- Shipped
- September 5, 2026 at 2:24 AM UTC
- Author
- Kamo
- Commit
- 1f019a5
Org resolution funnels every lookup through one query helper that swallows the exception and answers Optional.empty(). For an organization that genuinely is not there, that is right. For the transient SQLState 40001 that every DDL leaves behind for about fifteen minutes, it is a lie with teeth: the caller is told the hostname belongs to nobody, and since a729435 a sign-in whose host names no organization is refused. A schema change would therefore read to everyone on a white-labelled domain as "your workspace does not exist" — with nothing above WARN in the log and no error anywhere that mentions a database. byHost is one of the two lookups named in the write-up of the last window, and byId is reached by nearly every authenticated request, so both are covered by retrying in the one place they share. The retry sits INSIDE the try, ahead of the swallow, because by the time that catch has run there is no exception left to recognise. It is meaningful here precisely because this class is NOT @Transactional: each attempt is its own transaction, so the second one is not re-running inside a transaction the first already poisoned. Wrapping a caller instead would have retried nothing. Behaviour is unchanged in every other case: a permanent error and an absent organization both still answer empty, and both still cost exactly one query. Two constructors, so the four existing test classes that build this with a bare JdbcTemplate keep working; @Autowired marks the one Spring must use, which it will not work out for itself.