Spring Boot Interview Mastery
for 10-Year Developers

@Component public class OrderService implements InitializingBean, DisposableBean { @Autowired private PaymentClient paymentClient; @PostConstruct public void init() { // Runs after injection. Validate config, warm caches, open connections. paymentClient.connect(); } @Override public void afterPropertiesSet() { // Same as @PostConstruct but via interface — avoid, @PostConstruct is cleaner } @PreDestroy public void cleanup() { // Runs before bean is destroyed. Close connections, flush buffers. paymentClient.close(); } }

// These three are equivalent to @SpringBootApplication: @Configuration // Marks this as a source of bean definitions @EnableAutoConfiguration // Turns on Spring Boot's auto-config magic @ComponentScan // Scans current package + sub-packages for beans // You can use them separately for fine-grained control: @SpringBootApplication( scanBasePackages = "com.example.specific", // narrow scan scope exclude = {DataSourceAutoConfiguration.class} // exclude unwanted auto-config ) public class MyApp { public static void main(String[] args) { SpringApplication.run(MyApp.class, args); } }

# application.yml — common defaults spring: application: name: order-service --- # application-dev.yml spring: config: activate: on-profile: dev datasource: url: jdbc:h2:mem:devdb logging: level: com.example: DEBUG --- # application-prod.yml spring: config: activate: on-profile: prod datasource: url: ${DB_URL} # inject from env variable — never hardcode username: ${DB_USER} password: ${DB_PASSWORD}

@Configuration public class CacheConfig { @Bean @Profile("dev") public CacheManager noOpCacheManager() { return new NoOpCacheManager(); // disabled cache for dev } @Bean @Profile("prod") public CacheManager redisCacheManager(RedisConnectionFactory factory) { return RedisCacheManager.builder(factory).build(); // real Redis for prod } }

// application.yml: // payment: // gateway-url: https://pay.example.com // timeout-ms: 5000 // max-retries: 3 @ConfigurationProperties(prefix = "payment") @Validated public class PaymentProperties { @NotBlank private String gatewayUrl; // payment.gateway-url → camelCase mapped @Min(1000) @Max(30000) private int timeoutMs; private int maxRetries = 3; // default value // getters + setters or use Lombok @Data } // Then inject cleanly: @Service public class PaymentService { private final PaymentProperties props; public PaymentService(PaymentProperties props) { this.props = props; } }

@AutoConfiguration @ConditionalOnClass({ DataSource.class, EmbeddedDatabaseType.class }) // ↑ Only applies if DataSource class is on the classpath @ConditionalOnMissingBean(type = "io.r2dbc.spi.ConnectionFactory") // ↑ Only applies if we're not using reactive R2DBC @EnableConfigurationProperties(DataSourceProperties.class) public class DataSourceAutoConfiguration { @Bean @ConditionalOnMissingBean // ← Only creates if YOU haven't defined your own public DataSource dataSource(DataSourceProperties properties) { return properties.initializeDataSourceBuilder().build(); } }

// 1. @ConditionalOnClass — bean created only if class exists on classpath @Bean @ConditionalOnClass(RedissonClient.class) public CacheManager redissonCache() { ... } // 2. @ConditionalOnMissingBean — only if YOU haven't defined your own @Bean @ConditionalOnMissingBean public ObjectMapper jacksonMapper() { return new ObjectMapper(); } // → You can override by declaring your own ObjectMapper @Bean // 3. @ConditionalOnProperty — based on config property @Bean @ConditionalOnProperty(name = "feature.new-payment-flow.enabled", havingValue = "true") public PaymentProcessor newFlowProcessor() { return new NewPaymentProcessor(); } // 4. @ConditionalOnBean — only if another bean exists @Bean @ConditionalOnBean(DataSource.class) public JdbcTemplate jdbcTemplate(DataSource ds) { return new JdbcTemplate(ds); } // 5. @ConditionalOnExpression — SpEL expression @Bean @ConditionalOnExpression("${app.mode} == 'async' and ${feature.kafka.enabled}") public KafkaProducer kafkaProducer() { ... }

@Component public abstract class OrderService { @Lookup // Spring overrides this to return a new instance each call public abstract OrderContext createOrderContext(); public void processOrder(Long orderId) { OrderContext ctx = createOrderContext(); // fresh prototype each time ctx.setOrderId(orderId); } }

