router/internal/expr/expr.go (1)

40-47: Clarify cloning semantics: not a true deep copy.

Clone duplicates top-level maps/slices but intentionally does not deep-copy nested values (e.g., map/slice entries inside Claims). The comment “deep copy” is misleading.

Apply:

-// Clone creates a deep copy of the Context
+// Clone returns a copy of Context with fresh top-level maps/slices (Auth.Claims, Auth.Scopes, URL.Query).
+// Nested reference values inside Claims are not deep-copied by design. Nil inputs become non-nil, empty.
 func (copyCtx Context) Clone() *Context {

router/internal/expr/expr_test.go (2)

60-80: Good regression for URL.Query cloning; optional extra assertion.

Consider also asserting map instance inequality for consistency with the earlier pointer-based checks.

 		clone := exprContext.Clone()
 
 		require.Equal(t, exprContext.Request.URL.Query, clone.Request.URL.Query)
 
 		// Verify modifying clone doesn't affect original
 		clone.Request.URL.Query["new"] = "value2"
 		require.NotEqual(t, exprContext.Request.URL.Query, clone.Request.URL.Query)
+		// Also ensure different map instances
+		require.NotEqual(t,
+			reflect.ValueOf(exprContext.Request.URL.Query).Pointer(),
+			reflect.ValueOf(clone.Request.URL.Query).Pointer(),
+		)

---

132-178: Make shallow-copy intent explicit by mutating nested values in the test.

You already assert pointer equality for nested slice/map in Claims. Add a quick mutation to document the shared-reference behavior.

 		sliceFromOriginal := exprContext.Request.Auth.Claims["slice"].([]string)
 		sliceFromClone := clone.Request.Auth.Claims["slice"].([]string)
 		require.Equal(t, reflect.ValueOf(sliceFromOriginal).Pointer(), reflect.ValueOf(sliceFromClone).Pointer())
 
 		mapFromOriginal := exprContext.Request.Auth.Claims["map"].(map[string]string)
 		mapFromClone := clone.Request.Auth.Claims["map"].(map[string]string)
 		require.Equal(t, reflect.ValueOf(mapFromOriginal).Pointer(), reflect.ValueOf(mapFromClone).Pointer())
+
+		// Mutate via clone to make the contract explicit
+		sliceFromClone[0] = "x"
+		mapFromClone["key"] = "changed"
+		require.Equal(t, "x", sliceFromOriginal[0])
+		require.Equal(t, "changed", mapFromOriginal["key"])

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.