Reflection Workbench

import java.lang.annotation.*;
import java.lang.reflect.*;

// Run: java PaymentReflectionDemo.java   (Java 11+, no compile step)
public class PaymentReflectionDemo {
    public static void main(String[] args) throws Exception {
        Class<?> c = Class.forName("PaymentService");

        System.out.println("=== 1. BLUEPRINT ===");
        System.out.println("Class      : " + c.getName());
        System.out.println("Is @Service: " + c.isAnnotationPresent(Service.class));
        System.out.println("Fields:");
        for (Field f : c.getDeclaredFields())
            System.out.println("  " + Modifier.toString(f.getModifiers()) + " " + f.getType().getSimpleName()
                + " " + f.getName() + (f.isAnnotationPresent(Sensitive.class) ? "   <-- @Sensitive" : ""));
        System.out.println("Methods:");
        for (Method m : c.getDeclaredMethods()) {
            Secured s = m.getAnnotation(Secured.class);
            System.out.println("  " + Modifier.toString(m.getModifiers()) + " " + m.getName()
                + params(m) + (s != null ? "   requires " + s.role() : "   (no rule!)"));
        }

        System.out.println("\n=== 2. WHAT SPRING DOES ===");
        Object service = c.getDeclaredConstructor().newInstance();
        String role = args.length > 0 ? args[0] : "USER";          // try: java PaymentReflectionDemo.java ADMIN
        for (String name : new String[]{"pay", "refund"}) {
            Method m = c.getMethod(name, double.class);
            String needed = m.getAnnotation(Secured.class).role();
            System.out.println(needed.equals(role)
                ? "  ALLOWED " + name + " -> " + m.invoke(service, 100.0)
                : "  DENIED  " + name + " (needs " + needed + ", user is " + role + ")");
        }

        System.out.println("\n=== 3. THE DANGER ===");
        Field secret = c.getDeclaredField("apiSecretKey");
        secret.setAccessible(true);
        System.out.println("  Leaked secret      : " + secret.get(service));
        Method fraud = c.getDeclaredMethod("fraudCheck", double.class);
        fraud.setAccessible(true);
        System.out.println("  fraudCheck(50000)  : " + fraud.invoke(service, 50000.0));
        Field balance = c.getDeclaredField("balance");
        balance.setAccessible(true);
        balance.set(service, 1_000_000.0);
        System.out.println("  Balance tampered to: " + balance.get(service));
    }

    static String params(Method m) {
        StringBuilder sb = new StringBuilder("(");
        for (Class<?> p : m.getParameterTypes()) sb.append(sb.length() > 1 ? ", " : "").append(p.getSimpleName());
        return sb.append(")").toString();
    }
}

@Retention(RetentionPolicy.RUNTIME) @interface Service {}
@Retention(RetentionPolicy.RUNTIME) @interface Secured { String role(); }
@Retention(RetentionPolicy.RUNTIME) @interface Sensitive {}

@Service
class PaymentService {
    @Sensitive private String apiSecretKey = "sk_live_9f8a7b6c";
    @Sensitive private String cardNumber   = "4111111111111111";
    private double balance = 500.00;

    @Secured(role = "ADMIN") public String refund(double amount) { balance += amount; return "Refunded " + amount; }
    @Secured(role = "USER")  public String pay(double amount)    { balance -= amount; return "Paid " + amount; }
    private boolean fraudCheck(double amount) { return amount > 10_000; }
}

import java.lang.annotation.*;
import java.lang.reflect.*;
import java.util.*;

// Run: java ReflectionDrills.java
// Each drill prints a result. Then delete the body of a drill and rewrite it from memory.
public class ReflectionDrills {

    public static void main(String[] args) throws Exception {
        drill1_threeWaysToGetAClass();
        drill2_publicVsDeclared();
        drill3_readAnnotationValue();
        drill4_unwrapInvocationTargetException();
        drill5_genericsSurviveInDeclarations();
        drill6_constructWithArguments();
    }