// ❌ PROBLEM — circular dependency: @Service class ServiceA { @Autowired ServiceB b; } @Service class ServiceB { @Autowired ServiceA a; } // → BeanCurrentlyInCreationException at startup // ✅ FIX 1 — @Lazy on one side (Spring creates a proxy) @Service class ServiceA { @Autowired public ServiceA(@Lazy ServiceB b) { this.b = b; } } // ✅ FIX 2 — Setter injection instead of constructor (use sparingly) @Service class ServiceA { private ServiceB b; @Autowired public void setServiceB(ServiceB b) { this.b = b; } } // ✅ FIX 3 — BEST: Refactor. Extract shared logic to a third service. @Service class SharedLogicService { ... } @Service class ServiceA { @Autowired SharedLogicService s; } @Service class ServiceB { @Autowired SharedLogicService s; }

// ✅ CONSTRUCTOR INJECTION — preferred (Spring team recommends this) @Service public class OrderService { private final PaymentService paymentService; // final = immutable ✓ private final InventoryService inventoryService; // @Autowired is optional since Spring 4.3 when there's one constructor public OrderService(PaymentService p, InventoryService i) { this.paymentService = p; this.inventoryService = i; } } // ⚠️ SETTER INJECTION — use for optional dependencies @Service public class ReportService { private EmailService emailService; // not final — mutable @Autowired(required = false) // optional dependency public void setEmailService(EmailService e) { this.emailService = e; } } // ❌ FIELD INJECTION — avoid (hard to test, hides dependencies) @Service public class BadService { @Autowired private PaymentService paymentService; // can't be final, can't be mocked without Spring context }

@Component @Primary // default when no qualifier specified public class EmailNotificationService implements NotificationService { } @Component public class SmsNotificationService implements NotificationService { } // Injection: @Service public class OrderService { // Gets EmailNotificationService (the @Primary one) @Autowired private NotificationService defaultNotifier; // Explicitly gets SMS service regardless of @Primary @Autowired @Qualifier("smsNotificationService") // @Qualifier wins over @Primary private NotificationService smsNotifier; }

@RestControllerAdvice @Slf4j public class GlobalExceptionHandler { // 1. Business logic exceptions (your custom ones) @ExceptionHandler(OrderNotFoundException.class) @ResponseStatus(HttpStatus.NOT_FOUND) public ApiError handleOrderNotFound(OrderNotFoundException ex, HttpServletRequest req) { log.warn("Order not found: {}", ex.getMessage()); return new ApiError("ORDER_NOT_FOUND", ex.getMessage(), req.getRequestURI()); } // 2. Validation failures (Bean Validation / @Valid) @ExceptionHandler(MethodArgumentNotValidException.class) @ResponseStatus(HttpStatus.BAD_REQUEST) public ApiError handleValidation(MethodArgumentNotValidException ex) { List<String> errors = ex.getBindingResult().getFieldErrors() .stream().map(e -> e.getField() + ": " + e.getDefaultMessage()) .collect(Collectors.toList()); return new ApiError("VALIDATION_FAILED", "Input validation failed", errors); } // 3. Unexpected exceptions — log everything, return generic message @ExceptionHandler(Exception.class) @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR) public ApiError handleAll(Exception ex, WebRequest request) { log.error("Unhandled exception", ex); // full stack trace in logs return new ApiError("INTERNAL_ERROR", "An unexpected error occurred"); // ↑ Never expose stack traces or internal info to client! } } // Consistent error response DTO public record ApiError( String code, String message, String path, Instant timestamp, List<String> errors ) { public ApiError(String code, String message) { this(code, message, null, Instant.now(), List.of()); } }

// Request DTO with validation annotations public record CreateOrderRequest( @NotBlank(message = "Customer ID is required") String customerId, @NotEmpty @Size(max = 50) List<@Valid OrderItem> items, @Future(message = "Delivery date must be in the future") LocalDate deliveryDate, @ValidCouponCode // custom validator String couponCode ) {} // Controller — trigger validation with @Valid @PostMapping("/orders") public ResponseEntity<OrderResponse> createOrder(@Valid @RequestBody CreateOrderRequest req) { return ResponseEntity.status(201).body(orderService.create(req)); } // Custom Validator Implementation @Constraint(validatedBy = CouponCodeValidator.class) @Target(ElementType.FIELD) @Retention(RetentionPolicy.RUNTIME) public @interface ValidCouponCode { String message() default "Invalid coupon code format"; Class<?>[] groups() default {}; Class<? extends Payload>[] payload() default {}; } @Component public class CouponCodeValidator implements ConstraintValidator<ValidCouponCode, String> { @Override public boolean isValid(String code, ConstraintValidatorContext ctx) { return code == null || code.matches("[A-Z0-9]{6,10}"); } }

