Vaadin Kubernetes Kit throws an exception while handling transient beans with scope “vaadin-ui” or “vaadin-session”

[myronenkom]

Hello,
Recently, we’ve encountered an issue related to session serialization in the Vaadin Kubernetes Kit. The problem occurs during the serialization of a bean that injects another bean with a scope of either “vaadin-ui” or “vaadin-session.”

Here’s a brief overview of the issue:

1. During serialization, the com.vaadin.kubernetes.starter.sessiontracker.serialization.TransientInjectableObjectOutputStream attempts to handle the transient injectable fields.
2. At some point, it calls SpringTransientHandler#detectBean to retrieve the injectable bean from the context.
3. The context then tries to handle the scope and invokes the VaadinUIScope or VaadinSessionScope post processor.
4. However, this process fails because it requires access to the VaadinSession, which is not present in the thread where serialization is performed.
5. As a result, an exception is thrown at com.vaadin.flow.spring.scopes.AbstractScope.java:73.

Here is the project to reproduce the issue https://github.com/myronenkom/kubernates-kit-issue

Stack trace attached
Session Serialization issue stack trace.txt

[mcollovati]

Serialization and deserialization of Vaadin scoped beans into transient fields fails because VaadinSession and UI thread locals are not set, causing an exception when accessing the bean store to detect/retrieve the bean reference.

The serialization part can be fixed in flow (see linked issue) by setting the thread locals in serialiaziont write hooks.
However, the deserialization part should be fixed in Kubernetes Kit because injection of transient fields happens after deserialization of the session attributes.

The fix could be to add VaadinSession and UI fields to TransientAwareHolder (should not have a big impact on the overall size of the serialized data), so that during injection it should be possible to set the thread locals.
In addition, VaadinSessionScope locks VaadinSession, but after deserialization the lock instance is not yet set. So, a temporary lock must be forced into the VaadinSession instance while applying field injections, and removed immediately after.