- Shipped
- August 7, 2026 at 7:12 AM UTC
- Author
- Kamo
- Commit
- 000b93d
DepartmentService is a @Service, and every service carries @ComponentScan("com.kamo"), so all ~40 of them construct it. Giving it a MailboxRepository therefore required all ~40 to scan com.kamo.z.shared.email, and four do. MediaService CrashLooped on its next deploy -- a deploy with nothing to do with departments -- and 23 more were armed to follow. The repository is now held as an ObjectProvider and resolved where it is used, so a service that never assigns a mailbox starts as before, and one that tries without the scan gets a sentence telling it where to go instead of a dead context. Behaviour in SecurityService, which owns the endpoint, is unchanged: same lookup, same cross-tenant refusal. The guard that exists to catch precisely this skipped the file. It exempts everything under donotmodify on the grounds that every service scans the donotmodify dao packages, which is true and says nothing about a donotmodify bean reaching into another package. It now checks where each required repository actually lives, accepting the two idioms that survive a missing scan -- ObjectProvider and @Autowired(required = false) -- and recording the pre-existing commerce dependencies rather than pretending they are safe.