// ❌ OLD WAY — Spring Boot 2 (WebSecurityConfigurerAdapter — REMOVED in 3.x) @Configuration public class OldSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { ... } } // ✅ NEW WAY — Spring Boot 3 / Spring Security 6 @Configuration @EnableWebSecurity @EnableMethodSecurity // enables @PreAuthorize, @PostAuthorize public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http .csrf(csrf -> csrf.disable()) // stateless APIs → disable CSRF .sessionManagement(s -> s.sessionCreationPolicy(STATELESS)) .authorizeHttpRequests(auth -> auth .requestMatchers("/api/auth/**", "/actuator/health").permitAll() .requestMatchers(HttpMethod.GET, "/api/products/**").permitAll() .requestMatchers("/api/admin/**").hasRole("ADMIN") .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults())) .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class) .build(); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); // cost factor 12 (recommended for 2024) } } // Method-level security @Service public class OrderService { @PreAuthorize("hasRole('ADMIN') or #userId == authentication.name") public List<Order> getOrdersForUser(String userId) { ... } }

@Component @RequiredArgsConstructor public class JwtAuthenticationFilter extends OncePerRequestFilter { private final JwtService jwtService; private final UserDetailsService userDetailsService; @Override protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException { String authHeader = req.getHeader("Authorization"); // Skip if no Bearer token if (authHeader == null || !authHeader.startsWith("Bearer ")) { chain.doFilter(req, res); return; } String jwt = authHeader.substring(7); String username = jwtService.extractUsername(jwt); if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) { UserDetails userDetails = userDetailsService.loadUserByUsername(username); if (jwtService.isTokenValid(jwt, userDetails)) { UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken( userDetails, null, userDetails.getAuthorities()); authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(req)); SecurityContextHolder.getContext().setAuthentication(authToken); } } chain.doFilter(req, res); } }

// THE PROBLEM — Entity with lazy association: @Entity public class Order { @OneToMany(fetch = FetchType.LAZY) // default for OneToMany private List<OrderItem> items; } // This causes N+1: List<Order> orders = orderRepo.findAll(); // 1 SQL: SELECT * FROM orders for (Order o : orders) { o.getItems().size(); // N SQLs: SELECT * FROM order_items WHERE order_id=? } // → 1 + N queries total. With 1000 orders = 1001 queries! 💀 // ✅ FIX 1 — JOIN FETCH in JPQL (best for most cases) @Query("SELECT DISTINCT o FROM Order o JOIN FETCH o.items WHERE o.status = :status") List<Order> findWithItems(@Param("status") OrderStatus status); // → 1 SQL with JOIN. All data loaded at once. // ✅ FIX 2 — @EntityGraph (declarative, no JPQL) @EntityGraph(attributePaths = {"items", "items.product"}) List<Order> findByStatus(OrderStatus status); // ✅ FIX 3 — @BatchSize (loads in batches, not 1-by-1) @OneToMany @BatchSize(size = 50) private List<OrderItem> items; // → Instead of N queries: ceil(N/50) queries // ✅ FIX 4 — Projections (only select what you need) public interface OrderSummary { Long getId(); String getStatus(); int getItemCount(); // computed in JPQL } @Query("SELECT o.id as id, o.status as status, SIZE(o.items) as itemCount FROM Order o") List<OrderSummary> findAllSummaries();

// Interface Projection — Spring creates proxy at runtime public interface ProductSummary { String getName(); BigDecimal getPrice(); @Value("#{target.name + ' ($' + target.price + ')'}") // SpEL expression String getDisplayName(); } List<ProductSummary> findByCategory(String category); // → SELECT name, price FROM product WHERE category=? // ↑ Only fetches needed columns — not the full entity! // DTO Projection — record or class with matching constructor public record ProductDTO(String name, BigDecimal price) {} @Query("SELECT new com.example.ProductDTO(p.name, p.price) FROM Product p WHERE p.category = :cat") List<ProductDTO> findDTOByCategory(@Param("cat") String category); // → Constructs DTO directly from JPQL — fastest approach

