Spring Boot, Stage by Stage

PS> cd "D:\Mtech RA nitk\Intership Student\springboot-learning\library-api"
PS> .\mvnw.cmd spring-boot:run

:: Spring Boot ::               (v4.1.0)
Starting LibraryApiApplication using Java ... 
Tomcat initialized with port 8080 (http)   ← embedded server, auto-configured
LiveReload server is running on port 35729 ← devtools
Tomcat started on port 8080 (http)
Started LibraryApiApplication in ~2 s      ← app is up

PS> curl.exe http://localhost:8080/actuator/health
{"groups":["liveness","readiness"],"status":"UP"}

spring.application.name=library-api
management.endpoints.web.exposure.include=health,info,beans,mappings

package com.library.api;

import java.util.Map;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class HelloController {

    @GetMapping("/api/hello")
    public Map<String, String> hello() {
        return Map.of(
            "message", "Hello from Spring Boot",
            "app", "library-api"
        );
    }
}

// GET /api/greet?name=Sharath   → query parameter
@GetMapping("/api/greet")
public Map<String, String> greet(
        @RequestParam(defaultValue = "stranger") String name) {
    return Map.of("greeting", "Hello, " + name + "!");
}

// GET /api/echo/42              → path variable
@GetMapping("/api/echo/{id}")
public Map<String, Object> echo(@PathVariable long id) {
    return Map.of("received", id, "doubled", id * 2);
}

PS> curl.exe "http://localhost:8080/api/greet?name=Sharath"
{"greeting":"Hello, Sharath!"}
PS> curl.exe http://localhost:8080/api/greet
{"greeting":"Hello, stranger!"}          ← defaultValue kicked in
PS> curl.exe http://localhost:8080/api/echo/21
{"received":21,"doubled":42}              ← "21" auto-converted to long
PS> curl.exe http://localhost:8080/api/echo/banana
(400 Bad Request)                         ← type conversion failed — free validation

package com.library.api.book;

public record Book(Long id, String title, String author, int year) {}

package com.library.api.book;

import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicLong;
import org.springframework.stereotype.Service;

@Service
public class BookService {

    private final Map<Long, Book> store = new ConcurrentHashMap<>();
    private final AtomicLong seq = new AtomicLong();

    public List<Book> findAll() {
        return List.copyOf(store.values());
    }

    public Optional<Book> findById(long id) {
        return Optional.ofNullable(store.get(id));
    }

    public Book create(Book book) {
        long id = seq.incrementAndGet();
        Book saved = new Book(id, book.title(), book.author(), book.year());
        store.put(id, saved);
        return saved;
    }

    public Optional<Book> update(long id, Book book) {
        if (!store.containsKey(id)) {
            return Optional.empty();
        }
        Book saved = new Book(id, book.title(), book.author(), book.year());
        store.put(id, saved);
        return Optional.of(saved);
    }

    public boolean delete(long id) {
        return store.remove(id) != null;
    }
}

package com.library.api.book;

import java.net.URI;
import java.util.List;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/books")
public class BookController {

    private final BookService service;

    public BookController(BookService service) {   // constructor injection
        this.service = service;
    }

    @GetMapping
    public List<Book> all() {
        return service.findAll();
    }

    @GetMapping("/{id}")
    public ResponseEntity<Book> byId(@PathVariable long id) {
        return service.findById(id)
                .map(ResponseEntity::ok)
                .orElse(ResponseEntity.notFound().build());
    }

    @PostMapping
    public ResponseEntity<Book> create(@RequestBody Book book) {
        Book saved = service.create(book);
        return ResponseEntity
                .created(URI.create("/api/books/" + saved.id()))
                .body(saved);
    }

    @PutMapping("/{id}")
    public ResponseEntity<Book> update(@PathVariable long id, @RequestBody Book book) {
        return service.update(id, book)
                .map(ResponseEntity::ok)
                .orElse(ResponseEntity.notFound().build());
    }

    @DeleteMapping("/{id}")
    public ResponseEntity<Void> delete(@PathVariable long id) {
        return service.delete(id)
                ? ResponseEntity.noContent().build()
                : ResponseEntity.notFound().build();
    }
}

PS> curl.exe http://localhost:8080/api/books
[]

PS> curl.exe -i -X POST http://localhost:8080/api/books `
       -H "Content-Type: application/json" `
       -d '{\"title\":\"Clean Code\",\"author\":\"Robert C. Martin\",\"year\":2008}'
HTTP/1.1 201
Location: /api/books/1
{"id":1,"title":"Clean Code","author":"Robert C. Martin","year":2008}

PS> curl.exe http://localhost:8080/api/books/1
{"id":1,"title":"Clean Code","author":"Robert C. Martin","year":2008}

