What Programming Language Is CoSec Written In? A Complete Kotlin Analysis

CoSec is written entirely in Kotlin, leveraging the language's extension functions, coroutines-friendly APIs, and the Kotlin DSL for Gradle build configuration.

CoSec (the CoSecurity framework) is an open-source security project hosted at ahoo-wang/cosec. If you are investigating what programming language CoSec is written in, the codebase provides a definitive answer: every implementation file uses the .kt extension, and the build logic is defined exclusively in .kts scripts.

Core Implementation Language: Kotlin

Policy Engine and Action Matchers

The authorization logic in CoSec resides in Kotlin classes within the cosec-core module. The PathActionMatcher class, located at cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt, demonstrates the primary programming language used throughout the repository:

// cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt
class PathActionMatcher(
    private val patternParser: PathPatternParser,
    private val pathPattern: PathPattern,
    configuration: Configuration
) : AbstractActionMatcher(PathActionMatcherFactory.TYPE, configuration) {

    override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
        PathContainer.parsePath(request.path, patternParser.pathOptions)
            .let { pathContainer ->
                val matchInfo = pathPattern.matchAndExtract(pathContainer) ?: return false
                securityContext.setPathVariables(matchInfo.uriVariables)
                return true
            }
    }
}

This implementation showcases Kotlin-specific features including the let scope function, null-safety operators, and expression-oriented programming. The internalMatch method leverages Kotlin's concise syntax to parse paths and extract URI variables for the security context.

Policy Configuration with Kotlin DSL

CoSec exposes a Kotlin-friendly API for constructing security policies programmatically. While policies are often defined in JSON (referenced via schema/cosec-policy.schema.json), you can instantiate matchers using Kotlin code:

val policyJson = """
{
  "id": "example",
  "action": {
    "path": { "pattern": "/api/**" }
  },
  "condition": { "authenticated": {} }
}
""".trimIndent()

val policy = JsonConfiguration.fromJson(policyJson)
val matcher = PathActionMatcherFactory.INSTANCE.create(policy.getRequired("action"))

This pattern demonstrates how CoSec integrates Kotlin's type-safe configuration with JSON policy definitions.

Build System: Gradle Kotlin DSL

CoSec uses the Gradle Kotlin DSL exclusively for its build system. The root project configuration is defined in build.gradle.kts, while module-specific builds like cosec-core/build.gradle.kts manage dependencies using Kotlin syntax:

dependencies {
    implementation("org.springframework.boot:spring-boot-starter-webflux")
    implementation("com.google.guava:guava")
}

The use of .kts files rather than Groovy .gradle scripts confirms that Kotlin serves as both the implementation and build configuration language for the project.

Key Kotlin Language Features in CoSec

The repository exploits several advanced Kotlin capabilities that confirm what programming language powers the framework:

• Extension functions: Used to extend SecurityContext and other domain objects without inheritance, enabling fluent API designs throughout the codebase.
• Coroutines-friendly APIs: Integration with Spring WebFlux leverages Kotlin's suspend functions and reactive programming models for non-blocking security checks.
• Type-safe builders: The configuration DSL for policy creation utilizes Kotlin's builder pattern capabilities to ensure compile-time validation of security rules.

Repository Structure and Source Locations

Understanding what programming language CoSec is written in becomes evident when examining the source tree:

• cosec-core/src/main/kotlin/me/ahoo/cosec/policy/action/PathActionMatcher.kt — Core action matching logic implemented in Kotlin
• build.gradle.kts — Root build script using Kotlin DSL
• cosec-core/build.gradle.kts — Module-level build configuration in Kotlin
• schema/cosec-policy.schema.json — JSON schema referenced by Kotlin code for policy validation

All test suites and example applications within the repository also reside in src/test/kotlin directories, confirming Kotlin as the sole implementation language across the entire project.

Summary

• CoSec is implemented entirely in Kotlin, with all source files using the .kt extension.
• The project uses Gradle Kotlin DSL (.kts files) exclusively for build configuration.
• Core security components like PathActionMatcher leverage Kotlin-specific features such as scope functions (let), null-safety, and sealed classes.
• The framework integrates with Spring WebFlux/WebMvc using Kotlin-friendly reactive APIs and coroutines support.
• Policy configuration supports both JSON definitions and programmatic Kotlin DSL construction.

Frequently Asked Questions

Is CoSec written in Java or Kotlin?

CoSec is written entirely in Kotlin. While it runs on the JVM and interoperates with Java libraries like Spring Framework, all source files use the .kt extension and implement Kotlin idioms such as extension functions, data classes, and the let scope function seen in PathActionMatcher.kt.

Does CoSec use Spring Framework?

Yes. According to the source code in ahoo-wang/cosec, the framework integrates with Spring WebFlux and Spring WebMvc. The build.gradle.kts references spring-boot-starter-webflux, and the security context implementations are designed to work within Spring's reactive stack using Kotlin coroutines.

What build tool does CoSec use?

CoSec uses Gradle with the Kotlin DSL. All build scripts use the .kts extension, including the root build.gradle.kts and module-specific scripts like cosec-core/build.gradle.kts. This allows type-safe build configuration using Kotlin syntax rather than Groovy.

Can I write CoSec policies in Kotlin?

While the CoSec engine is implemented in Kotlin, policies are typically defined in JSON format according to the schema at schema/cosec-policy.schema.json. However, you can programmatically construct and load policies using Kotlin code by leveraging JsonConfiguration.fromJson() and the configuration DSL exposed by the framework's Kotlin API.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}