@Service public class OrderService { @Transactional // outer transaction public void placeOrder(Order order) { orderRepository.save(order); auditService.logAction("ORDER_PLACED", order.getId()); // separate tx if (order.getTotal().compareTo(LIMIT) > 0) { throw new BusinessException("Over limit"); // rolls back orderRepository.save() // but auditService.logAction ALREADY COMMITTED (REQUIRES_NEW) } } } @Service public class AuditService { @Transactional(propagation = Propagation.REQUIRES_NEW) public void logAction(String action, Long entityId) { auditRepo.save(new AuditLog(action, entityId)); // always commits! } }

@Service public class OrderService { // ❌ TRAP: methodA calls methodB on 'this' — bypasses the proxy! public void methodA() { methodB(); // calls this.methodB() NOT proxy.methodB() // → @Transactional on methodB is IGNORED. No transaction! } @Transactional public void methodB() { // This @Transactional has NO EFFECT when called from methodA above } } // WHY: @Transactional works via AOP proxy. External callers call proxy.methodB() // which adds the transaction. But 'this.methodB()' bypasses the proxy entirely. // ✅ FIX 1 — Inject self (Spring Boot 2.6+ may need spring.main.allow-circular-references=true) @Service public class OrderService { @Autowired @Lazy private OrderService self; // inject the proxy reference public void methodA() { self.methodB(); // calls through proxy → @Transactional works! } } // ✅ FIX 2 — Refactor: move transactional method to a different bean // Best practice — avoid self-injection entirely // ✅ FIX 3 — Use AspectJ mode (compile-time weaving, no proxy limitation) @EnableTransactionManagement(mode = AdviceMode.ASPECTJ)

// Custom annotation @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface Timed { String value() default ""; } @Aspect @Component @Slf4j public class PerformanceAspect { // Advice 1: Around — full control of method execution @Around("@annotation(Timed)") public Object measureTime(ProceedingJoinPoint pjp) throws Throwable { long start = System.currentTimeMillis(); String method = pjp.getSignature().toShortString(); try { Object result = pjp.proceed(); // call actual method log.info("[PERF] {} completed in {}ms", method, System.currentTimeMillis() - start); return result; } catch (Throwable t) { log.error("[PERF] {} failed in {}ms", method, System.currentTimeMillis() - start); throw t; } } // Advice 2: AfterThrowing — log all service exceptions @AfterThrowing( pointcut = "execution(* com.example.service.*.*(..))", throwing = "ex" ) public void logServiceException(JoinPoint jp, Exception ex) { log.error("Exception in {} with args {}: {}", jp.getSignature().getName(), jp.getArgs(), ex.getMessage()); } // Advice 3: Before — audit all write operations @Before("execution(* com.example.repository.*.save(..)) || execution(* com.example.repository.*.delete(..))") public void auditWrite(JoinPoint jp) { String user = SecurityContextHolder.getContext().getAuthentication().getName(); log.info("[AUDIT] User {} called {}", user, jp.getSignature()); } } // Usage — just annotate methods: @Service public class ProductService { @Timed("getProducts") public List<Product> getAllProducts() { ... } }

management: endpoints: web: exposure: include: health,info,metrics,prometheus # expose only what's needed base-path: /management # hide from /actuator path endpoint: health: show-details: when-authorized # don't expose internals to all probes: enabled: true # /health/liveness and /health/readiness for K8s metrics: export: prometheus: enabled: true # scrape at /management/prometheus server: port: 8081 # separate port — so Nginx doesn't expose actuator externally

