fix(kernel)!: register day-zero middleware before providers mount routes

togo.New() called Router.Use() AFTER applyProviders(), but providers (auth) mount
routes during applyProviders → chi panic 'all middlewares must be defined before
routes'. Reordered: Use/NotFound/MethodNotAllowed first, then applyProviders.
Regression test added.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: fadymondy

kernel.go

@@ -66,12 +66,14 @@ func New() *Kernel {
 		plugins:  Discovered(),
 	}
 	k.Log = defaultLogger() // baseline; the log plugin (if installed) overrides it
-	k.applyProviders()
-	// Day-zero error handling + logging, applied before any routes are mounted.
+	// Day-zero middleware MUST be registered before any provider mounts routes —
+	// chi forbids Use() after routes exist (e.g. the auth plugin adds routes).
 	k.Router.Use(k.recovery, k.requestLogger)
 	// The Go backend only serves API/GraphQL/docs, so unmatched routes return JSON.
 	k.Router.NotFound(jsonErrorHandler(http.StatusNotFound, "not found"))
 	k.Router.MethodNotAllowed(jsonErrorHandler(http.StatusMethodNotAllowed, "method not allowed"))
+	// Providers run last: some (auth) mount routes + their own middleware.
+	k.applyProviders()
 	return k
 }
 

kernel_mw_test.go

@@ -0,0 +1,25 @@
+package togo
+
+import (
+	"net/http"
+	"testing"
+)
+
+// A provider that mounts routes + its own middleware (like auth) must not make
+// New() panic ("Use after routes"). Regression for the chi ordering bug.
+func TestNewWithRouteMountingProvider(t *testing.T) {
+	RegisterProviderFunc("test-routes", PriorityLate, func(k *Kernel) error {
+		k.Router.Use(func(next http.Handler) http.Handler { return next })
+		k.Router.Get("/_test", func(w http.ResponseWriter, r *http.Request) {})
+		return nil
+	})
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("New() panicked: %v", r)
+		}
+	}()
+	k := New()
+	if k.Router == nil {
+		t.Fatal("nil router")
+	}
+}