Circular reference detected for service "restrict_by_ip.current_user"

I'm sorry, I don't see what renaming the config property of these classes could possibly have to do with a circular reference to a `recript_by_ip.current_user` service which is not even defined by this module.

I'm postponing this issue pending further explanation and may close later if there is no activity.

[edit: I see that service is actually defined by this module, I missed it the first time around - however the remainder of this comment stands]

I ran into this today. Here's a description provided by Claude Code:

The cause is structural, not config-related — the OP's property-rename patches are a red herring (darvanen's skepticism is correct).

restrict_by_ip decorates current_user and gives the decorator a heavy dependency subtree (restrict_by_ip.role_firewall → ip_tools / entity_type.manager). Whenever anything in that subtree transitively needs a logger, you get a cycle, because logging depends on current_user — which is now the decorator. The OP's path entered via logger.channel.file; on an Acquia stack it enters via acquia_connector → logger.factory. Same loop, different trigger.

This got worse in Drupal 10.3: core made current_user a hard constructor argument of logger.factory (change record). That turns this from an intermittent cycle (depends on whether a logger channel is eagerly built) into a deterministic failure on 10.3+ — it reliably breaks drush deploy when acquia_connector is enabled.

Minimal fix: mark restrict_by_ip.role_firewall as lazy: true so the current_user decorator receives a lazy proxy and its subtree isn't instantiated at container-compile time. This requires committing a generated proxy class (core/scripts/generate-proxy-class.php 'Drupal\restrict_by_ip\RoleFirewall' 'modules/contrib/restrict_by_ip/src'). Verified against 4.0.0-beta3 on Drupal 10.6: drush cr / drush updatedb pass and role-stripping still works.

Longer term, decorating current_user is inherently fragile (everything depends on it, so any added dependency is a latent cycle) — an event-subscriber approach to role stripping would avoid the decoration path entirely.

Attached is the patch it came up.

Thanks @bburg I'll take a look

I've been working on a new major version which includes an architectural overhaul, I'll put the full change in there and release an alpha soon.

@bburg it turns out the work applied cleanly to 8.x-4.x as well, would you mind trying it out? I'm attaching it as a patch for ease.

I've committed to 9.x so I can continue with other improvements, awaiting feedback on 8.x-4.x since that's in use on live sites.