// Custom health indicator (e.g., check external payment gateway) @Component public class PaymentGatewayHealthIndicator implements HealthIndicator { @Override public Health health() { try { boolean isUp = paymentClient.ping(); return isUp ? Health.up().withDetail("gateway", "Stripe reachable").build() : Health.down().withDetail("gateway", "Stripe unreachable").build(); } catch (Exception e) { return Health.down(e).build(); } } } // Custom business metric (Micrometer) @Service public class OrderService { private final Counter ordersPlaced; private final Timer orderProcessingTime; public OrderService(MeterRegistry registry) { ordersPlaced = Counter.builder("orders.placed.total") .description("Total orders placed") .tag("region", "india") .register(registry); orderProcessingTime = Timer.builder("orders.processing.time") .register(registry); } public Order placeOrder(OrderRequest req) { return orderProcessingTime.record(() -> { Order order = doProcess(req); ordersPlaced.increment(); return order; }); } }

// 1. @WebMvcTest — controller slice test @WebMvcTest(OrderController.class) class OrderControllerTest { @Autowired MockMvc mockMvc; @MockBean OrderService orderService; // @Service not loaded, must mock @Test void shouldReturn201WhenOrderCreated() throws Exception { given(orderService.create(any())).willReturn(new OrderResponse(1L, "PLACED")); mockMvc.perform(post("/api/orders") .contentType(APPLICATION_JSON) .content("""{"customerId":"C1","items":[{"productId":"P1","qty":2}]}""")) .andExpect(status().isCreated()) .andExpect(jsonPath("$.status").value("PLACED")); } } // 2. @DataJpaTest with Testcontainers (real PostgreSQL!) @DataJpaTest @AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE) @Testcontainers class OrderRepositoryTest { @Container static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine"); @Autowired OrderRepository orderRepository; @Test void shouldFindOrdersByCustomer() { // uses REAL PostgreSQL container — no H2 quirks! Order order = orderRepository.save(new Order("C1", OrderStatus.PLACED)); assertThat(orderRepository.findByCustomerId("C1")).hasSize(1); } }

# application.yml resilience4j: circuitbreaker: instances: paymentService: slidingWindowSize: 10 failureRateThreshold: 50 # open after 50% failures waitDurationInOpenState: 5s # wait before HALF_OPEN permittedCallsInHalfOpenState: 3 retry: instances: paymentService: maxAttempts: 3 waitDuration: 500ms retryExceptions: [java.io.IOException, java.net.ConnectException] // Java — annotate your service method @Service public class OrderService { @CircuitBreaker(name = "paymentService", fallbackMethod = "paymentFallback") @Retry(name = "paymentService") public PaymentResponse processPayment(PaymentRequest req) { return paymentClient.charge(req); // calls external service } // Fallback — same return type + Throwable parameter public PaymentResponse paymentFallback(PaymentRequest req, Throwable t) { log.error("Payment service unavailable: {}", t.getMessage()); return PaymentResponse.pending(req.getOrderId()); // graceful degradation } }

// Producer @Service @RequiredArgsConstructor public class OrderEventPublisher { private final KafkaTemplate<String, OrderEvent> kafkaTemplate; public void publishOrderPlaced(Order order) { OrderEvent event = new OrderEvent(order.getId(), "PLACED", Instant.now()); kafkaTemplate.send("order-events", order.getId().toString(), event) .whenComplete((result, ex) -> { if (ex != null) { log.error("Failed to publish order event for {}", order.getId(), ex); // store in outbox table for retry (Outbox pattern) } else { log.info("Published to partition {}", result.getRecordMetadata().partition()); } }); } } // Consumer with error handling + DLQ @Component @Slf4j public class OrderEventConsumer { @KafkaListener( topics = "order-events", groupId = "inventory-service", containerFactory = "orderEventFactory" ) public void handleOrderEvent(OrderEvent event, @Header(KafkaHeaders.RECEIVED_TOPIC) String topic, Acknowledgment ack) { try { // check idempotency first if (!processedEvents.contains(event.getId())) { inventoryService.reserve(event.getOrderId()); processedEvents.add(event.getId()); } ack.acknowledge(); // manual ack — at-least-once } catch (Exception e) { log.error("Error processing event {}: {}", event.getId(), e.getMessage()); // Don't ack → message goes back to retry topic via error handler throw e; } } } // Dead Letter Topic config @Bean public DefaultErrorHandler errorHandler(KafkaTemplate<String, Object> template) { var deadLetterPublisher = new DeadLetterPublishingRecoverer(template, (rec, ex) -> new TopicPartition(rec.topic() + ".DLT", rec.partition())); BackOff backOff = new FixedBackOff(1000L, 3); // 3 retries, 1s apart return new DefaultErrorHandler(deadLetterPublisher, backOff); }

