Repository navigation
ServerPlugin.registerAPI still hands third-party plugins a raw PathHandler, so their routes answer every HTTP method #10296
Description
Follow-up from #10157.
Gap
#10157 makes every plugin this repository ships (ha-raft, mcp, metrics) declare its HTTP routes with their method through the new com.arcadedb.server.http.PluginRoutes, so an undeclared method is answered 405 + Allow before the handler runs.
ServerPlugin.registerAPI(HttpServer, PathHandler) itself was left unchanged, for compatibility: a third-party plugin built against it still receives the raw PathHandler, and a route it adds with addExactPath/addPrefixPath still answers EVERY method. The server now only names such a route at WARNING at startup (PluginPathHandler) and exposes it through HttpServer.getUnrestrictedPluginRoutes(); it still serves it.
Entry point
ServerPlugin.registerAPI(HttpServer, PathHandler) as called from HttpServer.setupRoutes() for an out-of-tree plugin.
Why out of scope for #10157
Closing it at the type level means changing a public SPI signature (hand plugins a PluginRoutes, or refuse raw registrations), which breaks every external plugin at compile or start time. That is a breaking-API decision for a release boundary, not something to slip into a severity-critical bug fix.
Options
- Add
registerAPI(HttpServer, PluginRoutes)as the primary overload, deprecate thePathHandlerone, remove it in a later release. - Keep the signature, but refuse (fail the plugin's start) a raw registration behind a setting whose default flips in a later release.
Activity
feat(#10296): ServerPlugin.registerAPI hands plugins PluginRoutes ins…
robfrank commentedon Oct 18, 2026
Fixed in #10311 (option 1 from this issue).
ServerPlugingets a newregisterAPI(HttpServer, PluginRoutes)overload, so a plugin declares each route together with its HTTP methods. The oldregisterAPI(HttpServer, PathHandler)still works but is deprecated for removal, and the server logs a warning naming any plugin that still uses it. The built-in plugins (HA Raft, MCP, Prometheus) now use the new overload.Still open:
❤️ Thanks for helping make ArcadeDB better! ArcadeDB is free and open source, sustained by its community. If it's useful to you or your company, please consider becoming a sponsor to keep development going.
feat(#10296): ServerPlugin.registerAPI hands plugins PluginRoutes ins…