PS> curl.exe -i http://localhost:8080/api/books/99
HTTP/1.1 404

PS> curl.exe -X PUT http://localhost:8080/api/books/1 `
       -H "Content-Type: application/json" `
       -d '{\"title\":\"Clean Code\",\"author\":\"Robert C. Martin\",\"year\":2009}'
{"id":1,"title":"Clean Code","author":"Robert C. Martin","year":2009}

PS> curl.exe -i -X DELETE http://localhost:8080/api/books/1
HTTP/1.1 204

PS> curl.exe http://localhost:8080/api/books
[]

package com.library.api.author;

import jakarta.persistence.Entity;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;

@Entity
public class Author {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String name;

    protected Author() {}  // JPA needs a no-arg constructor

    public Author(String name) {
        this.name = name;
    }

    public Long getId() { return id; }
    public String getName() { return name; }
    public void setName(String name) { this.name = name; }
}

package com.library.api.book;

import com.library.api.author.Author;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;
import jakarta.persistence.ManyToOne;

@Entity
public class Book {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String title;

    @Column(name = "published_year")
    private int year;

    @ManyToOne
    private Author author;

    protected Book() {}  // JPA needs a no-arg constructor

    public Book(String title, int year, Author author) {
        this.title = title;
        this.year = year;
        this.author = author;
    }

    public Long getId() { return id; }
    public String getTitle() { return title; }
    public int getYear() { return year; }
    public Author getAuthor() { return author; }

    public void setTitle(String title) { this.title = title; }
    public void setYear(int year) { this.year = year; }
    public void setAuthor(Author author) { this.author = author; }
}

package com.library.api.author;

import org.springframework.data.jpa.repository.JpaRepository;

public interface AuthorRepository extends JpaRepository<Author, Long> {}

package com.library.api.book;

import java.util.List;
import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.data.jpa.repository.JpaRepository;

public interface BookRepository extends JpaRepository<Book, Long> {

    List<Book> findByAuthor_NameContainingIgnoreCase(String authorName);

    Page<Book> findAll(Pageable pageable);
}

package com.library.api.author;

import java.util.List;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/authors")
public class AuthorController {

    private final AuthorRepository repo;

    public AuthorController(AuthorRepository repo) {
        this.repo = repo;
    }

    @GetMapping
    public List<Author> all() {
        return repo.findAll();
    }

    @PostMapping
    public Author create(@RequestBody Author author) {
        return repo.save(new Author(author.getName()));
    }
}

package com.library.api.book;

import com.library.api.author.Author;
import com.library.api.author.AuthorRepository;
import java.util.List;
import org.springframework.data.domain.Page;
import org.springframework.data.domain.Pageable;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/books")
public class BookController {

    private final BookRepository books;
    private final AuthorRepository authors;

    public BookController(BookRepository books, AuthorRepository authors) {
        this.books = books;
        this.authors = authors;
    }

    @GetMapping
    public Page<Book> all(Pageable pageable) {
        return books.findAll(pageable);
    }

    @GetMapping("/{id}")
    public Book byId(@PathVariable long id) {
        return books.findById(id).orElseThrow();
    }

    @GetMapping("/search")
    public List<Book> byAuthor(@RequestParam String author) {
        return books.findByAuthor_NameContainingIgnoreCase(author);
    }

    record NewBook(String title, int year, Long authorId) {}

    @PostMapping
    public Book create(@RequestBody NewBook body) {
        Author author = authors.findById(body.authorId()).orElseThrow();
        return books.save(new Book(body.title(), body.year(), author));
    }

    @DeleteMapping("/{id}")
    public ResponseEntity<Void> delete(@PathVariable long id) {
        books.deleteById(id);
        return ResponseEntity.noContent().build();
    }
}

PS> curl.exe -X POST http://localhost:8080/api/authors -H "Content-Type: application/json" -d '{\"name\":\"Robert C. Martin\"}'
{"id":1,"name":"Robert C. Martin"}

PS> curl.exe -X POST http://localhost:8080/api/books -H "Content-Type: application/json" -d '{\"title\":\"Clean Code\",\"year\":2008,\"authorId\":1}'
{"id":1,"title":"Clean Code","year":2008,"author":{"id":1,"name":"Robert C. Martin"}}

PS> curl.exe "http://localhost:8080/api/books?page=0&size=1"
{"content":[{...}],"totalElements":1,"totalPages":1,"number":0,"size":1,...}

PS> curl.exe "http://localhost:8080/api/books/search?author=martin"
[{"id":1,"title":"Clean Code",...}]              ← case-insensitive, cross-relationship