    // 1. Payment.class, obj.getClass(), Class.forName(...) give the SAME object
    static void drill1_threeWaysToGetAClass() throws Exception {
        Class<?> a = Payment.class;
        Class<?> b = new Payment("PAY-1", "ACC-778899", 250.0).getClass();
        Class<?> c = Class.forName("Payment");
        System.out.println("1) same Class object? " + (a == b && b == c));
    }

    // 2. getMethods = public + inherited; getDeclaredMethods = all visibilities, this class only
    static void drill2_publicVsDeclared() {
        Method[] pub = PaymentServiceImpl.class.getMethods();
        Method[] dec = PaymentServiceImpl.class.getDeclaredMethods();
        System.out.println("2) getMethods=" + pub.length + " (includes Object's toString, hashCode...)"
            + "  getDeclaredMethods=" + dec.length + " " + names(dec));
    }

    // 3. Read @PreAuthorize("...") the way Spring Security does
    static void drill3_readAnnotationValue() throws Exception {
        Method m = PaymentServiceImpl.class.getMethod("createPayment", Payment.class);
        PreAuthorize rule = m.getAnnotation(PreAuthorize.class);
        System.out.println("3) createPayment rule = " + rule.value());
        Object generic = rule.annotationType().getMethod("value").invoke(rule); // without knowing the type
        System.out.println("   read generically   = " + generic);
    }

    // 4. Method.invoke wraps the real exception
    static void drill4_unwrapInvocationTargetException() throws Exception {
        Method m = PaymentServiceImpl.class.getMethod("createPayment", Payment.class);
        try {
            m.invoke(new PaymentServiceImpl(), new Payment("PAY-2", "ACC-1", -5));
        } catch (InvocationTargetException e) {
            System.out.println("4) wrapper: " + e.getClass().getSimpleName() + " message=" + e.getMessage());
            System.out.println("   real   : " + e.getCause());
        }
    }

    // 5. Generics are erased, except in declarations (how Spring Data knows the entity type)
    static void drill5_genericsSurviveInDeclarations() {
        Type t = PaymentRepository.class.getGenericInterfaces()[0];
        System.out.println("5) PaymentRepository extends " + t.getTypeName());
    }

    // 6. Build an object through a constructor with arguments (what Spring does for injection)
    static void drill6_constructWithArguments() throws Exception {
        Constructor<Payment> ctor = Payment.class.getDeclaredConstructor(String.class, String.class, double.class);
        Payment p = ctor.newInstance("PAY-3", "ACC-555", 99.0);
        Field amount = Payment.class.getDeclaredField("amount");
        amount.setAccessible(true);
        System.out.println("6) built " + p + ", private amount read = " + amount.get(p));
    }

    static List<String> names(Method[] ms) {
        List<String> l = new ArrayList<>(); for (Method m : ms) l.add(m.getName()); Collections.sort(l); return l;
    }
}

@Retention(RetentionPolicy.RUNTIME) @interface PreAuthorize { String value(); }

class Payment {
    private final String paymentId; private final String accountNumber; private final double amount;
    Payment(String id, String acc, double amount) { this.paymentId = id; this.accountNumber = acc; this.amount = amount; }
    double amount() { return amount; }
    public String toString() { return "Payment[" + paymentId + "]"; }
}

interface Repository<T, ID> {}
interface PaymentRepository extends Repository<Payment, String> {}

class PaymentServiceImpl {
    @PreAuthorize("hasAuthority('SCOPE_payment.write')")
    public String createPayment(Payment p) {
        if (p.amount() <= 0) throw new IllegalArgumentException("amount must be positive");
        return "created " + p;
    }
    @PreAuthorize("hasAuthority('SCOPE_payment.read')")
    public String getPayment(String id) { return "found " + id; }
    private boolean fraudCheck(Payment p) { return p.amount() > 10_000; }
}

import java.lang.annotation.*;
import java.lang.reflect.*;
import java.util.*;

