I have this parent class. I include ApiHelpers module in it. I do not invoke authenticate! here to allow /hello to be my "healtheck" which does not require authentication:

# ApplicationController

class ApplicationController < Sinatra::Base
  helpers ApiHelpers

  before do
    content_type :json
  end

  get '/hello' do
    { message: 'Hello!' }.to_json
  end
end

A subclass of ApplicationController. I call authenticate! here before every request.

class ArticlesController < ApplicationController
  before do
    authenticate!
  end

  get '/articles' do
    articles = Article.all
    articles.map { |article| article.to_json }
  end
end

And ApiHelpers module.

module ApiHelpers
  def authenticate!
    halt 403, { message: 'Unauthorized!' }.to_json unless authorized?
  end

  private

  def authorized?
    request.env['HTTP_AUTHORIZATION'] == 'Bearer 123qweasd'
  end
end

# config.ru
# frozen_string_literal: true

root = ::File.dirname(__FILE__)
require ::File.join(root, 'app')

run ApplicationController
use ArticlesController

When I call /hello endpoint I get 403 Unauthorized even though the endpoint is defined in parent class where authenticate! is not called. authenticate! is called in subclass ArticlesController.

Actual behaviour

before block called in subclass is invoked also in before block in parent class.

Expected behaviour

before block called in subclass is not invoked in before block in parent class.

Is this a bug or am I doing something wrong?