PS> curl.exe -i -X DELETE http://localhost:8080/api/books/1
HTTP/1.1 204

PS> curl.exe -i http://localhost:8080/api/books/1
HTTP/1.1 500          ← ugly, and expected — Stage 4 fixes this

import jakarta.validation.Valid;
import jakarta.validation.constraints.Min;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;
import java.util.NoSuchElementException;
// ...existing imports...

    record NewBook(
            @NotBlank(message = "title must not be blank") String title,
            @Min(value = 1450, message = "year must be 1450 or later") int year,
            @NotNull(message = "authorId is required") Long authorId) {}

    @PostMapping
    public Book create(@Valid @RequestBody NewBook body) {
        Author author = authors.findById(body.authorId())
                .orElseThrow(() -> new NoSuchElementException("No author with id " + body.authorId()));
        return books.save(new Book(body.title(), body.year(), author));
    }

@GetMapping("/{id}")
public Book byId(@PathVariable long id) {
    return books.findById(id)
            .orElseThrow(() -> new NoSuchElementException("No book with id " + id));
}

package com.library.api;

import java.util.HashMap;
import java.util.Map;
import java.util.NoSuchElementException;
import org.springframework.http.HttpStatus;
import org.springframework.http.ProblemDetail;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(NoSuchElementException.class)
    public ProblemDetail handleNotFound(NoSuchElementException ex) {
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, ex.getMessage());
        problem.setTitle("Resource not found");
        return problem;
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ProblemDetail handleValidation(MethodArgumentNotValidException ex) {
        Map<String, String> fieldErrors = new HashMap<>();
        ex.getBindingResult().getFieldErrors().forEach(
                error -> fieldErrors.put(error.getField(), error.getDefaultMessage()));

        ProblemDetail problem = ProblemDetail.forStatusAndDetail(
                HttpStatus.BAD_REQUEST, "One or more fields are invalid");
        problem.setTitle("Validation failed");
        problem.setProperty("errors", fieldErrors);
        return problem;
    }
}

PS> curl.exe -i http://localhost:8080/api/books/999
HTTP/1.1 404
Content-Type: application/problem+json

{"type":"about:blank","title":"Resource not found","status":404,
 "detail":"No book with id 999","instance":"/api/books/999"}

PS> curl.exe -i -X POST http://localhost:8080/api/books `
       -H "Content-Type: application/json" `
       -d '{\"title\":\"\",\"year\":1200,\"authorId\":1}'
HTTP/1.1 400
Content-Type: application/problem+json

{"type":"about:blank","title":"Validation failed","status":400,
 "detail":"One or more fields are invalid","instance":"/api/books",
 "errors":{"year":"year must be 1450 or later","title":"title must not be blank"}}

package com.library.api.book;

import jakarta.validation.constraints.Min;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;

public record NewBookRequest(
        @NotBlank(message = "title must not be blank") String title,
        @Min(value = 1450, message = "year must be 1450 or later") int year,
        @NotNull(message = "authorId is required") Long authorId) {}

boolean existsByTitleIgnoreCaseAndAuthor(String title, Author author);

package com.library.api.book;

public class DuplicateBookException extends RuntimeException {
    public DuplicateBookException(String title, String authorName) {
        super("Author " + authorName + " already has a book titled \"" + title + "\"");
    }
}

@Service
public class BookService {

    private final BookRepository books;
    private final AuthorRepository authors;

    public BookService(BookRepository books, AuthorRepository authors) {
        this.books = books;
        this.authors = authors;
    }

    public Book create(NewBookRequest request) {
        Author author = authors.findById(request.authorId())
                .orElseThrow(() -> new NoSuchElementException("No author with id " + request.authorId()));

        if (books.existsByTitleIgnoreCaseAndAuthor(request.title(), author)) {
            throw new DuplicateBookException(request.title(), author.getName());
        }
        return books.save(new Book(request.title(), request.year(), author));
    }
}

@ExtendWith(MockitoExtension.class)
class BookServiceTest {

    @Mock private BookRepository books;
    @Mock private AuthorRepository authors;
    @InjectMocks private BookService bookService;

    @Test
    void createsBookWhenAuthorExistsAndTitleIsNew() {
        Author martin = new Author("Robert C. Martin");
        when(authors.findById(1L)).thenReturn(Optional.of(martin));
        when(books.existsByTitleIgnoreCaseAndAuthor("Clean Code", martin)).thenReturn(false);
        when(books.save(any(Book.class))).thenAnswer(inv -> inv.getArgument(0));

        Book saved = bookService.create(new NewBookRequest("Clean Code", 2008, 1L));

        assertThat(saved.getTitle()).isEqualTo("Clean Code");
        verify(books).save(any(Book.class));
    }

