WIP 4.x

docs/asciidoc/body.adoc

@@ -48,7 +48,7 @@ Raw `request body` is available via javadoc:Context[body] method:
 <2> `HTTP Body` as `byte array`
 <3> `HTTP Body` as `InputStream`
 
-This give us the `raw body`.
+This gives us the `raw body`.
 
 ==== Message Decoder
 

docs/asciidoc/index.adoc

@@ -62,6 +62,7 @@ Latest Release: https://github.com/jooby-project/jooby/releases/tag/v{joobyVersi
 
 Looking for a previous version?
 
+* Access to link:v3[3.x] documentation. See link:/migration/4.x[migrating from 3.x to 4.x]
 * Access to link:v2[2.x] documentation. See link:/migration/3.x[migrating from 2.x to 3.x]
 * Access to link:v1[1.x] documentation.
 ====

docs/asciidoc/migration.adoc

@@ -1,3 +1,4 @@
+include::migration/4.x.adoc[]
 include::migration/3.x.adoc[]
 
 === Upgrading from 1.x to 2.x

docs/asciidoc/migration/4.x.adoc

@@ -0,0 +1,80 @@
+=== Upgrading from 3.x to 4.x
+You will find here notes/tips about how to migrate from 3.x to 4.x.
+
+[NOTE]
+=====
+This is a **work in progress** document, if something is wrong or missing please https://github.com/jooby-project/jooby/issues/new[report to Github] or better https://github.com/jooby-project/jooby/edit/3.x/docs/asciidoc/migration/4.x.adoc[edit this file and fix it]
+=====
+
+==== Requirements
+
+- Java 21 as minimum
+
+==== module-info.java
+
+Jooby is now compatible with Java Module system.
+
+Almost all Jooby components are now Java Modules, but not all them. For those where wasn't
+possible the Jooby module contains the `Automatic-Module-Name` manifest entry.
+
+==== Buffer API
+
+The package `io.jooby.buffer` is gone. It was replaced by `io.jooby.output` these classes
+are used mainly by the javadoc:MessageEncoder[] API, the new API is easier to use and has better
+performance.
+
+==== Value API
+
+The new package is now `io.jooby.value`. The API has now decoupled from javadoc:Context[] 
+in future release will be the basis of a new configuration system.
+
+Also, the `io.jooby.ValueNode` and `io.jooby.ValueNodeConverter` are gone.
+
+==== Session API
+
+For security reasons, the default HTTP session was removed. You need to configure the session
+explicitly and provide a cookie session name. The `jooby.sid` cookie name was removed from project. 
+
+==== Server configuration
+
+The `install(Server)`, `setServerOptions`, `start()` method are gone. With the new support for
+multiple applications in a single server, these methods are useless.
+
+The new way:
+
+.New way to boot
+----
+runApp(args, new NettyServer(new ServerOptions()), App::new);
+----
+
+
+==== Packages
+|===
+|3.x|4.x|Module
+|io.jooby.buffer| io.jooby.output | replacement jooby (core)
+|===
+
+==== Classes
+|===
+|3.x|4.x|Description|Module
+|io.jooby.buffer.*|-| removed | jooby (core)
+||io.jooby.output.*| new output API | jooby (core)
+|io.jooby.MvcFactory|-| was deprecated and now removed | jooby (core)
+|io.jooby.annotation.ResultType|-| removed | jooby (core)
+|io.jooby.ValueNode|io.jooby.value.Value| replaced/merged | jooby (core)
+|io.jooby.ValueNodeConverter|io.jooby.value.ValueConverter| replaced/merged | jooby (core)
+|io.jooby.RouteSet|io.jooby.Route.Set| moved into Route and renamed to Set | jooby (core)
+|===
+
+==== Method
+|===
+|2.x|3.x|Description
+|io.jooby.Jooby.setServerOptions()|Server.setOptions()| removed in favor of `Server.setOptions()`
+|io.jooby.Router.mvc|-| it was deprecated and now removed
+|io.jooby.Router.decorator|-| it was deprecated and now removed
+|io.jooby.Router.getConverters|io.jooby.Router.getValueFactory| replaced
+|io.jooby.Router.getBeanConverters|io.jooby.Router.getValueFactory| replaced
+|io.jooby.Router.attribute(String)|Router.getAttribute(String)| Renamed
+|io.jooby.Router.RouteOption|io.jooby.RouterOptions| Moved to `RouterOptions`
+|io.jooby.Router.setTrustProxy|RouterOptions.setTrustProxy| Moved to `RouterOptions`
+|===

docs/asciidoc/modules/redis.adoc

@@ -140,12 +140,12 @@ import io.jooby.redis.RedisSessionStore;
 import io.lettuce.core.RedisClient;
 
 {
-  install(new RedisModule());                                                     <1>
+  install(new RedisModule());                                                                    <1>
 
-  setSessionStore(new RedisSessionStore(require(RedisClient.class)));             <2>
+  setSessionStore(new RedisSessionStore(Cookie.session("myappid"), require(RedisClient.class))); <2>
 
   get("/", ctx -> {
-    Session httpSession = ctx.session();                                          <3>
+    Session httpSession = ctx.session();                                                         <3>
     // HTTP session is backed by Redis
   });
 }
@@ -160,12 +160,12 @@ import io.jooby.redis.RedisSessionStore
 import io.lettuce.core.RedisClient
 
