feat: scope middleware to groups in Use() and MiddlewareGroup() functions

Enhance middleware handling to support scoping within `Group()`, `NamedGroup()`, and `MiddlewareGroup()`, ensuring middleware applies only to routes within the defined group. Add tests to verify expected behavior.

Author: mallardduck

pkg/teapot/router.go

@@ -25,6 +25,7 @@ type Router struct {
 	optimizedHandlers *[]*optimizedHandler // for finalization optimization
 	finalized         bool
 	debugLog          bool // enable debug logging for auto-promotion
+	isGroupContext    bool // true when inside Group()/NamedGroup()/MiddlewareGroup() — Use() appends to r.middlewares instead of r.mux
 
 	// Homing support for late propagation
 	parents []parentRouter // parent routers to notify of new routes
@@ -451,6 +452,7 @@ func (r *Router) MiddlewareGroup(fn func(r *Router), middlewares ...func(http.Ha
 		middlewares:       append(append([]func(http.Handler) http.Handler{}, r.middlewares...), middlewares...), // Parent + new
 		optimizedHandlers: r.optimizedHandlers,
 		finalized:         r.finalized,
+		isGroupContext:    true, // Use() inside groups appends to r.middlewares, not r.mux
 	}
 
 	fn(subRouter)
@@ -470,6 +472,7 @@ func (r *Router) NamedGroup(pattern, namePrefix string, fn func(r *Router)) {
 		middlewares:       append([]func(http.Handler) http.Handler{}, r.middlewares...), // Copy parent middlewares
 		optimizedHandlers: r.optimizedHandlers,
 		debugLog:          r.debugLog,
+		isGroupContext:    true, // Use() inside groups appends to r.middlewares, not r.mux
 	}
 
 	// Trim trailing dot if namePrefix is empty
@@ -521,11 +524,24 @@ func (r *Router) Route(pattern string, fn func(r *Router)) {
 	})
 }
 
-// Use adds global middleware to the router
+// Use adds middleware to the router.
+//
+// At the root level, middleware is registered globally with chi and applies to all routes.
+//
+// Inside a Group(), NamedGroup(), or MiddlewareGroup() block, middleware is scoped to
+// routes registered within that group. It is appended to the group's middleware chain
+// and copied to each route at registration time.
+//
+// Use() must be called before registering routes or nested groups for the middleware
+// to take effect on those routes (same convention as chi).
 func (r *Router) Use(middlewares ...func(http.Handler) http.Handler) {
-	// Only add to chi.Mux for truly global middleware
-	// Don't add to r.middlewares as that would duplicate with route-specific
-	r.mux.Use(middlewares...)
+	if r.isGroupContext {
+		// Group context: store in r.middlewares so it's copied to routes at registration
+		r.middlewares = append(r.middlewares, middlewares...)
+	} else {
+		// Root/Route context: delegate to chi for global middleware
+		r.mux.Use(middlewares...)
+	}
 }
 
 // MountNamed is like Mount, but allows specifying a name prefix for the sub-router's routes.

pkg/teapot/router_test.go

@@ -1060,3 +1060,77 @@ func TestMiddlewareGroupAfterFinalization(t *testing.T) {
 	asserts.True(routeNames["after1"])
 	asserts.True(routeNames["after2"])
 }
+
+// Test: r.Use() inside Group() scopes middleware to the group, not globally
+func TestGroupUseIsScoped(t *testing.T) {
+	r := teapot.New()
+
+	var log []string
+	groupMiddleware := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			log = append(log, "group:"+req.URL.Path)
+			next.ServeHTTP(w, req)
+		})
+	}
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	r.Group("/api", func(r *teapot.Router) {
+		r.Use(groupMiddleware)
+		r.GET("/users", handler)
+	})
+	r.GET("/public", handler)
+
+	srv := httptest.NewServer(r)
+	defer srv.Close()
+
+	// Hit the public route — middleware must NOT run
+	log = nil
+	resp, _ := http.Get(srv.URL + "/public")
+	_ = resp.Body.Close()
+	assert.Empty(t, log, "group middleware must not fire for /public")
+
+	// Hit the group route — middleware MUST run
+	log = nil
+	resp, _ = http.Get(srv.URL + "/api/users")
+	_ = resp.Body.Close()
+	assert.Equal(t, []string{"group:/api/users"}, log, "group middleware must fire for /api/users")
+}
+
+// Test: r.Use() inside MiddlewareGroup() scopes middleware to that group's routes
+func TestMiddlewareGroupUseIsScoped(t *testing.T) {
+	r := teapot.New()
+
+	var log []string
+	mw := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			log = append(log, "mw:"+req.URL.Path)
+			next.ServeHTTP(w, req)
+		})
+	}
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	r.MiddlewareGroup(func(r *teapot.Router) {
+		r.Use(mw)
+		r.GET("/protected", handler)
+	})
+	r.GET("/open", handler)
+
+	srv := httptest.NewServer(r)
+	defer srv.Close()
+
+	log = nil
+	resp, _ := http.Get(srv.URL + "/open")
+	_ = resp.Body.Close()
+	assert.Empty(t, log, "mw must not fire for /open")
+
+	log = nil
+	resp, _ = http.Get(srv.URL + "/protected")
+	_ = resp.Body.Close()
+	assert.Equal(t, []string{"mw:/protected"}, log, "mw must fire for /protected")
+}