refactor: resolve app services through injected containers, never the global server

[rubenvdlinde]

Why

On 2026-09-08 an openregister unit test took 19 GB of RAM and 6 GB of swap, twice, and rebooted the developer VM. PR #3523 fixed the bootstrap and four classes. This finishes the job.

Outside a booted Nextcloud, \OC::$server->get() and \OCP\Server::get() autowire this app's services from scratch, and MagicMapper -> SettingsService -> ValidationOperationsHandler -> ValidateObject is a constructor cycle the container has no detection for. Inside a booted server the same call is merely a hidden dependency that no unit test can control.

What changed

Services and controllers now resolve through what they already own. Where the looked-up thing was a collaborator the class could simply hold, it became a constructor argument: the search trail mapper, the magic mapper's register and schema mappers, the organisation controller's user session. Where the lookup has to stay lazy or dynamic, it goes through an injected Psr\Container\ContainerInterface: the eight background jobs, the link services, the relations controller, the grant resolver.

Tests register on a per-test container mock. A new RegistersContainerServices trait replaces registering mocks on the process-wide fake server, which never reset and leaked mocks between tests. BlobMigrationJobTest no longer needs its capture-and-restore dance or its skip, so its cases actually run.

The nine remaining lookups are marked, not hidden. Each carries a phpcs:ignore naming why it stays:

site	why it stays
SharesProvider, ShareLinkService (2 methods each)	PSR-11 adapter shims that ARE the container handed to a collaborator, so there is nothing to inject into them
DoriathApplicationRegistrar, DoriathCredentialStore	optional sibling app (keepiq), guarded by class_exists and try/catch, absent on most instances
AnonymisationBackendService	optional AppAPI PublicFunctions, same guards
CospendProvider	last-resort fallback, tried only after the injected container
Db\Schema	an entity, not a DI-built class; its guarded lookup was already documented

Also: psalm and phpmd get explicit 2G limits in composer.json, and the NoLegacyServerAccessors sniff test runs again. It was skipped for a PHP_CodeSniffer 3.9 bug and pointed at a copy of the sniff this repo no longer carries, so for months it guarded nothing. PHPCS is at 3.13 now.

Two dead branches removed that static analysis flagged: AgentMapper::findByUuid returns a non-nullable Agent and throws on a miss, so the null check after it could never run; IResponse::getHeader returns an array, so its null coalesce could never fire. Neither changes behaviour.

Verified locally

Check	Result
phpunit tests/Unit --no-coverage	19,454 tests, exit 0, peak 454 MB, 105 s
phpcs --standard=phpcs.xml on all 47 touched lib files	exit 0
fleet sniff (NoServiceLocator) on lib	0 unannotated lookups

The fleet sniff is the one from ConductionNL/.github branch feat/no-service-locator-sniff, which lands after the per-app refactors so no app goes red on arrival.

Not in this PR

lib/AppInfo, lib/AppHost and lib/Migration keep their lookups: they run before or outside DI, and the sniff excludes them by path.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ 90e1994

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	❌
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 543/543
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					❌

---

Quality workflow — 2026-09-08 09:27 UTC

Download the full PDF report from the workflow artifacts.