    @Test
    void rejectsDuplicateTitleForSameAuthor() {
        Author martin = new Author("Robert C. Martin");
        when(authors.findById(1L)).thenReturn(Optional.of(martin));
        when(books.existsByTitleIgnoreCaseAndAuthor("clean code", martin)).thenReturn(true);

        assertThatThrownBy(() -> bookService.create(new NewBookRequest("clean code", 2008, 1L)))
                .isInstanceOf(DuplicateBookException.class);
    }

    // + rejectsUnknownAuthor(), same shape
}

@WebMvcTest(BookController.class)
@Import(GlobalExceptionHandler.class)
class BookControllerWebMvcTest {

    @Autowired private MockMvc mockMvc;
    @MockitoBean private BookRepository books;
    @MockitoBean private BookService bookService;

    @Test
    void getByIdReturns404ProblemDetailWhenMissing() throws Exception {
        when(books.findById(999L)).thenReturn(Optional.empty());

        mockMvc.perform(get("/api/books/999"))
                .andExpect(status().isNotFound())
                .andExpect(jsonPath("$.title", is("Resource not found")));
    }

    @Test
    void createReturns400WhenTitleBlank() throws Exception {
        mockMvc.perform(post("/api/books")
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("{\"title\":\"\",\"year\":2020,\"authorId\":1}"))
                .andExpect(status().isBadRequest())
                .andExpect(jsonPath("$.errors.title").exists());
    }

    // + createReturns201BodyWhenValid(), listReturnsPageBody()
}

@DataJpaTest
class BookRepositoryDataJpaTest {

    @Autowired private BookRepository books;
    @Autowired private EntityManager entityManager;

    @Test
    void existsByTitleIgnoreCaseAndAuthorDetectsDuplicates() {
        Author bloch = new Author("Joshua Bloch");
        entityManager.persist(bloch);
        entityManager.persist(new Book("Effective Java", 2018, bloch));
        entityManager.flush();

        assertThat(books.existsByTitleIgnoreCaseAndAuthor("EFFECTIVE JAVA", bloch)).isTrue();
        assertThat(books.existsByTitleIgnoreCaseAndAuthor("Some Other Book", bloch)).isFalse();
    }
}

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@AutoConfigureTestRestTemplate
class LibraryApiIntegrationTest {

    @Autowired private TestRestTemplate rest;

    @Test
    void fullCreateAndFetchFlowWorksEndToEnd() {
        var author = rest.postForEntity("/api/authors", new Author("Integration Author"), Author.class);
        Long authorId = author.getBody().getId();

        // ...POST /api/books with that authorId, assert 200 + body contains the title...

        var notFound = rest.getForEntity("/api/books/999999", String.class);
        assertThat(notFound.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
    }
}

package com.library.api.auth;

public enum Role {
    LIBRARIAN,
    MEMBER
}

package com.library.api.auth;

import jakarta.persistence.*;

@Entity
@Table(name = "app_user")
public class User {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String username;
    private String passwordHash;

    @Enumerated(EnumType.STRING)
    private Role role;

    protected User() {}  // JPA needs a no-arg constructor

    public User(String username, String passwordHash, Role role) {
        this.username = username;
        this.passwordHash = passwordHash;
        this.role = role;
    }

    public Long getId() { return id; }
    public String getUsername() { return username; }
    public String getPasswordHash() { return passwordHash; }
    public Role getRole() { return role; }
}

package com.library.api.auth;

import java.util.Optional;
import org.springframework.data.jpa.repository.JpaRepository;

public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
    boolean existsByUsername(String username);
}

package com.library.api.auth;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import java.security.Key;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

@Service
public class JwtService {

    private final Key key;
    private final long expirationMinutes;

    public JwtService(
            @Value("${library.jwt.secret}") String secret,
            @Value("${library.jwt.expiration-minutes}") long expirationMinutes) {
        this.key = Keys.hmacShaKeyFor(secret.getBytes());
        this.expirationMinutes = expirationMinutes;
    }

    public String generateToken(User user) {
        Instant now = Instant.now();
        return Jwts.builder()
                .subject(user.getUsername())
                .claim("role", user.getRole().name())
                .issuedAt(Date.from(now))
                .expiration(Date.from(now.plus(expirationMinutes, ChronoUnit.MINUTES)))
                .signWith(key)
                .compact();
    }

    public Claims parseClaims(String token) {
        return Jwts.parser()
                .verifyWith((javax.crypto.SecretKey) key)
                .build()
                .parseSignedClaims(token)
                .getPayload();
    }
}

public record RegisterRequest(
        @NotBlank(message = "username must not be blank") String username,
        @Size(min = 8, message = "password must be at least 8 characters") String password,
        @NotNull(message = "role is required") Role role) {}

public record LoginRequest(
        @NotBlank String username,
        @NotBlank String password) {}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final UserRepository users;
    private final PasswordEncoder passwordEncoder;
    private final JwtService jwtService;

    public AuthController(UserRepository users, PasswordEncoder passwordEncoder, JwtService jwtService) {
        this.users = users;
        this.passwordEncoder = passwordEncoder;
        this.jwtService = jwtService;
    }

    record TokenResponse(String token) {}

    @PostMapping("/register")
    public TokenResponse register(@Valid @RequestBody RegisterRequest body) {
        if (users.existsByUsername(body.username())) {
            throw new IllegalStateException("Username \"" + body.username() + "\" is already taken");
        }
        User user = new User(body.username(), passwordEncoder.encode(body.password()), body.role());
        users.save(user);
        return new TokenResponse(jwtService.generateToken(user));
    }