# 1. Lazy initialization — beans created on first use, not at startup spring: main: lazy-initialization: true # 2. Narrow component scan scope # In @SpringBootApplication: scanBasePackages="com.example.mymodule" # 3. Exclude unused auto-configurations spring: autoconfigure: exclude: - org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration - org.springframework.boot.autoconfigure.quartz.QuartzAutoConfiguration // 4. Connection pool tuning (HikariCP — default in Spring Boot) spring: datasource: hikari: maximum-pool-size: 20 # max connections minimum-idle: 5 # always keep 5 ready connection-timeout: 30000 # 30s max wait for connection idle-timeout: 600000 # 10min idle before release // 5. Spring Boot 3 AOT (Ahead-of-Time compilation) // mvn -Pnative native:compile → builds native binary with sub-second startup // 6. @Cacheable for expensive operations @Service public class ProductService { @Cacheable(value = "products", key = "#id", unless = "#result == null") public Product findById(Long id) { return productRepository.findById(id).orElse(null); } @CacheEvict(value = "products", key = "#product.id") public Product update(Product product) { return productRepository.save(product); } @CacheEvict(value = "products", allEntries = true) public void clearCache() {} }

@Service @RequiredArgsConstructor public class ProductAggregatorService { private final ProductClient productClient; private final InventoryClient inventoryClient; private final ReviewClient reviewClient; private final Executor asyncExecutor; // configured thread pool public ProductDetailResponse getProductDetails(String productId) { // Fire all 3 API calls in parallel CompletableFuture<ProductInfo> productFuture = CompletableFuture.supplyAsync(() -> productClient.getProduct(productId), asyncExecutor) .exceptionally(ex -> { log.error("Product API failed", ex); return null; // degrade gracefully }); CompletableFuture<InventoryInfo> inventoryFuture = CompletableFuture.supplyAsync(() -> inventoryClient.getStock(productId), asyncExecutor) .exceptionally(ex -> { log.warn("Inventory API failed — showing unknown stock", ex); return new InventoryInfo("UNKNOWN"); }); CompletableFuture<ReviewSummary> reviewFuture = CompletableFuture.supplyAsync(() -> reviewClient.getSummary(productId), asyncExecutor) .exceptionally(ex -> { log.warn("Reviews API failed — showing no reviews", ex); return ReviewSummary.empty(); }); // Wait for ALL to complete (even if some failed) CompletableFuture.allOf(productFuture, inventoryFuture, reviewFuture) .orTimeout(2, TimeUnit.SECONDS) // fail fast after 2 seconds total .join(); return ProductDetailResponse.builder() .product(productFuture.join()) .inventory(inventoryFuture.join()) .reviews(reviewFuture.join()) .build(); } } // Configure dedicated thread pool for async calls @Bean("asyncExecutor") public Executor asyncExecutor() { return new ThreadPoolExecutor( 10, 50, 60L, TimeUnit.SECONDS, new LinkedBlockingQueue<>(100), new ThreadPoolExecutor.CallerRunsPolicy() ); }

// ❌ WRONG — loads all 1M records into heap → OOM List<Order> orders = orderRepository.findAll(); // 💀 // ✅ FIX 1 — JPA Stream (processes one at a time, within transaction) @Repository public interface OrderRepository extends JpaRepository<Order, Long> { @Query("SELECT o FROM Order o WHERE o.status = 'PENDING'") @QueryHints(@QueryHint(name = HINT_FETCH_SIZE, value = "50")) Stream<Order> streamAllPendingOrders(); } @Service @Transactional(readOnly = true) public class InvoiceGeneratorService { public void generateMonthlyInvoices() { try (Stream<Order> stream = orderRepository.streamAllPendingOrders()) { stream .filter(o -> o.isEligibleForInvoice()) .map(this::createInvoice) .forEach(invoice -> { invoiceService.save(invoice); emailService.sendAsync(invoice); EntityManagerHolder.clear(); // flush L1 cache periodically }); } } } // ✅ FIX 2 — Spring Batch with chunked processing @Bean public Step generateInvoicesStep() { return stepBuilderFactory .<Order, Invoice>get("generateInvoices") .chunk(100) // read 100, process 100, write 100, commit → repeat .reader(orderItemReader()) .processor(orderToInvoiceProcessor()) .writer(invoiceWriter()) .faultTolerant() .retry(TransientDataAccessException.class).retryLimit(3) .skip(IllegalArgumentException.class).skipLimit(10) .build(); }

