fix: address PR 311 review feedback

- MailService: switch to @PostConstruct to cache JavaMailSender once at
  startup; warning logged a single time without PII instead of per-call
  with recipient address (GDPR/noise concern raised by Copilot review).
- MailServiceTest: call init() after construction to simulate
  @PostConstruct; no-sender tests use a dedicated service instance.
- README: clarify spring.security.oauth2.enabled is a framework
  property (not a standard Spring Security key) and is opt-in only.

Author: devondragon

README.md

@@ -261,7 +261,7 @@ Follow these steps to get up and running with the Spring User Framework in your
    ```
 
    **Notes:**
-   - `spring-boot-starter-oauth2-client` is required even if you don't plan to enable social login. The framework's security chain wires OAuth2 user services at startup; the dependency must be on the classpath so the classes resolve. OAuth2 login itself remains disabled by default (`spring.security.oauth2.enabled=false`).
+   - `spring-boot-starter-oauth2-client` is required even if you don't plan to use social login. The framework's security chain wires OAuth2 user services at startup; the dependency must be on the classpath so the classes resolve. The OAuth2 login flow itself is disabled by default and opt-in — set `spring.security.oauth2.enabled=true` in your application properties only when you configure OAuth2 provider credentials (this is a framework property, not a standard Spring Security key).
    - `spring-retry` needs an explicit version because Spring Boot's BOM may not manage this artifact. The version shown matches what the framework is built against.
 
 ### Step 2: Database Configuration

src/main/java/com/digitalsanctuary/spring/user/mail/MailService.java

@@ -1,6 +1,7 @@
 package com.digitalsanctuary.spring.user.mail;
 
 import java.util.Map;
+import jakarta.annotation.PostConstruct;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.mail.MailException;
@@ -20,18 +21,20 @@
  * emails.
  *
  * <p>Email is treated as optional: if no {@link JavaMailSender} bean is available (typically because {@code spring.mail.host} is not configured),
- * send operations log a warning and return without throwing, so the application starts and runs normally with email-dependent features degraded.</p>
+ * a single warning is logged at startup and all send operations silently no-op, so the application starts and runs normally with email-dependent
+ * features degraded.</p>
  */
 @Slf4j
 @Service
 public class MailService {
 
-	/** Provider for the mail sender — resolved lazily so the bean is optional. */
 	private final ObjectProvider<JavaMailSender> mailSenderProvider;
 
-	/** The mail content builder. */
 	private final MailContentBuilder mailContentBuilder;
 
+	/** Resolved once at startup; null when JavaMailSender is not configured. */
+	private JavaMailSender resolvedSender;
+
 	/** The from address. */
 	@Value("${user.mail.fromAddress}")
 	private String fromAddress;
@@ -48,17 +51,15 @@ public MailService(ObjectProvider<JavaMailSender> mailSenderProvider, MailConten
 	}
 
 	/**
-	 * Resolve the {@link JavaMailSender}, or log a warning and return null when none is available.
-	 *
-	 * @param to the recipient (for log context only)
-	 * @return the sender, or {@code null} if not configured
+	 * Resolves and caches the {@link JavaMailSender} once at startup. Logs a single warning when no sender is available so operators are informed
+	 * without flooding logs during normal operation.
 	 */
-	private JavaMailSender resolveMailSender(String to) {
-		JavaMailSender sender = mailSenderProvider.getIfAvailable();
-		if (sender == null) {
-			log.warn("Email send to '{}' skipped: JavaMailSender is not configured. Set 'spring.mail.host' to enable email sending.", to);
+	@PostConstruct
+	void init() {
+		resolvedSender = mailSenderProvider.getIfAvailable();
+		if (resolvedSender == null) {
+			log.warn("JavaMailSender is not configured — email sending is disabled. Set 'spring.mail.host' to enable.");
 		}
-		return sender;
 	}
 
 	/**
@@ -72,12 +73,10 @@ private JavaMailSender resolveMailSender(String to) {
 	@Retryable(retryFor = {MailException.class}, maxAttempts = 3,
 			   backoff = @Backoff(delay = 1000, multiplier = 2))
 	public void sendSimpleMessage(String to, String subject, String text) {
-		log.debug("Attempting to send simple email to: {}", to);
-
-		JavaMailSender sender = resolveMailSender(to);
-		if (sender == null) {
+		if (resolvedSender == null) {
 			return;
 		}
+		log.debug("Attempting to send simple email to: {}", to);
 