    @PostMapping("/login")
    public TokenResponse login(@Valid @RequestBody LoginRequest body) {
        User user = users.findByUsername(body.username())
                .orElseThrow(() -> new BadCredentialsException("Invalid username or password"));

        if (!passwordEncoder.matches(body.password(), user.getPasswordHash())) {
            throw new BadCredentialsException("Invalid username or password");
        }
        return new TokenResponse(jwtService.generateToken(user));
    }
}

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;

    public JwtAuthenticationFilter(JwtService jwtService) {
        this.jwtService = jwtService;
    }

    @Override
    protected void doFilterInternal(
            HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            String token = header.substring("Bearer ".length());
            try {
                Claims claims = jwtService.parseClaims(token);
                String username = claims.getSubject();
                String role = claims.get("role", String.class);

                var authorities = List.of(new SimpleGrantedAuthority("ROLE_" + role));
                var authentication =
                        new UsernamePasswordAuthenticationToken(username, null, authorities);
                SecurityContextHolder.getContext().setAuthentication(authentication);
            } catch (JwtException ignored) {
                // Invalid or expired token: leave SecurityContext empty, request proceeds unauthenticated
            }
        }

        chain.doFilter(request, response);
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;

    public SecurityConfig(JwtAuthenticationFilter jwtAuthenticationFilter) {
        this.jwtAuthenticationFilter = jwtAuthenticationFilter;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        AuthenticationEntryPoint unauthorizedEntryPoint =
                (request, response, authException) -> response.sendError(HttpStatus.UNAUTHORIZED.value());

        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .exceptionHandling(ex -> ex.authenticationEntryPoint(unauthorizedEntryPoint))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**", "/actuator/health").permitAll()
                .anyRequest().authenticated())
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

@PreAuthorize("hasRole('LIBRARIAN')")
@PostMapping
public Book create(@Valid @RequestBody NewBookRequest body) {
    return bookService.create(body);
}

@PreAuthorize("hasRole('LIBRARIAN')")
@DeleteMapping("/{id}")
public ResponseEntity<Void> delete(@PathVariable long id) {
    books.deleteById(id);
    return ResponseEntity.noContent().build();
}

@ExceptionHandler(AccessDeniedException.class)
public ProblemDetail handleAccessDenied(AccessDeniedException ex) {
    ProblemDetail problem = ProblemDetail.forStatusAndDetail(
            HttpStatus.FORBIDDEN, "You do not have permission to perform this action");
    problem.setTitle("Access denied");
    return problem;
}

PS> curl.exe -i http://localhost:8080/api/books
HTTP/1.1 401                                          ← no token at all

PS> curl.exe -X POST http://localhost:8080/api/auth/register -H "Content-Type: application/json" -d '{\"username\":\"alice\",\"password\":\"password123\",\"role\":\"MEMBER\"}'
{"token":"eyJhbGciOiJIUzM4NCJ9.eyJzdWIiOiJhbGljZSIs..."}

PS> curl.exe -X POST http://localhost:8080/api/auth/register -H "Content-Type: application/json" -d '{\"username\":\"bob\",\"password\":\"password123\",\"role\":\"LIBRARIAN\"}'
{"token":"eyJhbGciOiJIUzM4NCJ9.eyJzdWIiOiJib2Ii..."}

# save each token to a variable, then:

PS> curl.exe -i -H "Authorization: Bearer $member" http://localhost:8080/api/books
HTTP/1.1 200                                          ← members can read

PS> curl.exe -i -X POST -H "Authorization: Bearer $member" -H "Content-Type: application/json" -d '{\"title\":\"x\",\"year\":2020,\"authorId\":1}' http://localhost:8080/api/books
HTTP/1.1 403
{"detail":"You do not have permission to perform this action","instance":"/api/books","status":403,"title":"Access denied"}

PS> curl.exe -X POST -H "Authorization: Bearer $librarian" -H "Content-Type: application/json" -d '{\"name\":\"Robert C. Martin\"}' http://localhost:8080/api/authors
{"name":"Robert C. Martin","id":1}

