The migration that changed the API

import java.lang.reflect.*;
import java.util.*;

/**
 * Solution: the migration that changed the API.
 *
 * Four failures, one cause: the entity was the boundary. Every fix here is the
 * same move made twice — name what crosses, in each direction — and that one
 * change resolves all four rather than four separate patches.
 */
public class Solution {

    /* ── infrastructure (correct; do not change) ────────────────────────── */

    /** A lazy association that counts how many times it is initialised. */
    static final class Lazy<T> {
        private final java.util.function.Supplier<T> loader;
        private final int[] loads;
        private T value;
        Lazy(java.util.function.Supplier<T> loader, int[] loads) { this.loader = loader; this.loads = loads; }
        T get() { if (value == null) { loads[0]++; value = loader.get(); } return value; }
    }

    /** Emits every field it can reach. It cannot know what you meant to publish. */
    static String serialise(Object v, int depth) {
        if (depth > 6) throw new IllegalStateException("recursion: a cycle in the object graph");
        if (v == null) return "null";
        if (v instanceof Number || v instanceof Boolean) return v.toString();
        if (v instanceof String s) return "\"" + s + "\"";
        if (v instanceof Lazy<?> l) return serialise(l.get(), depth);
        if (v instanceof Collection<?> c) {
            var out = new ArrayList<String>();
            for (Object e : c) out.add(serialise(e, depth + 1));
            return "[" + String.join(",", out) + "]";
        }
        var parts = new ArrayList<String>();
        for (Field f : v.getClass().getDeclaredFields()) {
            if (f.isSynthetic()) continue;
            f.setAccessible(true);
            try { parts.add("\"" + f.getName() + "\":" + serialise(f.get(v), depth + 1)); }
            catch (IllegalAccessException e) { throw new RuntimeException(e); }
        }
        return "{" + String.join(",", parts) + "}";
    }

    static Set<String> keysIn(String json) {
        var keys = new LinkedHashSet<String>();
        var m = java.util.regex.Pattern.compile("\"([A-Za-z][A-Za-z0-9_]*)\"\\s*:").matcher(json);
        while (m.find()) keys.add(m.group(1));
        return keys;
    }

    /* ── the entities ───────────────────────────────────────────────────── */

    static final int[] LOADS = {0};

    static final class Role {
        String name = "USER";
        User user;                                  // back-reference
    }

    static final class User {
        long id = 42;
        String email = "ada@example.com";
        String displayName = "Ada";
        String passwordHash = "$2a$12$Nn0Xy8kQ8Zz";      // added by a migration
        String lastLoginIp = "203.0.113.9";              // added by a migration
        boolean deleted = false;                         // added by a migration
        Lazy<List<String>> permissions = new Lazy<>(() -> List.of("read", "write"), LOADS);
        Role role = new Role();
        User() { role.user = this; }
    }

    /* ── the API under review ───────────────────────────────────────────── */

    /** Fields the product owner agreed this endpoint returns. */
    static final Set<String> AGREED_CONTRACT = new LinkedHashSet<>(List.of("id", "displayName", "email"));

    /*
     * The response. Every field here was written down by someone, which is the
     * entire difference. A column added to the table tomorrow cannot appear in
     * it, a rename cannot silently break a client, and there is no association
     * to lazy-load and no back-reference to recurse into.
     *
     * Defects 1, 2 and 3 are all fixed by this record existing — the cycle, the
     * leaked columns and the query during serialisation were three symptoms of
     * returning the entity, not three bugs.
     */
    record UserResponse(long id, String email, String displayName) {}

    /*
     * The request. Binding a body straight onto an entity is mass assignment:
     * the caller could set passwordHash, and setting id turned a create into an
     * update against an arbitrary row.
     *
     * This record is the allowlist. Anything not named here is not settable,
     * and the mapping below chooses which entity fields a caller may influence.
     */
    record CreateUserRequest(String email, String displayName) {}

    static final class UserApi {

        /** GET /users/{id} — returns a response, built while the session is open. */
        Object get(long id) {
            User entity = new User();                 // loaded in the transaction
            return new UserResponse(entity.id, entity.email, entity.displayName);
        }

        /** POST /users — reads only the fields the API offers. */
        User create(Map<String, Object> requestBody) {
            var request = new CreateUserRequest(
                (String) requestBody.get("email"),
                (String) requestBody.get("displayName"));

            var user = new User();
            if (request.displayName() != null) user.displayName = request.displayName();
            if (request.email() != null) user.email = request.email();
            return user;                              // id and passwordHash untouched
        }
    }

    /* ── checks ─────────────────────────────────────────────────────────── */

    public static void main(String[] args) {
        List<String> failures = new ArrayList<>();
        var api = new UserApi();

        // 1. The response must be serialisable at all.
        try {
            serialise(api.get(42), 0);
        } catch (IllegalStateException e) {
            failures.add("1. serialising the response threw: " + e.getMessage());
        }

        // 2. And it must contain only the agreed fields. Read them off the
        //    returned type, so this check works even when check 1 is failing.
        var published = new LinkedHashSet<String>();
        for (Field f : api.get(42).getClass().getDeclaredFields())
            if (!f.isSynthetic()) published.add(f.getName());
        var extra = new LinkedHashSet<>(published);
        extra.removeAll(AGREED_CONTRACT);
        if (!extra.isEmpty())
            failures.add("2. the response publishes fields nobody agreed to: " + extra);

        // 3. Serialising must not query the database.
        LOADS[0] = 0;
        try { serialise(api.get(42), 0); } catch (RuntimeException ignored) { }
        if (LOADS[0] > 0)
            failures.add("3. serialising issued " + LOADS[0] + " lazy load(s) — that query happens "
                       + "after the transaction, where nothing is measuring it");

        // 4. A caller must not be able to set fields the API does not offer.
        var hostile = new LinkedHashMap<String, Object>();
        hostile.put("displayName", "Mallory");
        hostile.put("id", 1L);                       // point the write at another row
        hostile.put("passwordHash", "chosen-by-caller");
        var created = api.create(hostile);
        if (created.id != 42 || "chosen-by-caller".equals(created.passwordHash))
            failures.add("4. a request body set id=" + created.id + " and passwordHash directly — "
                       + "the create endpoint can overwrite an arbitrary user");

        /* ── report ─────────────────────────────────────────────────────── */
        if (failures.isEmpty()) {
            System.out.println("PASS");
        } else {
            failures.forEach(f -> System.out.println("  " + f));
            System.out.println("FAIL");
        }
    }
}