NamespaceAccessFilter is @ApplicationScoped but constructor-injects a request-scoped SecurityIdentity (NamespaceAccessFilter.java:26,30,37). Works today because every call happens on a request thread, where CDI resolves the identity through its normal-scope proxy.
Risk: called from a non-request context — a @Scheduled sync tick, or GitHubStartupInitializer's startup thread — and the proxy has no active request to delegate to. Throws ContextNotActiveException.
Fix: confirm (and document) that this filter is never reachable off a request thread, or restructure so it doesn't depend on request-scoped state outside one.
NamespaceAccessFilteris@ApplicationScopedbut constructor-injects a request-scopedSecurityIdentity(NamespaceAccessFilter.java:26,30,37). Works today because every call happens on a request thread, where CDI resolves the identity through its normal-scope proxy.Risk: called from a non-request context — a
@Scheduledsync tick, orGitHubStartupInitializer's startup thread — and the proxy has no active request to delegate to. ThrowsContextNotActiveException.Fix: confirm (and document) that this filter is never reachable off a request thread, or restructure so it doesn't depend on request-scoped state outside one.