PS> curl.exe -i -X POST -H "Authorization: Bearer $librarian" -H "Content-Type: application/json" -d '{\"title\":\"Clean Code\",\"year\":2008,\"authorId\":1}' http://localhost:8080/api/books
HTTP/1.1 200                                          ← librarians can create

PS> curl.exe -X POST http://localhost:8080/api/auth/login -H "Content-Type: application/json" -d '{\"username\":\"alice\",\"password\":\"wrongpassword\"}'
{"detail":"Invalid username or password","instance":"/api/auth/login","status":401,"title":"Authentication failed"}

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@AutoConfigureTestRestTemplate
class LibraryApiSecurityIntegrationTest {

    @Autowired private TestRestTemplate rest;

    @Test
    void anonymousRequestToBooksIsRejected() {
        var response = rest.getForEntity("/api/books", String.class);
        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
    }

    @Test
    void memberCanReadButNotCreateBooks() {
        // register a MEMBER, GET /api/books with its token → 200,
        // POST /api/books with the same token → 403
    }

    @Test
    void librarianCanCreateBooks() {
        // register a LIBRARIAN, POST an author, POST a book → 200
    }
}

spring.application.name=library-api
spring.profiles.active=dev

management.endpoints.web.exposure.include=health,info,beans,mappings,metrics,env

spring.datasource.url=jdbc:h2:mem:librarydb
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

library.jwt.secret=dev-only-secret-change-me-dev-only-secret-change-me
library.jwt.expiration-minutes=60

spring.datasource.url=${DB_URL}
spring.datasource.username=${DB_USERNAME}
spring.datasource.password=${DB_PASSWORD}
spring.jpa.hibernate.ddl-auto=validate
spring.jpa.show-sql=false

library.jwt.secret=${JWT_SECRET}
library.jwt.expiration-minutes=60

logging.structured.format.console=ecs

package com.library.api.config;

import jakarta.validation.Valid;
import jakarta.validation.constraints.NotNull;
import jakarta.validation.constraints.Positive;
import jakarta.validation.constraints.Size;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;

@ConfigurationProperties(prefix = "library")
@Validated
public record LibraryProperties(@NotNull @Valid Jwt jwt) {
    public record Jwt(
            @Size(min = 32, message = "library.jwt.secret must be at least 32 characters "
                    + "(HMAC-SHA256 needs a >=256-bit key) - check JWT_SECRET is set and not an unresolved placeholder")
            String secret,
            @Positive long expirationMinutes) {}
}

@SpringBootApplication
@ConfigurationPropertiesScan
public class LibraryApiApplication { /* unchanged body */ }

public JwtService(LibraryProperties properties) {
    this.key = Keys.hmacShaKeyFor(properties.jwt().secret().getBytes());
    this.expirationMinutes = properties.jwt().expirationMinutes();
}

private static final Logger log = LoggerFactory.getLogger(AuthController.class);

// inside register(), after users.save(user):
log.info("Registered new user username={} role={}", user.getUsername(), user.getRole());

// inside login(), on the wrong-password branch:
log.warn("Failed login attempt username={}", body.username());

// inside login(), on success:
log.info("Successful login username={}", user.getUsername());

{"@timestamp":"2026-08-08T11:43:25.640Z","log":{"level":"INFO","logger":"com.library.api.auth.AuthController"},
 "process":{"pid":16280,"thread":{"name":"http-nio-8080-exec-2"}},
 "service":{"name":"library-api","version":"0.0.1-SNAPSHOT"},
 "message":"Registered new user username=alice role=MEMBER","ecs":{"version":"8.11"}}

.authorizeHttpRequests(auth -> auth
    .requestMatchers("/api/auth/**", "/actuator/health", "/error").permitAll()
    .requestMatchers("/actuator/beans", "/actuator/env", "/actuator/mappings").hasRole("LIBRARIAN")
    .anyRequest().authenticated())

<plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
    <executions>
        <execution>
            <goals>
                <goal>build-info</goal>
            </goals>
        </execution>
    </executions>
</plugin>

PS> curl.exe -H "Authorization: Bearer $lib" http://localhost:8080/actuator/info
{"build":{"artifact":"library-api","name":"library-api","time":"2026-08-08T11:42:01.812Z","version":"0.0.1-SNAPSHOT","group":"com.library"}}

PS> .\mvnw.cmd clean package -DskipTests
BUILD SUCCESS

PS> java -jar target\library-api-0.0.1-SNAPSHOT.jar
Started LibraryApiApplication ... (dev profile, the default)

# in a second terminal, prove nothing else is needed:
PS> curl.exe http://localhost:8080/actuator/health
{"groups":["liveness","readiness"],"status":"UP"}

spring.application.name=catalog-service
server.port=8081

spring.datasource.url=jdbc:h2:mem:catalogdb
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

management.endpoints.web.exposure.include=health,info

package com.library.catalog;

import java.util.NoSuchElementException;
import org.springframework.http.HttpStatus;
import org.springframework.http.ProblemDetail;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

