A BeanDefinition can have a constructor argument or property value of type Class. If the class reference is not public, this leads to issues as the following:

Unable to compile generated source
[ERROR] com.example.demo.DemoControllerTests is not public in com.example.demo; cannot be accessed from outside package /Users/snicoll/workspace/demos/demo-aot-native/target/spring-aot/test/sources/org/springframework/boot/test/context/ImportsContextCustomizer_ImportsCleanupPostProcessor__TestContext001_BeanDefinitions.java 3:24
[ERROR] com.example.demo.DemoControllerTests is not public in com.example.demo; cannot be accessed from outside package /Users/snicoll/workspace/demos/demo-aot-native/target/spring-aot/test/sources/org/springframework/boot/test/context/ImportsContextCustomizer_ImportsCleanupPostProcessor__TestContext001_BeanDefinitions.java 29:78

There can be issues where several privileges are required, which are impossible to fix so I am not sure what we should be doing. In this particular case, it turns out the FQN of the class is all that we need.

Comment From: snicoll

It would be nice to be able to know where the code is generated and offers some escape hatch. In this case, we could generate code that would load the class at runtime via ClassUtils

Comment From: snicoll

The contract created by #28999 could mean we'd be able to improve the ClassDelegate so that it uses ReflectionUtils#resolveClassName for cases where the Class is not accessible in the curent context.

Comment From: snicoll

I am not sure we should change the code just yet. The sample I've created was a bit contrived and it would be impossible to recreate this setup with manual code which is something that we're trying to make an assumption for AOT.