 		MimeMessagePreparator messagePreparator = mimeMessage -> {
 			MimeMessageHelper messageHelper = new MimeMessageHelper(mimeMessage);
@@ -87,7 +86,7 @@ public void sendSimpleMessage(String to, String subject, String text) {
 			messageHelper.setText(text, true);
 		};
 
-		sender.send(messagePreparator);
+		resolvedSender.send(messagePreparator);
 		log.debug("Successfully sent simple email to: {}", to);
 	}
 
@@ -103,12 +102,10 @@ public void sendSimpleMessage(String to, String subject, String text) {
 	@Retryable(retryFor = {MailException.class}, maxAttempts = 3,
 			   backoff = @Backoff(delay = 1000, multiplier = 2))
 	public void sendTemplateMessage(String to, String subject, Map<String, Object> variables, String templatePath) {
-		log.debug("Attempting to send template email to: {}, template: {}", to, templatePath);
-
-		JavaMailSender sender = resolveMailSender(to);
-		if (sender == null) {
+		if (resolvedSender == null) {
 			return;
 		}
+		log.debug("Attempting to send template email to: {}, template: {}", to, templatePath);
 
 		MimeMessagePreparator messagePreparator = mimeMessage -> {
 			MimeMessageHelper messageHelper = new MimeMessageHelper(mimeMessage);
@@ -121,7 +118,7 @@ public void sendTemplateMessage(String to, String subject, Map<String, Object> v
 			messageHelper.setText(content, true);
 		};
 
-		sender.send(messagePreparator);
+		resolvedSender.send(messagePreparator);
 		log.debug("Successfully sent template email to: {}", to);
 	}
 

src/test/java/com/digitalsanctuary/spring/user/mail/MailServiceTest.java

@@ -56,9 +56,10 @@ class MailServiceTest {
 
     @BeforeEach
     void setUp() {
-        // Provider returns the mock mailSender by default; individual tests can override to simulate missing config.
+        // Provider returns the mock mailSender by default.
         lenient().when(mailSenderProvider.getIfAvailable()).thenReturn(mailSender);
         mailService = new MailService(mailSenderProvider, mailContentBuilder);
+        mailService.init(); // simulate @PostConstruct — caches the resolved sender
         ReflectionTestUtils.setField(mailService, "fromAddress", FROM_ADDRESS);
 
         // Setup default mock behavior
@@ -514,29 +515,30 @@ void shouldHandleTemplateBuilderException() throws Exception {
     @DisplayName("Missing JavaMailSender Tests")
     class MissingMailSenderTests {
 
+        private MailService unconfiguredMailService;
+
+        @BeforeEach
+        void setUpUnconfigured() {
+            // Separate service instance where the sender is absent from startup.
+            when(mailSenderProvider.getIfAvailable()).thenReturn(null);
+            unconfiguredMailService = new MailService(mailSenderProvider, mailContentBuilder);
+            unconfiguredMailService.init();
+            ReflectionTestUtils.setField(unconfiguredMailService, "fromAddress", FROM_ADDRESS);
+        }
+
         @Test
         @DisplayName("sendSimpleMessage should no-op when JavaMailSender is not configured")
         void sendSimpleMessageNoOpsWhenSenderMissing() {
-            // Given
-            when(mailSenderProvider.getIfAvailable()).thenReturn(null);
-
-            // When
-            mailService.sendSimpleMessage(TO_ADDRESS, SUBJECT, "Body");
+            unconfiguredMailService.sendSimpleMessage(TO_ADDRESS, SUBJECT, "Body");
 
-            // Then
             verify(mailSender, never()).send(any(MimeMessagePreparator.class));
         }
 
         @Test
         @DisplayName("sendTemplateMessage should no-op when JavaMailSender is not configured")
         void sendTemplateMessageNoOpsWhenSenderMissing() {
-            // Given
-            when(mailSenderProvider.getIfAvailable()).thenReturn(null);
+            unconfiguredMailService.sendTemplateMessage(TO_ADDRESS, SUBJECT, new HashMap<>(), "email/test");
 
-            // When
-            mailService.sendTemplateMessage(TO_ADDRESS, SUBJECT, new HashMap<>(), "email/test");
-
-            // Then
             verify(mailSender, never()).send(any(MimeMessagePreparator.class));
             verify(mailContentBuilder, never()).build(anyString(), any(Context.class));
         }