@RestControllerAdvice
public class CatalogExceptionHandler {

    @ExceptionHandler(NoSuchElementException.class)
    public ProblemDetail handleNotFound(NoSuchElementException ex) {
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, ex.getMessage());
        problem.setTitle("Resource not found");
        return problem;
    }
}

spring.application.name=loan-service
server.port=8082

spring.datasource.url=jdbc:h2:mem:loandb
spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

catalog.service.base-url=http://localhost:8081
catalog.service.connect-timeout-ms=1000
catalog.service.read-timeout-ms=2000

management.endpoints.web.exposure.include=health,info

@Entity
public class Loan {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private Long bookId;
    private String bookTitle;
    private String memberName;
    private LocalDate loanDate;
    // protected no-arg constructor, a real constructor, getters — same shape as every entity since Stage 3
}

public record BookSummary(Long id, String title, int year) {}

@Configuration
public class CatalogClientConfig {

    @Bean
    public RestClient catalogRestClient(
            RestClient.Builder builder,
            @Value("${catalog.service.base-url}") String baseUrl,
            @Value("${catalog.service.connect-timeout-ms}") long connectTimeoutMs,
            @Value("${catalog.service.read-timeout-ms}") long readTimeoutMs) {

        var settings = HttpClientSettings.defaults()
                .withConnectTimeout(Duration.ofMillis(connectTimeoutMs))
                .withReadTimeout(Duration.ofMillis(readTimeoutMs));

        return builder
                .baseUrl(baseUrl)
                .requestFactory(ClientHttpRequestFactoryBuilder.detect().build(settings))
                .build();
    }
}

public class CatalogUnavailableException extends RuntimeException {
    public CatalogUnavailableException(String message, Throwable cause) {
        super(message, cause);
    }
}

@Component
public class CatalogClient {

    private final RestClient restClient;

    public CatalogClient(RestClient catalogRestClient) {
        this.restClient = catalogRestClient;
    }

    public BookSummary findBook(Long bookId) {
        try {
            return restClient.get()
                    .uri("/api/books/{id}", bookId)
                    .retrieve()
                    .body(BookSummary.class);
        } catch (HttpClientErrorException.NotFound e) {
            throw new NoSuchElementException("No book with id " + bookId + " in the catalog");
        } catch (ResourceAccessException e) {
            throw new CatalogUnavailableException("catalog-service did not respond in time", e);
        }
    }
}

@RestController
@RequestMapping("/api/loans")
public class LoanController {

    private final LoanRepository loans;
    private final CatalogClient catalogClient;

    public LoanController(LoanRepository loans, CatalogClient catalogClient) {
        this.loans = loans;
        this.catalogClient = catalogClient;
    }

    @GetMapping
    public List<Loan> all() {
        return loans.findAll();
    }

    record NewLoan(Long bookId, String memberName) {}

    @PostMapping
    public Loan create(@RequestBody NewLoan body) {
        BookSummary book = catalogClient.findBook(body.bookId());
        Loan loan = new Loan(book.id(), book.title(), body.memberName(), LocalDate.now());
        return loans.save(loan);
    }
}

@RestControllerAdvice
public class LoanExceptionHandler {

    @ExceptionHandler(NoSuchElementException.class)
    public ProblemDetail handleNotFound(NoSuchElementException ex) {
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, ex.getMessage());
        problem.setTitle("Resource not found");
        return problem;
    }

    @ExceptionHandler(CatalogUnavailableException.class)
    public ProblemDetail handleCatalogUnavailable(CatalogUnavailableException ex) {
        ProblemDetail problem = ProblemDetail.forStatusAndDetail(
                HttpStatus.SERVICE_UNAVAILABLE,
                "catalog-service is unreachable - could not verify the book, try again shortly");
        problem.setTitle("Upstream service unavailable");
        return problem;
    }
}

PS> cd catalog-service; .\mvnw.cmd spring-boot:run

PS> cd loan-service; .\mvnw.cmd spring-boot:run

PS> curl.exe -X POST http://localhost:8081/api/authors -H "Content-Type: application/json" -d '{\"name\":\"Douglas Adams\"}'
{"name":"Douglas Adams","id":1}

PS> curl.exe -X POST http://localhost:8081/api/books -H "Content-Type: application/json" -d '{\"title\":\"The Hitchhikers Guide to the Galaxy\",\"year\":1979,\"authorId\":1}'
{"title":"The Hitchhikers Guide to the Galaxy","year":1979,"author":{...},"id":1}

