ExposedConnectionProvider is the only one of okapi-exposed's three core classes that doesn't take an explicit Database constructor parameter. ExposedTransactionRunner(database) and ExposedTransactionContextValidator(database) are both correctly scoped — the validator explicitly uses the per-database database.transactionManager.currentOrNull() and is tested against nested multi-database transactions. ExposedConnectionProvider instead uses the global, thread-local TransactionManager.currentOrNull() — "whichever Exposed transaction is currently innermost-active on this thread" — with no verification it's the intended database.
This matters because ConnectionProvider isn't just used for metrics/lag polling: PostgresOutboxStore/MysqlOutboxStore route every operation through it (persist, claimPending, updateAfterProcessing, removeDeliveredBefore, findOldestCreatedAt, countByStatuses). In an app with multiple Database instances, if ExposedConnectionProvider.withConnection is called while a different database's transaction happens to be innermost-active (e.g. nested transaction(otherDb) { ... publish() ... }), it silently returns the wrong connection — no error. FOR UPDATE SKIP LOCKED claims or publish() writes could land against the wrong database, silently.
There is currently no test coverage anywhere in the repo (unit or integration) exercising okapi-exposed's classes in a multi-database scenario.
Fix direction: add a required database: Database constructor parameter to ExposedConnectionProvider, matching its two siblings, and swap the global TransactionManager.currentOrNull() for database.transactionManager.currentOrNull(). This is a breaking API change — only one call site exists in-repo (a test), but it needs a major version bump and a CHANGELOG.md BREAKING entry given the project is now past 1.0.0. Should also add multi-DB unit tests mirroring ExposedTransactionContextValidatorTest.kt's coverage, an integration test analogous to MultiDataSourceTransactionTest.kt, and a short "multiple databases" usage note in the README (currently absent for okapi-exposed).
ExposedConnectionProvideris the only one of okapi-exposed's three core classes that doesn't take an explicit Database constructor parameter.ExposedTransactionRunner(database)andExposedTransactionContextValidator(database)are both correctly scoped — the validator explicitly uses the per-database database.transactionManager.currentOrNull() and is tested against nested multi-database transactions. ExposedConnectionProvider instead uses the global, thread-localTransactionManager.currentOrNull()— "whichever Exposed transaction is currently innermost-active on this thread" — with no verification it's the intended database.This matters because
ConnectionProviderisn't just used for metrics/lag polling:PostgresOutboxStore/MysqlOutboxStoreroute every operation through it (persist, claimPending, updateAfterProcessing, removeDeliveredBefore, findOldestCreatedAt, countByStatuses). In an app with multiple Database instances, if ExposedConnectionProvider.withConnection is called while a different database's transaction happens to be innermost-active (e.g. nested transaction(otherDb) { ... publish() ... }), it silently returns the wrong connection — no error. FOR UPDATE SKIP LOCKED claims or publish() writes could land against the wrong database, silently.There is currently no test coverage anywhere in the repo (unit or integration) exercising okapi-exposed's classes in a multi-database scenario.
Fix direction: add a required database: Database constructor parameter to ExposedConnectionProvider, matching its two siblings, and swap the global TransactionManager.currentOrNull() for database.transactionManager.currentOrNull(). This is a breaking API change — only one call site exists in-repo (a test), but it needs a major version bump and a CHANGELOG.md BREAKING entry given the project is now past 1.0.0. Should also add multi-DB unit tests mirroring ExposedTransactionContextValidatorTest.kt's coverage, an integration test analogous to MultiDataSourceTransactionTest.kt, and a short "multiple databases" usage note in the README (currently absent for okapi-exposed).