$ show apache/shiro
Apache Shiro is a mature Java security framework and library, not an end-user application. It provides authentication, authorization, session management, and cryptography through a modular Maven multi-module architecture. The central abstractions are SecurityManager, Subject, Realm, Authenticator, Authorizer, and SessionManager, backed by pluggable implementations such as JDBC, LDAP, Active Directory, and text-based realms. The web module adds servlet filters, filter-chain management, JSP/JSF tags, and path-matching URL security, while support modules integrate with Spring, Spring Boot, Guice, CDI, JAX-RS, AspectJ, Quartz, and Jakarta EE. The crypto modules offer modern password hashing (Argon2, BCrypt), legacy SHA hashing, symmetric ciphers, and hash format serialization. The framework is embeddable via programmatic configuration, annotation-driven AOP interceptors, or the legacy INI-based configuration path, which is now deprecated in favor of environment-based setup. The codebase is heavily tested with unit tests and container-based integration tests, and core interfaces remain small and clean; however, it carries noticeable legacy baggage including deprecated factories, duplicated JSP/JSF tag implementations, mixed mocking frameworks, and numerous support modules that require ongoing maintenance to avoid drift. It has no data pipelines or research components; all data-related code is limited to security data sources, caching, and test fixtures.
The LLM identified 5 files worth highlighting for reuse:
A generic annotation-driven event bus that resolves @Subscribe listeners, orders them, and dispatches events with proper lifecycle handling. It is self-contained within the small event module and could be extracted into any Java project requiring lightweight pub/sub communication without external dependencies.
A Map implementation using soft references and a reference queue to automatically evict entries when memory is pressured. It is a pure Java utility with no internal framework coupling, making it directly reusable in any application needing a memory-sensitive cache map.
Implements a flexible multi-level wildcard permission model ('domain:action:instance') with support for partial wildcards, list matching, and case-insensitive comparison. The class is nearly standalone and demonstrates non-obvious parsing and pruning logic that can be reused in any authorization system requiring string-based permission expressions.
A robust Ant-style path matcher supporting '?', '*', and '**' wildcards, used by Shiro's filter chain resolver. It is a self-contained utility with minimal internal dependencies, and could be lifted into any Java web application or routing library that needs hierarchical path pattern matching.
Resolves hash format implementations by heuristic class naming and ServiceLoader-based HashSpi discovery, enabling modular crypt format strings (e.g., Shiro1, BCrypt, Argon2) to be parsed without a central registry. The pattern is reusable for any pluggable serialization/format factory that needs to discover implementations dynamically.