never claim a
+      #   concern the composite source does not carry.
+      # @return [Hash]
+      def extract_metadata(controller, source = nil, inlined_concerns: nil)
         own_methods = controller.instance_methods(false).to_set(&:to_s)
         actions = controller.action_methods.select { |m| own_methods.include?(m) }.to_a
 
@@ -231,9 +515,12 @@ module Woods
                                .map(&:name)
                                .compact,
 
-          # Concerns included
+          # Concerns included (detected by membership, not name — #175)
           included_concerns: extract_included_concerns(controller),
 
+          # Concerns actually inlined into source_code (demodulized)
+          inlined_concerns: inlined_concerns || build_controller_source_with_concerns(controller, source).last,
+
           # Response formats
           responds_to: extract_respond_formats(controller, source),
 
@@ -246,10 +533,13 @@ module Woods
         }
       end
 
+      # Names of the app-defined concerns included in the controller.
+      # Detection lives in {#detect_included_concerns} (#175).
+      #
+      # @param controller [Class] The controller class
+      # @return [Array<String>] Full module names
       def extract_included_concerns(controller)
-        controller.included_modules
-                  .select { |m| m.name&.include?('Concern') || m.name&.include?('Concerns') }
-                  .map(&:name)
+        detect_included_concerns(controller).map(&:name)
       end
 
       def extract_respond_formats(controller, source = nil)
@@ -270,6 +560,18 @@ module Woods
         formats.uniq
       end
 
+      # Strong-parameter declarations, keyed by the `*_params` method name.
+      #
+      # Each entry is `{ model:, permitted: }`. `permitted` is the list of
+      # keys named at the TOP level of the `permit`/`expect` call — scalar
+      # symbols and hash keys alike — and never the members of a nested list
+      # or hash: `permit(:title, tags: [], meta: {seo: [:keyword]})` yields
+      # `%w[title tags meta]`. See {#permitted_keys}.
+      #
+      # @param controller [Class, nil] Controller class (used only to locate
+      #   the source when +source+ is not supplied)
+      # @param source [String, nil] Controller source code
+      # @return [Hash{String => Hash}] `{ method_name => { model:, permitted: } }`
       def extract_permitted_params(controller, source = nil)
         if source.nil?
           source_path = source_file_for(controller)
@@ -280,23 +582,81 @@ module Woods
 
         params = {}
 
-        # Match params.require(:x).permit(...) patterns
-        source.scan(/def\s+(\w+_params).*?params\.require\(:(\w+)\)\.permit\((.*?)\)/m) do |method, model, permitted|
-          params[method] = {
-            model: model,
-            permitted: permitted.scan(/:(\w+)/).flatten
-          }
+        # Match params.require(:x).permit(...) patterns. The body segment
+        # between the method name and the require/permit call is bounded by
+        # a negative lookahead on `def` so a method with no permit call
+        # (e.g. `filter_params; params.fetch(:f); end`) never lets the scan
+        # run into the *next* method's body and misattribute its params.
+        # The /m flag plus a [\s\S] capture let the permit list cross
+        # newlines — the common style in large controllers (M2); without
+        # them `permit(` followed by a newline matched nothing and
+        # permitted_params came back empty. The `\s*` around each chain joint
+        # covers the fluent style the M2 fix missed (EXTA-5): the list could
+        # cross newlines but the call chain itself still could not, so
+        # `params.require(:post)\n  .permit(...)` matched nothing.
+        source.scan(
+          /def\s+(\w+_params)\b#{PARAMS_METHOD_BODY}
+           params\s*\.\s*require\(:(\w+)\)\s*\.\s*permit\(([\s\S]*?)\)/xm
+        ) do |method, model, permitted|
+          params[method] = { model: model, permitted: permitted_keys(permitted) }
+        end
+
+        # Rails 8's params.expect(post: [:title, :body]) replacement for
+        # require(...).permit(...). Same multi-line capture as above (M2).
+        source.scan(
+          /def\s+(\w+_params)\b#{PARAMS_METHOD_BODY}
+           params\s*\.\s*expect\(\s*(\w+):\s*\[([\s\S]*?)\]\s*\)/xm
+        ) do |method, model, permitted|
+          params[method] ||= { model: model, permitted: permitted_keys(permitted) }
         end
 
         params
       end
 
+      # The top-level keys of a permit/expect argument list.
+      #
+      # The contract is deliberately flat and shallow: every key the caller
+      # names at the top level, whether declared as a scalar symbol
+      # (`:title`) or as a hash key (`tags: []`, `meta: {…}`), and nothing
+      # from inside a nested list or hash. Scanning for `:(\w+)` alone
+      # produced neither contract — hash keys, which is how every array and
+      # nested param is declared, were dropped while their nested leaves
+      # leaked in flat, so `permit(:title, tags: [], meta: {seo: [:keyword]})`
+      # reported `title, keyword` (EXTA-12).
+      #
+      # @param list [String] Raw text between `permit(`/`expect(…[` and its close
+      # @return [Array<String>] Top-level key names, in source order
+      def permitted_keys(list)
+        top_level_arguments(list).scan(/:(\w+)|(\w+):/).map { |symbol, key| symbol || key }.uniq
+      end
+
+      # Drop everything inside nested `[...]` / `{...}` groups, leaving the
+      # argument list's own tokens.
+      #
+      # @param list [String]
+      # @return [String]
+      def top_level_arguments(list)
+        depth = 0
+        list.each_char.with_object(+'') do |char, kept|
+          case char
+          when '[', '{' then depth += 1
+          when ']', '}' then depth -= 1 if depth.positive?
+          else kept << char if depth.zero?
+          end
+        end
+      end
+
       # ──────────────────────────────────────────────────────────────────────
       # Dependency Extraction
       # ──────────────────────────────────────────────────────────────────────
 
