- Shipped
- August 3, 2026 at 4:39 AM UTC
- Author
- Kamo
- Commit
- c787aa7
@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and MfaRecoveryCodeRepository had no beans. MfaEnrollmentService is a @Service under the com.kamo component scan, so it is constructed regardless of whether this service uses it; without its repositories it cannot be built, SecurityController cannot be built, and the context fails to start. That takes down every login, not just MFA ones. This is the third entry in the same pattern, and the file already carried a comment about mlos.notification CrashLooping two earlier deploys for exactly this reason. I read that comment and still shipped the same defect, because the platform-wide component scan and the explicit repository scan disagree by design and nothing enforces the pairing. My MfaContextWiringTest did not catch it: it constructs the service with mock repositories, which proves the constructor is unambiguous but says nothing about whether Spring can find repository beans in a real application. A unit-level context runner cannot see a scan-configuration mismatch — only booting the actual application can.