 {
-  install(RedisModule())                                                           <1>
+  install(RedisModule())                                                                        <1>
 
-  sessionStore = RedisSessionStore(require(RedisClient::class))                    <2>
+  sessionStore = RedisSessionStore(Cookie.session("myappid"), require(RedisClient::class))      <2>
 
   get("/") {
-    val httpSession = ctx.session()                                                <3>
+    val httpSession = ctx.session()                                                             <3>
     // HTTP session is backed by Redis
   }
 }
@@ -179,4 +179,3 @@ More Options:
 
 - javadoc:redis.RedisSessionStore[setTimeout, java.time.Duration, artifact="jooby-redis"]: Set session timeout. Default is: `30 minutes`
 - javadoc:redis.RedisSessionStore[setNamespace, java.lang.String, artifact="jooby-redis"]: Set key prefix. Default is: `sessions`
-- javadoc:redis.RedisSessionStore[setToken, io.jooby.SessionToken, artifact="jooby-redis"]: Set session token. Default is a cookie token: `jooby.sid`

docs/asciidoc/session.adoc

@@ -13,10 +13,13 @@ objects. It's intended as a simple mechanism to store basic data (not an object
 
 Jooby provides the following javadoc:SessionStore[]:
 
-- In-Memory sessions - which you should combine with an a sticky sessions proxy if you plan to run multiple instances.
+- In-Memory sessions—which you should combine with a sticky sessions proxy if you plan to run multiple instances.
 - Cookie sessions signed with a secret key
 - JSON Web Token sessions
 
+Since 4.0.0 no session is configured by default. Attempt to access to a session at runtime results
+in exception.
+
 === In-Memory Session
 
 Default session store uses memory to save session data. This store:
@@ -28,6 +31,8 @@ Default session store uses memory to save session data. This store:
 [source,java,role="primary"]
 ----
 {
+  setSessionStore(SessionStore.memory(Cookie.session("myappid")));
+
   get("/", ctx -> {
     Session session = ctx.session();   // <1>
 
@@ -42,6 +47,8 @@ Default session store uses memory to save session data. This store:
 [source,kotlin,role="secondary"]
 ----
 {
+  setSessionStore(SessionStore.memory(Cookie.session("myappid")))
+
   get("/") {
     val session = ctx.session()        // <1>
 
@@ -56,7 +63,7 @@ Default session store uses memory to save session data. This store:
 <2> Set a session attribute
 <3> Get a session attribute
 
-Session token/ID is retrieved it from request cookie. Default session cookie is javadoc:SessionToken[SID, text=jooby.sid]. To customize cookie details:
+Session token/ID is retrieved it from request cookie. Default session cookie never expires, it is http only under the `/` path. To customize cookie details:
 
 .In-Memory Session with Custom Cookie
 [source,java,role="primary"]
@@ -92,7 +99,7 @@ Session token/ID is retrieved it from request cookie. Default session cookie is
 
 <1> Set an `in-memory` session store with a custom cookie named: `SESSION`
 
-Alternative you can use a request header to retrieve a session token/ID:
+Alternatively, you can use a request header to retrieve a session token/ID:
 
 .In-Memory Session with HTTP Header
 [source,java,role="primary"]
@@ -177,9 +184,9 @@ Data sign/unsign is done using javadoc:Cookie[sign, java.lang.String, java.lang.
 [source,java,role="primary"]
 ----
 {
-  String secret = "super secret key";              // <1>
+  String secret = "super secret key";                                         // <1>
 
-  setSessionStore(SessionStore.signed(secret));    // <2>
+  setSessionStore(SessionStore.signed(Cookie.session("myappid"), secret));    // <2>
 
   get("/", ctx -> {
     Session session = ctx.session();
@@ -195,9 +202,9 @@ Data sign/unsign is done using javadoc:Cookie[sign, java.lang.String, java.lang.
 [source,kotlin,role="secondary"]
 ----
 {
-  val secret = "super secret key"                  // <1>
+  val secret = "super secret key"                                            // <1>
 
-  sessionStore = SessionStore.signed(secret)       // <2>
+  sessionStore = SessionStore.signed(Cookie.session("myappid"),secret)       // <2>
 
   get("/") {
     val session = ctx.session()
@@ -220,7 +227,7 @@ Like with `memory` session store you can use HTTP headers:
 {
   String secret = "super secret key";                                            // <1>
 
-  setSessionStore(SessionStore.signed(secret, SessionToken.header("TOKEN")));    // <2>
+  setSessionStore(SessionStore.signed(SessionToken.header("TOKEN"), secret));    // <2>
 
   get("/", ctx -> {
     Session session = ctx.session();
@@ -238,7 +245,7 @@ Like with `memory` session store you can use HTTP headers:
 {
   val secret = "super secret key"                                                // <1>
 
-  sessionStore = SessionStore.signed(secret, SessionToken.header("TOKEN"))       // <2>
+  sessionStore = SessionStore.signed(SessionToken.header("TOKEN"), secret)       // <2>
 
   get("/") {
     val session = ctx.session()

jooby/pom.xml

@@ -95,7 +95,6 @@
       <version>3.4.15</version>
       <scope>test</scope>
     </dependency>
-
   </dependencies>
 
   <build>