fix(security): make self-proxied transactional persist methods protected (not package-private)

registerNewUserAccount, changeUserPassword, and setInitialPassword route their DB
write back through the @lazy self proxy (self.persistNewUserAccount /
persistChangedPassword / persistInitialPassword) so the short @transactional applies
after the bcrypt hash runs outside any transaction. Those persist* methods were
package-private. In Spring Framework 7 the CGLIB proxy subclass is generated in a
different package, so it cannot override package-private methods: self.persistX(...)
then executes the inherited body on the proxy instance — whose @Autowired fields are
never injected — throwing NullPointerException ("this.userRepository is null") and
silently dropping the transaction. This broke registration, password change, password
reset, and set-initial-password for consumers.

Caught by the demo-app Playwright E2E (Spring Boot 4.0.4); the library's own CI runs
4.0.6, where the behavior is masked — so a @SpringBootTest on the pinned CI version
cannot be relied on to catch it. Fix by making the three methods protected (CGLIB
overrides public/protected across packages; matches the already-correct protected
GdprDeletionService.executeUserDeletion and public UserEmailService.createPasswordResetTokenForUser).

Add SelfProxiedMethodVisibilityTest: a version-independent, bytecode-level guard that
fails fast if any self-proxied method is ever made package-private/private again.

Author: devondragon

src/main/java/com/digitalsanctuary/spring/user/service/UserService.java

@@ -372,18 +372,21 @@ public User registerNewUserAccount(final UserDto newUserDto) {
 	 * <p>
 	 * Internal seam: this method exists only to split the DB write away from the bcrypt hash. It MUST
 	 * be invoked through the Spring proxy (via {@link #self}) so the transaction applies. It is
-	 * deliberately <b>package-private</b> so consumers cannot call it directly and bypass the
-	 * centralized RegistrationGuard enforced by {@link #registerNewUserAccount(UserDto)}; CGLIB
-	 * self-invocation still applies the transaction because Spring's proxy subclass is generated in
-	 * this same package.
+	 * deliberately <b>protected</b> so consumers cannot call it directly and bypass the centralized
+	 * RegistrationGuard enforced by {@link #registerNewUserAccount(UserDto)}. It must be
+	 * {@code protected} rather than package-private: the CGLIB proxy subclass is generated in a
+	 * different package, so it can only override (and therefore advise/route) {@code public} or
+	 * {@code protected} methods. A package-private method is not overridden, so the {@code self}
+	 * invocation would execute on the proxy instance — whose {@code @Autowired} fields are never
+	 * populated — and both the transaction and the dependencies would be missing.
 	 * </p>
 	 *
 	 * @param user the fully built user entity (password already encoded)
 	 * @return the saved user entity
 	 * @throws UserAlreadyExistException if an account with the same email already exists
 	 */
 	@Transactional(isolation = Isolation.SERIALIZABLE)
-	User persistNewUserAccount(final User user) {
+	protected User persistNewUserAccount(final User user) {
 		if (emailExists(user.getEmail())) {
 			log.debug("UserService.persistNewUserAccount: email already exists: {}", user.getEmail());
 			throw new UserAlreadyExistException(
@@ -755,15 +758,18 @@ public void changeUserPassword(final User user, final String password) {
 	 * <p>
 	 * Internal seam: this method exists only to split the DB write away from the bcrypt hash. It MUST
 	 * be invoked through the Spring proxy (via {@link #self}) so the transaction applies. It is
-	 * deliberately <b>package-private</b> so it is not part of the public API; CGLIB self-invocation
-	 * still applies the transaction because Spring's proxy subclass is generated in this same package.
+	 * <b>protected</b> so it stays out of the public API yet remains overridable by the CGLIB proxy
+	 * subclass — which is generated in a different package and therefore cannot override a
+	 * package-private method. A package-private method would not be advised and the {@code self}
+	 * invocation would run on the proxy instance (whose {@code @Autowired} fields are null), so it
+	 * must be {@code protected} (or public).
 	 * </p>
 	 *
 	 * @param user            the user whose password changed (password field already set/encoded)
 	 * @param encodedPassword the already-encoded password to record in history
 	 */
 	@Transactional
-	void persistChangedPassword(final User user, final String encodedPassword) {
+	protected void persistChangedPassword(final User user, final String encodedPassword) {
 		userRepository.save(user);
 		savePasswordHistory(user, encodedPassword);
 		// Force re-auth on a password change (OWASP). By default the current session is preserved and
@@ -856,15 +862,18 @@ public void setInitialPassword(User user, String rawPassword) {
 	 * <p>
 	 * Internal seam: this method exists only to split the DB write away from the bcrypt hash. It MUST
 	 * be invoked through the Spring proxy (via {@link #self}) so the transaction applies. It is
-	 * deliberately <b>package-private</b> so it is not part of the public API; CGLIB self-invocation
-	 * still applies the transaction because Spring's proxy subclass is generated in this same package.
+	 * <b>protected</b> so it stays out of the public API yet remains overridable by the CGLIB proxy
+	 * subclass — which is generated in a different package and therefore cannot override a
+	 * package-private method. A package-private method would not be advised and the {@code self}
+	 * invocation would run on the proxy instance (whose {@code @Autowired} fields are null), so it
+	 * must be {@code protected} (or public).
 	 * </p>
 	 *
 	 * @param user            the user whose initial password is being set (password field already set)
 	 * @param encodedPassword the already-encoded password to record in history
 	 */
 	@Transactional
-	void persistInitialPassword(final User user, final String encodedPassword) {
+	protected void persistInitialPassword(final User user, final String encodedPassword) {
 		userRepository.save(user);
 		savePasswordHistory(user, encodedPassword);
 	}

