Deprecate positional options Hash in Auth DSL; use keyword arguments

[ericproulx]

Summary

Grape::Middleware::Auth::DSL#auth, #http_basic and #http_digest now take their options as keyword arguments. Passing a positional options Hash still works but emits a Grape.deprecator warning and is merged into the keyword options, so downstream callers keep working through the deprecation cycle.

This mirrors the desc(description, **options) deprecation from #2723.

# preferred
http_basic realm: 'API' do |u, p| ... end
auth :http_digest, realm: 'API', opaque: 'secret', &proc

# still works, now deprecated
http_basic({ realm: 'API' })
auth :http_digest, { realm: 'API', opaque: 'secret' }

Details

• New private merge_legacy_auth_options(method_name, legacy_options, options): no-op on the kwargs path; on a positional Hash it warns via Grape.deprecator and merges (kwargs win).
• Getter/setter duality of auth is preserved — the return … unless type early-return runs before any deprecation logic, so reading auth never warns.
• Internal delegation uses **options (auth(:http_basic, **options, &)), so http_basic/http_digest don't self-trigger the deprecation.
• reverse_merge and the Grape::Middleware::Auth::Base consumption path are unchanged.

Docs

• UPGRADING.md: new >= 3.3 entry documenting the kwargs migration and the deprecated positional form (styled like the existing with / version kwargs entries).

Tests

• spec/grape/middleware/auth/dsl_spec.rb: 3 new specs (one per method) — a positional Hash raises ActiveSupport::DeprecationException (suite runs deprecator.behavior = :raise) and still produces the correct auth settings when silenced. Existing keyword/block specs unchanged.
• Full default suite: 2313 examples, 0 failures. RuboCop clean.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run