// Run: java ProxyDemo.java
// Builds what Spring builds for @PreAuthorize + your MethodTraceAspect, with a plain JDK proxy.
public class ProxyDemo {

    public static void main(String[] args) {
        PaymentService real = new PaymentServiceImpl();
        PaymentService user  = secure(real, Set.of("SCOPE_payment.read"));
        PaymentService admin = secure(real, Set.of("SCOPE_payment.read", "SCOPE_payment.write"));

        System.out.println("proxy class: " + user.getClass().getName() + "\n");
        System.out.println("--- user with read scope only");
        call(() -> user.getPayment("PAY-1001"));
        call(() -> user.createPayment("PAY-2002", 250.00));
        System.out.println("\n--- admin with write scope");
        call(() -> admin.createPayment("PAY-2002", 250.00));
        System.out.println("\n--- self-invocation: createAndAudit calls this.getPayment() inside");
        call(() -> admin.createAndAudit("PAY-3003", 10.00));
        System.out.println("   ^ only ONE trace line: the inner getPayment never went through the proxy");
    }

    @SuppressWarnings("unchecked")
    static <T> T secure(T target, Set<String> scopes) {
        InvocationHandler h = (proxy, method, args) -> {
            Method impl = target.getClass().getMethod(method.getName(), method.getParameterTypes());
            String name = target.getClass().getSimpleName() + "." + method.getName();
            System.out.println("-> " + name + " inputs=" + Arrays.toString(args));          // trace: inputs
            PreAuthorize rule = impl.getAnnotation(PreAuthorize.class);                       // security: read annotation
            if (rule != null && !scopes.contains(rule.value()))
                throw new SecurityException("403 Forbidden: needs " + rule.value());
            long t = System.nanoTime();
            try {
                Object out = method.invoke(target, args);                                      // the real method
                System.out.println("<- " + name + " output=" + out + " (" + (System.nanoTime() - t) / 1000 + " us)");
                return out;
            } catch (InvocationTargetException e) { throw e.getCause(); }
        };
        return (T) Proxy.newProxyInstance(target.getClass().getClassLoader(),
                                          target.getClass().getInterfaces(), h);
    }

    static void call(java.util.function.Supplier<Object> s) {
        try { s.get(); } catch (SecurityException e) { System.out.println("x  " + e.getMessage()); }
    }
}

@Retention(RetentionPolicy.RUNTIME) @interface PreAuthorize { String value(); }

interface PaymentService {
    String getPayment(String id);
    String createPayment(String id, double amount);
    String createAndAudit(String id, double amount);
}

class PaymentServiceImpl implements PaymentService {
    @PreAuthorize("SCOPE_payment.read")
    public String getPayment(String id) { return "Payment[" + id + "]"; }

    @PreAuthorize("SCOPE_payment.write")
    public String createPayment(String id, double amount) { return "Created " + id + " for " + amount; }

    @PreAuthorize("SCOPE_payment.write")
    public String createAndAudit(String id, double amount) {
        return "Created " + id + ", audit saw " + this.getPayment(id);   // 'this' = real object, not proxy
    }
}

import java.lang.annotation.*;
import java.lang.reflect.*;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;

// Run: java MaskerDemo.java
// Production pattern: mark fields @Sensitive, mask them in logs. Reflection runs once per class (cached).
public class MaskerDemo {
    public static void main(String[] args) {
        Payment p = new Payment("PAY-1001", "ACC-778899", "4111111111111111", 250.00, "nithin");
        System.out.println("toString (unsafe): " + p.unsafeToString());
        System.out.println("Masker   (safe)  : " + Masker.describe(p));
        System.out.println("cached classes   : " + Masker.CACHE.keySet());
    }
}