src/test/java/com/digitalsanctuary/spring/user/architecture/SelfProxiedMethodVisibilityTest.java

@@ -0,0 +1,78 @@
+package com.digitalsanctuary.spring.user.architecture;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.util.Arrays;
+import java.util.List;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import com.digitalsanctuary.spring.user.gdpr.GdprDeletionService;
+import com.digitalsanctuary.spring.user.service.UserEmailService;
+import com.digitalsanctuary.spring.user.service.UserService;
+
+/**
+ * Structural guard for the Spring self-invocation proxy pattern used across the service layer.
+ *
+ * <p>
+ * Several services split a slow, non-transactional step (e.g. bcrypt hashing) from the short DB write by routing the
+ * write back through their own Spring proxy: {@code self.persistX(...)} where {@code self} is an
+ * {@code @Lazy @Autowired} reference to the same bean. For that to work the target method <strong>must be
+ * {@code public} or {@code protected}</strong>: Spring generates the CGLIB proxy subclass in a <em>different</em>
+ * package, so it can only override (and therefore advise + route) {@code public}/{@code protected} methods. A
+ * <em>package-private</em> target is not overridden, so {@code self.persistX(...)} executes the inherited body on the
+ * proxy instance — whose {@code @Autowired} fields were never populated — yielding a {@link NullPointerException} (e.g.
+ * {@code "this.userRepository" is null}) and silently dropping the transaction.
+ * </p>
+ *
+ * <p>
+ * This bug is <strong>version-dependent at runtime</strong>: it reproduces on some Spring Framework patch releases and
+ * is masked on others, so a {@code @SpringBootTest} on the CI's pinned Spring version cannot be relied on to catch a
+ * regression. This bytecode-level visibility check is version-independent and fails fast if any self-proxied method is
+ * ever made package-private (or private) again.
+ * </p>
+ *
+ * <p>
+ * Note: this rule is intentionally scoped to the specific methods invoked via {@code self}. Other package-private
+ * {@code @Transactional} helpers (e.g. {@code RolePrivilegeSetupService.getOrCreateRole}) are called via {@code this}
+ * from within an already-transactional method and run in the caller's transaction, so they do not need to be proxied.
+ * </p>
+ */
+@DisplayName("Self-proxied (@Lazy self) transactional methods must be proxyable (public/protected)")
+class SelfProxiedMethodVisibilityTest {
+
+    /**
+     * Every method that is invoked through a {@code self} proxy reference in the production code. Keep this list in
+     * sync with the {@code self.<method>(...)} call sites in the service/gdpr packages.
+     */
+    static List<Arguments> selfProxiedMethods() {
+        return List.of(Arguments.of(UserService.class, "persistNewUserAccount"),
+                Arguments.of(UserService.class, "persistChangedPassword"),
+                Arguments.of(UserService.class, "persistInitialPassword"),
+                Arguments.of(GdprDeletionService.class, "executeUserDeletion"),
+                Arguments.of(UserEmailService.class, "createPasswordResetTokenForUser"));
+    }
+
+    @ParameterizedTest(name = "{0}#{1} is public or protected")
+    @MethodSource("selfProxiedMethods")
+    void selfInvokedMethodMustBeProxyable(final Class<?> declaringClass, final String methodName) {
+        final List<Method> matches = Arrays.stream(declaringClass.getDeclaredMethods())
+                .filter(m -> m.getName().equals(methodName)).toList();
+
+        assertThat(matches).as("expected to find method %s#%s — has it been renamed or removed? Update this guard.",
+                declaringClass.getSimpleName(), methodName).isNotEmpty();
+
+        for (final Method method : matches) {
+            final int modifiers = method.getModifiers();
+            assertThat(Modifier.isPublic(modifiers) || Modifier.isProtected(modifiers))
+                    .as("%s#%s is invoked through the Spring self-proxy and MUST be public or protected; a "
+                            + "package-private/private method is not overridden by the CGLIB proxy subclass (generated "
+                            + "in a different package), so the self-invocation runs on the un-injected proxy instance "
+                            + "and throws NPE while silently losing the transaction.",
+                            declaringClass.getSimpleName(), methodName)
+                    .isTrue();
+        }
+    }
+}