# What Programming Language Is CoSec Written In? A Complete Kotlin Analysis

> Discover what programming language CoSec is written in. This complete analysis explores Kotlin's role in the ahoo-wang/cosec repository and its key features.

- Repository: [Ahoo Wang/cosec](https://github.com/ahoo-wang/cosec)
- Tags: analysis
- Published: 2026-02-23

---

**CoSec is written entirely in Kotlin**, leveraging the language's extension functions, coroutines-friendly APIs, and the Kotlin DSL for Gradle build configuration.

CoSec (the CoSecurity framework) is an open-source security project hosted at `ahoo-wang/cosec`. If you are investigating what programming language CoSec is written in, the codebase provides a definitive answer: every implementation file uses the `.kt` extension, and the build logic is defined exclusively in `.kts` scripts.

## Core Implementation Language: Kotlin

### Policy Engine and Action Matchers

The authorization logic in CoSec resides in Kotlin classes within the `cosec-core` module. The `PathActionMatcher` class, located at [`cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt`](https://github.com/ahoo-wang/cosec/blob/main/cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt), demonstrates the primary programming language used throughout the repository:

```kotlin
// cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt
class PathActionMatcher(
    private val patternParser: PathPatternParser,
    private val pathPattern: PathPattern,
    configuration: Configuration
) : AbstractActionMatcher(PathActionMatcherFactory.TYPE, configuration) {

    override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
        PathContainer.parsePath(request.path, patternParser.pathOptions)
            .let { pathContainer ->
                val matchInfo = pathPattern.matchAndExtract(pathContainer) ?: return false
                securityContext.setPathVariables(matchInfo.uriVariables)
                return true
            }
    }
}

```

This implementation showcases Kotlin-specific features including the `let` scope function, null-safety operators, and expression-oriented programming. The `internalMatch` method leverages Kotlin's concise syntax to parse paths and extract URI variables for the security context.

### Policy Configuration with Kotlin DSL

CoSec exposes a Kotlin-friendly API for constructing security policies programmatically. While policies are often defined in JSON (referenced via [`schema/cosec-policy.schema.json`](https://github.com/ahoo-wang/cosec/blob/main/schema/cosec-policy.schema.json)), you can instantiate matchers using Kotlin code:

```kotlin
val policyJson = """
{
  "id": "example",
  "action": {
    "path": { "pattern": "/api/**" }
  },
  "condition": { "authenticated": {} }
}
""".trimIndent()

val policy = JsonConfiguration.fromJson(policyJson)
val matcher = PathActionMatcherFactory.INSTANCE.create(policy.getRequired("action"))

```

This pattern demonstrates how CoSec integrates Kotlin's type-safe configuration with JSON policy definitions.

## Build System: Gradle Kotlin DSL

CoSec uses the **Gradle Kotlin DSL** exclusively for its build system. The root project configuration is defined in `build.gradle.kts`, while module-specific builds like `cosec-core/build.gradle.kts` manage dependencies using Kotlin syntax:

```kotlin
dependencies {
    implementation("org.springframework.boot:spring-boot-starter-webflux")
    implementation("com.google.guava:guava")
}

```

The use of `.kts` files rather than Groovy `.gradle` scripts confirms that Kotlin serves as both the implementation and build configuration language for the project.

## Key Kotlin Language Features in CoSec

The repository exploits several advanced Kotlin capabilities that confirm what programming language powers the framework:

- **Extension functions**: Used to extend `SecurityContext` and other domain objects without inheritance, enabling fluent API designs throughout the codebase.
- **Coroutines-friendly APIs**: Integration with Spring WebFlux leverages Kotlin's suspend functions and reactive programming models for non-blocking security checks.
- **Type-safe builders**: The configuration DSL for policy creation utilizes Kotlin's builder pattern capabilities to ensure compile-time validation of security rules.

## Repository Structure and Source Locations

Understanding what programming language CoSec is written in becomes evident when examining the source tree:

- [`cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt`](https://github.com/ahoo-wang/cosec/blob/main/cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt) — Core action matching logic implemented in Kotlin
- `build.gradle.kts` — Root build script using Kotlin DSL  
- `cosec-core/build.gradle.kts` — Module-level build configuration in Kotlin
- [`schema/cosec-policy.schema.json`](https://github.com/ahoo-wang/cosec/blob/main/schema/cosec-policy.schema.json) — JSON schema referenced by Kotlin code for policy validation

All test suites and example applications within the repository also reside in `src/test/kotlin` directories, confirming Kotlin as the sole implementation language across the entire project.

## Summary

- CoSec is implemented entirely in **Kotlin**, with all source files using the `.kt` extension.
- The project uses **Gradle Kotlin DSL** (`.kts` files) exclusively for build configuration.
- Core security components like `PathActionMatcher` leverage Kotlin-specific features such as scope functions (`let`), null-safety, and sealed classes.
- The framework integrates with **Spring WebFlux/WebMvc** using Kotlin-friendly reactive APIs and coroutines support.
- Policy configuration supports both JSON definitions and programmatic Kotlin DSL construction.

## Frequently Asked Questions

### Is CoSec written in Java or Kotlin?

CoSec is written entirely in **Kotlin**. While it runs on the JVM and interoperates with Java libraries like Spring Framework, all source files use the `.kt` extension and implement Kotlin idioms such as extension functions, data classes, and the `let` scope function seen in [`PathActionMatcher.kt`](https://github.com/ahoo-wang/cosec/blob/main/PathActionMatcher.kt).

### Does CoSec use Spring Framework?

Yes. According to the source code in `ahoo-wang/cosec`, the framework integrates with **Spring WebFlux** and **Spring WebMvc**. The `build.gradle.kts` references `spring-boot-starter-webflux`, and the security context implementations are designed to work within Spring's reactive stack using Kotlin coroutines.

### What build tool does CoSec use?

CoSec uses **Gradle** with the **Kotlin DSL**. All build scripts use the `.kts` extension, including the root `build.gradle.kts` and module-specific scripts like `cosec-core/build.gradle.kts`. This allows type-safe build configuration using Kotlin syntax rather than Groovy.

### Can I write CoSec policies in Kotlin?

While the CoSec engine is implemented in Kotlin, policies are typically defined in **JSON** format according to the schema at [`schema/cosec-policy.schema.json`](https://github.com/ahoo-wang/cosec/blob/main/schema/cosec-policy.schema.json). However, you can programmatically construct and load policies using Kotlin code by leveraging `JsonConfiguration.fromJson()` and the configuration DSL exposed by the framework's Kotlin API.