This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch WW-5674-isclassbelongstopackages-allocation in repository https://gitbox.apache.org/repos/asf/struts.git
commit 2543dd8fc21c1f0a5dcb1f415955f0133548728e Author: Lukasz Lenart <[email protected]> AuthorDate: Mon Aug 3 13:45:40 2026 +0200 WW-5674 docs(ognl): align the design doc with the package-private overload The three-argument isClassBelongsToPackages was narrowed to package-private during the final review, but section 3 still showed it as public static and still carried the superseded justification for publishing it. Co-Authored-By: Claude Opus 5 <[email protected]> --- ...674-isclassbelongstopackages-allocation-design.md | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/superpowers/specs/2026-08-03-WW-5674-isclassbelongstopackages-allocation-design.md b/docs/superpowers/specs/2026-08-03-WW-5674-isclassbelongstopackages-allocation-design.md index 5666a44e1..313894764 100644 --- a/docs/superpowers/specs/2026-08-03-WW-5674-isclassbelongstopackages-allocation-design.md +++ b/docs/superpowers/specs/2026-08-03-WW-5674-isclassbelongstopackages-allocation-design.md @@ -190,28 +190,30 @@ exclusion path under the shipped configuration, where `struts.excludedPackageNames` carries roughly thirty entries by default. It protects deployments that configure both sets empty. -### 3. Both public entry points delegate to it +### 3. Both entry points delegate to it ```java public static boolean isClassBelongsToPackages(Class<?> clazz, Set<String> matchingPackages) { return isClassBelongsToPackages(clazz, matchingPackages, emptySet()); } -public static boolean isClassBelongsToPackages(Class<?> clazz, Set<String> first, Set<String> second) { +static boolean isClassBelongsToPackages(Class<?> clazz, Set<String> first, Set<String> second) { return isPackageBelongsToPackages(toPackageName(clazz), first, second); } ``` One copy of the prefix logic, reached by every caller. -The existing two-argument signature is retained. It is `public static` on a -public class, so it is nominally API even though a repository-wide search finds -no caller outside `SecurityMemberAccess` itself. +The existing two-argument signature is retained unchanged. It is `public static` +on a public class, so it is nominally API even though a repository-wide search +finds no caller outside `SecurityMemberAccess` itself. -The new three-argument overload is `public static` for consistency with the two -public statics beside it. It has a single caller today; making it -package-private instead would be a defensible alternative and is a trivial -follow-up if the extra surface is unwelcome. +The new three-argument overload is package-private. It has exactly one caller +(`isClassAllowlisted`) and its only test lives in the same package, so +package-private reaches everything that needs it, and it matches the visibility +of `isPackageBelongsToPackages` beside it. Publishing it would freeze it as +`struts2-core` API until the next major release for no benefit — particularly +unwelcome while WW-4759 is drawing the `struts2-api` boundary. ### 4. Single walk on the allowlist path