@Retention(RetentionPolicy.RUNTIME) @Target(ElementType.FIELD) @interface Sensitive {}

class Payment {
    private final String paymentId;
    @Sensitive private final String accountNumber;
    @Sensitive private final String cardNumber;
    private final double amount;
    private final String owner;
    Payment(String id, String acc, String card, double amount, String owner) {
        this.paymentId = id; this.accountNumber = acc; this.cardNumber = card; this.amount = amount; this.owner = owner;
    }
    String unsafeToString() { return paymentId + " " + accountNumber + " " + cardNumber + " " + amount; }
}

final class Masker {
    static final Map<Class<?>, List<Field>> CACHE = new ConcurrentHashMap<>();

    static String describe(Object o) {
        List<Field> fields = CACHE.computeIfAbsent(o.getClass(), c -> {
            List<Field> list = new ArrayList<>();
            for (Field f : c.getDeclaredFields())
                if (!Modifier.isStatic(f.getModifiers())) { f.setAccessible(true); list.add(f); }
            return list;
        });
        StringJoiner out = new StringJoiner(", ", o.getClass().getSimpleName() + "[", "]");
        for (Field f : fields) {
            try {
                String v = String.valueOf(f.get(o));
                if (f.isAnnotationPresent(Sensitive.class)) v = "****" + v.substring(Math.max(0, v.length() - 4));
                out.add(f.getName() + "=" + v);
            } catch (IllegalAccessException e) { out.add(f.getName() + "=?"); }
        }
        return out.toString();
    }
}

import java.lang.annotation.*;
import java.lang.reflect.*;

// Run: java BreakItLab.java
// Every reflection failure from Stage 5 that you can trigger without Spring. Read each error, then the fix.
public class BreakItLab {
    public static void main(String[] args) {
        run("ClassNotFoundException",   () -> Class.forName("org.example.Paymnet"));
        run("NoSuchMethodException",    () -> Svc.class.getMethod("pay", Double.class));       // needs double.class
        run("NoSuchMethodException",    () -> Svc.class.getMethod("fraudCheck", double.class)); // private: use getDeclaredMethod
        run("IllegalAccessException",   () -> Svc.class.getDeclaredMethod("fraudCheck", double.class).invoke(new Svc(), 1.0));
        run("IllegalArgumentException", () -> Svc.class.getMethod("pay", double.class).invoke(new Svc(), "100"));
        run("InvocationTargetException",() -> Svc.class.getMethod("pay", double.class).invoke(new Svc(), -1.0));
        run("InaccessibleObjectException", () -> { String.class.getDeclaredField("value").setAccessible(true); return null; });
        run("NoSuchMethodException (no no-arg constructor, Hibernate's error)",
                                        () -> NoDefaultCtor.class.getDeclaredConstructor().newInstance());
        System.out.println("\nSILENT failure: annotation with CLASS retention");
        System.out.println("  @Runtime present?  " + Svc.class.isAnnotationPresent(RuntimeTag.class));
        System.out.println("  @ClassOnly present? " + Svc.class.isAnnotationPresent(ClassOnlyTag.class) + "   <- no error, just false");
    }

    interface Step { Object go() throws Exception; }
    static void run(String expected, Step s) {
        try { s.go(); System.out.println("no error?! expected " + expected); }
        catch (InvocationTargetException e) {
            System.out.println("[" + e.getClass().getSimpleName() + "] real cause -> " + e.getCause());
        } catch (Exception e) {
            System.out.println("[" + e.getClass().getSimpleName() + "] " + e.getMessage());
        }
    }
}

@Retention(RetentionPolicy.RUNTIME) @interface RuntimeTag {}
@Retention(RetentionPolicy.CLASS)   @interface ClassOnlyTag {}

@RuntimeTag @ClassOnlyTag
class Svc {
    public String pay(double amount) {
        if (amount <= 0) throw new IllegalArgumentException("amount must be positive");
        return "Paid " + amount;
    }
    private boolean fraudCheck(double amount) { return amount > 10_000; }
}

class NoDefaultCtor { NoDefaultCtor(String id) {} }