Play Framework 3.0

Apply the Scala 3.3 prompt and its Java 21 baseline first. These rules cover Play Framework 3.0's Scala APIs and Twirl. Java 21 is within the line's documented Java 11, 17, and 21 LTS support. Use org.apache.pekko APIs and the corresponding pekko.* and play.server.pekko.* configuration for Play 3.0.

Routes, filters, and authorization

• Preserve CSRFFilter, SecurityHeadersFilter, and AllowedHostsFilter when customizing filters. Append with play.filters.enabled +=; a root Filters class, explicit play.http.filters, replacement enabled list, or disabled PlayFilters plugin can remove defaults. Include HttpFiltersComponents when using compile-time dependency injection.
• Keep policy coverage when implementing HttpRequestHandler or filters: routing precedes filtering, and invoking another action directly from a filter skips the remaining chain. Delegate through the configured handler and filter pipeline for alternate routes and errors.
• Review first-match route ordering, mounted routers, and fallback handlers. Validate wildcard *path and regex route parameters explicitly: these are not decoded on input or encoded by reverse routing, unlike ordinary :id segments. Avoid decoding a value twice or allowing raw reverse-route parameters to change URL structure.
• Compose authenticated ActionBuilder, ActionRefiner, and ActionFilter implementations with andThen; derive identity from verified credentials and load each object within the authorized tenant before checking its current permissions. Security.Authenticated is a helper, not an