Restore the per-attempt routing args in Grape::Router

[ericproulx]

Summary

#2824's fix is no longer in master. This restores it, with its regression spec.

lib/grape/router.rb#process_route is back to seeding env['grape.routing_args'] once with ||= and merging each attempt's captures in place:

env[Grape::Env::GRAPE_ROUTING_ARGS] ||= { route_info: route }
env[Grape::Env::GRAPE_ROUTING_ARGS].merge!(route_params) if route_params.present?

How it was lost

#2824 landed as a merge commit (0a08e97d). #2829 was squash-merged (59188e2a) from a branch cut before #2824, so its squashed diff replayed the stale router.rb over the fix and removed the regression spec from router_spec.rb in the same stroke. Git reported no conflict — a squash replays the branch diff onto the tip.

658e0d7f is still an ancestor of HEAD and #2824's CHANGELOG entry survived, so nothing about the history or the changelog suggests the fix is missing. With the spec gone too, the suite stayed green.

Impact (verified on current master)

Restoring the spec against master fails:

origin  = "/:id"                          expected "/:name"
params  = {"id"=>"123", "name"=>"123"}    expected {"name"=>"123"}

When a route cascades (X-Cascade: pass) and a later candidate answers:

• the route helper returns the cascaded route, not the serving one;
• the cascaded attempt's path captures leak into params — the endpoint sees id, which it never declared. This is the more consequential half, since it reaches user code and declared.

Notes

• Fix and spec restored verbatim from 658e0d7f. The router is the only writer of that env key, so assigning unconditionally is safe.
• Verified the spec fails without the change and passes with it.
• Full bundle exec rubocop and bundle exec rspec (2516 examples) pass.
• I checked the other recent fixes the same way (Fix base-only rescue handlers never firing #2794, Fix type: Array + values: [...] coercing to the guessed element type instead of Array #2813, Make InheritableSetting's raw stores internal (series finale) #2810, Compare the base API, not to_s, when refreshing a mounted app #2788, Make forward_match an internal kwarg instead of a route option #2774) — their regression specs are all still present and green, so this is the only lost fix.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run