Why is injecting @Bean from different modules allowed?

[alfonsoristorato]

Hey there, my company decided to use modulith for a Greenfield project, and I am all for it and learning new stuff.

We have setup our project and started playing around with it, the .verify() works quite well in indicating us what injections are allowed and which aren't, however I noticed that @Bean are not verified along. This allows us to create a specific WebClient @Bean (for example) in module A and inject it in module B without modulith ever complaining about it.

I am trying to find info online and in the discussion here, but not finding much unfortunately. Is this an intended feature, or is there a way to disable such injections?

[alampada]

I've created an example project that mirrors our setup to show case the issue in question: https://github.com/alampada/modulith-beans/blob/main/src/main/kotlin/com/example/modulith/beans/a/DependantService.kt

In our test,
Module A is not allowed to depend on a Service defined in Module B nested packages. We are expecting that.
However, module A is allowed to depend on a RestClient bean defined in Module B nested package. We were not expecting that. Could you please help us understand?

[odrotbohm]

Spring Modulith's dependency verification operates on a type level, not on bean instances. Bean instance references into other modules is not something wrong per se, as it's natural for one module to invoke another module directly. Also, we can't constrain references to other beans, as we're not even operating on a BeanFactory but sole type references.

I guess we can explore the idea of constraining the injection of foreign module instances, but currently that's out of scope.