PS> curl.exe -X POST http://localhost:8082/api/loans -H "Content-Type: application/json" -d '{\"bookId\":1,\"memberName\":\"Arthur Dent\"}'
{"bookId":1,"bookTitle":"The Hitchhikers Guide to the Galaxy","memberName":"Arthur Dent","loanDate":"2026-08-08","id":1}

PS> curl.exe -i -X POST http://localhost:8082/api/loans -H "Content-Type: application/json" -d '{\"bookId\":999,\"memberName\":\"Ford Prefect\"}'
HTTP/1.1 404
{"detail":"No book with id 999 in the catalog","instance":"/api/loans","status":404,"title":"Resource not found"}

PS> curl.exe -i -X POST http://localhost:8082/api/loans -H "Content-Type: application/json" -d '{\"bookId\":1,\"memberName\":\"Trillian\"}'
HTTP/1.1 503
{"detail":"catalog-service is unreachable - could not verify the book, try again shortly",
 "instance":"/api/loans","status":503,"title":"Upstream service unavailable"}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-amqp</artifactId>
</dependency>

library.events.exchange=library.events
library.events.loan-borrowed-routing-key=loan.borrowed

public record BookBorrowedEvent(
        Long loanId, Long bookId, String bookTitle, String memberName, LocalDate loanDate) {}

@Configuration
public class LoanEventsConfig {

    @Bean
    public TopicExchange libraryEventsExchange(@Value("${library.events.exchange}") String exchangeName) {
        return new TopicExchange(exchangeName);
    }

    @Bean
    public MessageConverter jsonMessageConverter() {
        return new JacksonJsonMessageConverter();
    }
}

@Component
public class LoanEventPublisher {

    private static final Logger log = LoggerFactory.getLogger(LoanEventPublisher.class);

    private final RabbitTemplate rabbitTemplate;
    private final String exchange;
    private final String routingKey;

    public LoanEventPublisher(
            RabbitTemplate rabbitTemplate,
            @Value("${library.events.exchange}") String exchange,
            @Value("${library.events.loan-borrowed-routing-key}") String routingKey) {
        this.rabbitTemplate = rabbitTemplate;
        this.exchange = exchange;
        this.routingKey = routingKey;
    }

    public void publishBookBorrowed(BookBorrowedEvent event) {
        rabbitTemplate.convertAndSend(exchange, routingKey, event);
        log.info("Published BookBorrowedEvent loanId={} bookId={}", event.loanId(), event.bookId());
    }
}

@PostMapping
public Loan create(@RequestBody NewLoan body) {
    BookSummary book = catalogClient.findBook(body.bookId());
    Loan loan = loans.save(new Loan(book.id(), book.title(), body.memberName(), LocalDate.now()));

    eventPublisher.publishBookBorrowed(
            new BookBorrowedEvent(loan.getId(), loan.getBookId(), loan.getBookTitle(),
                    loan.getMemberName(), loan.getLoanDate()));

    return loan;
}

spring.application.name=notification-service
server.port=8083

library.events.exchange=library.events
library.events.loan-borrowed-routing-key=loan.borrowed
library.events.loan-borrowed-queue=notification.loan-borrowed

management.endpoints.web.exposure.include=health,info

@Configuration
public class LoanEventsConfig {

    @Bean
    public TopicExchange libraryEventsExchange(@Value("${library.events.exchange}") String exchangeName) {
        return new TopicExchange(exchangeName);
    }

    @Bean
    public Queue loanBorrowedQueue(@Value("${library.events.loan-borrowed-queue}") String queueName) {
        return new Queue(queueName, true);  // true = durable, survives a broker restart
    }

    @Bean
    public Binding loanBorrowedBinding(
            Queue loanBorrowedQueue, TopicExchange libraryEventsExchange,
            @Value("${library.events.loan-borrowed-routing-key}") String routingKey) {
        return BindingBuilder.bind(loanBorrowedQueue).to(libraryEventsExchange).with(routingKey);
    }

    @Bean
    public MessageConverter jsonMessageConverter() {
        return new JacksonJsonMessageConverter();
    }
}

@Component
public class LoanBorrowedListener {

    private static final Logger log = LoggerFactory.getLogger(LoanBorrowedListener.class);
    private final List<String> sentNotifications = new CopyOnWriteArrayList<>();

    @RabbitListener(queues = "${library.events.loan-borrowed-queue}")
    public void onBookBorrowed(BookBorrowedEvent event) {
        String message = "Notify %s: you borrowed \"%s\" on %s"
                .formatted(event.memberName(), event.bookTitle(), event.loanDate());
        log.info(message);
        sentNotifications.add(Instant.now() + " - " + message);
    }

    public List<String> getSentNotifications() {
        return Collections.unmodifiableList(sentNotifications);
    }
}