// Custom annotation @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface RateLimit { int requests() default 100; int seconds() default 60; String key() default "default"; } // AOP Aspect for rate limiting @Aspect @Component @RequiredArgsConstructor public class RateLimitAspect { private final RedisTemplate<String, String> redisTemplate; @Around("@annotation(rateLimit)") public Object rateLimit(ProceedingJoinPoint pjp, RateLimit rateLimit) throws Throwable { String userId = SecurityContextHolder.getContext().getAuthentication().getName(); String key = "rate:" + rateLimit.key() + ":" + userId; // Atomic increment + expire using Lua script (no race condition) Long count = redisTemplate.execute(new DefaultRedisScript<>( """ local count = redis.call('INCR', KEYS[1]) if count == 1 then redis.call('EXPIRE', KEYS[1], ARGV[1]) end return count """, Long.class ), List.of(key), String.valueOf(rateLimit.seconds())); if (count > rateLimit.requests()) { throw new RateLimitExceededException( "Rate limit exceeded. Max " + rateLimit.requests() + " requests per " + rateLimit.seconds() + "s"); } return pjp.proceed(); } } // Usage @RestController public class SearchController { @GetMapping("/search") @RateLimit(requests = 20, seconds = 60, key = "search") public ResponseEntity<SearchResult> search(@RequestParam String q) { ... } }

// Step 1: Outbox table entity — persisted in SAME transaction as business data @Entity public class OutboxEvent { @Id @GeneratedValue private UUID id; private String aggregateType; // "ORDER" private String eventType; // "ORDER_PLACED" private String payload; // JSON private OutboxStatus status = PENDING; private Instant createdAt; } // Step 2: Save order + outbox event atomically @Service @Transactional public class OrderService { public Order placeOrder(OrderRequest req) { Order order = orderRepository.save(createOrder(req)); // Write event to outbox IN SAME transaction — atomicity guaranteed outboxRepository.save(new OutboxEvent( "ORDER", "ORDER_PLACED", toJson(order) )); // NO Kafka call here — Kafka is eventually consistent return order; } } // Step 3: Outbox poller — separate scheduled job publishes to Kafka @Component @Slf4j @RequiredArgsConstructor public class OutboxPoller { private final OutboxRepository outboxRepo; private final KafkaTemplate<String, String> kafka; @Scheduled(fixedDelay = 1000) // every second @Transactional public void poll() { List<OutboxEvent> pending = outboxRepo.findTop100ByStatusOrderByCreatedAtAsc(PENDING); for (OutboxEvent event : pending) { try { kafka.send(event.getAggregateType().toLowerCase() + "-events", event.getAggregateId().toString(), event.getPayload()).get(5, TimeUnit.SECONDS); event.setStatus(PUBLISHED); } catch (Exception e) { event.incrementRetry(); if (event.getRetries() > 5) event.setStatus(FAILED); } } } }

@Configuration @EnableAsync public class AsyncConfig implements AsyncConfigurer { @Override public Executor getAsyncExecutor() { ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor(); executor.setCorePoolSize(5); executor.setMaxPoolSize(20); executor.setQueueCapacity(500); executor.setThreadNamePrefix("Async-"); executor.setRejectedExecutionHandler(new ThreadPoolExecutor.CallerRunsPolicy()); executor.initialize(); return executor; } @Override public AsyncUncaughtExceptionHandler getAsyncUncaughtExceptionHandler() { return (ex, method, params) -> { log.error("Async error in {}: {}", method.getName(), ex.getMessage(), ex); // alert, metrics, etc. }; } } @Service public class NotificationService { // For fire-and-forget: @Async public void sendEmail(EmailRequest req) { emailClient.send(req); // runs in async thread pool } // For async with result (return Future to track completion): @Async public CompletableFuture<String> sendPushNotification(PushRequest req) { String result = pushClient.send(req); return CompletableFuture.completedFuture(result); } } // ⚠️ SAME SELF-INVOCATION TRAP applies to @Async! // Calling this.sendEmail() from within NotificationService bypasses @Async