       def extract_dependencies(controller, source = nil)
-        deps = []
+        # Included concerns add per-request behavior (filters, helpers).
+        # Same edge shape as ModelExtractor's concern edges so graph
+        # consumers see one format (#175).
+        deps = detect_included_concerns(controller).map do |mod|
+          { type: :concern, target: mod.name, via: :include }
+        end
 
         if source.nil?
           source_path = source_file_for(controller)

data/lib/woods/extractors/decorator_extractor.rb

@@ -97,23 +97,16 @@ module Woods
       # @param source [String] Ruby source code
       # @return [String, nil] The class name or nil
       def extract_class_name(file_path, source)
-        namespaces = source.scan(/^\s*module\s+([\w:]+)/).flatten
-        class_match = source.match(/^\s*class\s+([\w:]+)/)
-
-        if class_match
-          base_class = class_match[1]
-          if namespaces.any? && !base_class.include?('::')
-            "#{namespaces.join('::')}::#{base_class}"
-          else
-            base_class
-          end
-        else
-          relative = file_path.sub("#{Rails.root}/", '')
-          relative
+        # Zeitwerk-governed naming (G-1) first, then position-aware
+        # (SourceNesting, #174): only modules still open at the class
+        # declaration qualify it. A sibling module that closed earlier, or a
+        # helper module nested inside the class, does not.
+        governed_class_name(file_path, source) || qualified_first_class_name(source) ||
+          file_path
+            .sub("#{Rails.root}/", '')
             .sub(%r{^app/(decorators|presenters|form_objects)/}, '')
             .sub('.rb', '')
             .camelize
-        end
       end
 
       # ──────────────────────────────────────────────────────────────────────

data/lib/woods/extractors/engine_extractor.rb

@@ -46,16 +46,40 @@ module Woods
           Rails.application.respond_to?(:routes)
       end
 
-      # Retrieve Engine subclasses, compatible with Ruby 3.0+.
-      # Class#subclasses was added in Ruby 3.1; fall back to descendants filtering.
+      # Retrieve Engine subclasses.
+      #
+      # `Class#subclasses` is available on every supported Rails version
+      # (native since Ruby 3.1, backported by ActiveSupport's
+      # `core_ext/class/subclasses` before that, which every booted Rails
+      # app loads) — the ObjectSpace fallback below is defensive for the
+      # unlikely case that core_ext hasn't loaded, not a Ruby-version gap.
+      #
+      # Excludes {#host_application_class?} — Rails::Application is itself a
+      # Rails::Engine subclass (and the ObjectSpace fallback also reaches the
+      # host app's own concrete Application class), neither of which is an
+      # installed engine.
       #
       # @return [Array<Class>]
       def engine_subclasses
-        if Rails::Engine.respond_to?(:subclasses)
-          Rails::Engine.subclasses
-        else
-          ObjectSpace.each_object(Class).select { |klass| klass < Rails::Engine }
-        end
+        classes = if Rails::Engine.respond_to?(:subclasses)
+                    Rails::Engine.subclasses
+                  else
+                    ObjectSpace.each_object(Class).select { |klass| klass < Rails::Engine }
+                  end
+        classes.reject { |klass| host_application_class?(klass) }
+      end
+
+      # Whether a class is Rails::Application itself, or the host app's own
+      # concrete subclass of it (e.g. MyApp::Application). Both descend from
+      # Rails::Engine but represent the host app, not an installed engine —
+      # including them produced a phantom "engine" unit for the app itself.
+      #
+      # @param klass [Class]
+      # @return [Boolean]
+      def host_application_class?(klass)
+        return false unless klass.is_a?(Module)
+
+        defined?(Rails::Application) && klass <= Rails::Application
       end
 
       # Build a mapping from engine class to mounted path by scanning app routes.
@@ -64,7 +88,7 @@ module Woods
       def build_mount_map
         map = {}
         Rails.application.routes.routes.each do |route|
-          app = route.app
+          app = unwrap_mounted_app(route.app)
           next unless engine_class?(app)
 
           path = extract_mount_path(route)
@@ -77,6 +101,27 @@ module Woods
         {}
       end
 
+      # Unwrap a mounted route's app down to the actual engine class.
+      #
+      # For a mounted engine, `route.app` is an
+      # `ActionDispatch::Routing::Mapper::Constraints` wrapper, not the
+      # engine itself — the engine is `route.app.app`. {#engine_class?}
+      # never matched the wrapper, so `mounted_path` was always nil in a
+      # live app. Bounded to a handful of unwraps rather than an open-ended
+      # loop, since a route app is never nested more than a level or two
+      # deep in practice.
+      #
+      # @param app [Object] The route's `.app` value
+      # @return [Object] The unwrapped app, or the original value unchanged
+      def unwrap_mounted_app(app)
+        5.times do
+          break if engine_class?(app) || !app.respond_to?(:app)
+
+          app = app.app
+        end
+        app
+      end
+
       # Check if an object is a Rails::Engine subclass.
       #
       # Uses duck-typing: checks for engine_name method which is defined on all