Spring Boot & Spring Framework cheat sheet#

<!-- Fragment inside <project>; keep generated coordinates/modelVersion/build. -->
<parent>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-parent</artifactId>
  <version>4.1.1</version>
</parent>
<properties>
  <java.version>21</java.version>
</properties>
<dependencies>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-webmvc</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security-oauth2-resource-server</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-validation</artifactId>
  </dependency>
  <dependency>
    <groupId>org.postgresql</groupId>
    <artifactId>postgresql</artifactId>
    <scope>runtime</scope>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <scope>test</scope>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-webmvc-test</artifactId>
    <scope>test</scope>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa-test</artifactId>
    <scope>test</scope>
  </dependency>
  <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-test</artifactId>
    <scope>test</scope>
  </dependency>
</dependencies>

@SpringBootApplication
public class App {
    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }
}

spring:
  application:
    name: orders
  threads:
    virtual:
      enabled: true          # Java 21 virtual threads for Tomcat/request
  datasource:
    url: jdbc:postgresql://localhost:5432/orders
    username: app
    password: ${DB_PASSWORD}
    hikari:
      maximum-pool-size: 20
      minimum-idle: 5
  jpa:
    open-in-view: false      # NEVER leave true in APIs
    hibernate:
      ddl-auto: validate     # prod: validate/none; Flyway/Liquibase owns schema
    properties:
      hibernate:
        jdbc:
          time_zone: UTC
  jackson:
    default-property-inclusion: non_null

server:
  port: 8080
  shutdown: graceful
  tomcat:
    threads:
      max: 200               # platform-thread pool only; no effect with virtual threads

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus,metrics
  endpoint:
    health:
      probes:
        enabled: true        # /actuator/health/liveness + readiness

logging:
  level:
    org.springframework.web: INFO
    org.hibernate.SQL: WARN

@Service
public class OrderService {
    private final OrderRepository repo;
    private final Clock clock;

    public OrderService(OrderRepository repo, Clock clock) {
        this.repo = repo;
        this.clock = clock;
    }

    @Transactional
    public Order pay(long id) {
        Order o = repo.findById(id).orElseThrow(() -> new NotFound(id));
        o.pay(clock.instant());
        return o;
    }
}

@Configuration
class TimeConfig {
    @Bean Clock clock() { return Clock.systemUTC(); }
}

@RestController
@RequestMapping("/api/orders")
class OrderController {
    private final OrderService service;

    OrderController(OrderService service) { this.service = service; }

    @GetMapping("/{id}")
    OrderResponse get(@PathVariable long id) {
        return OrderResponse.from(service.get(id));
    }

    @PostMapping
    @ResponseStatus(HttpStatus.CREATED)
    OrderResponse create(@Valid @RequestBody CreateOrderRequest req) {
        return OrderResponse.from(service.create(req));
    }

    @GetMapping
    Page<OrderResponse> list(
            @RequestParam(defaultValue = "0") @Min(0) int page,
            @RequestParam(defaultValue = "20") @Min(1) @Max(100) int size) {
        return service.list(PageRequest.of(page, size)).map(OrderResponse::from);
    }
}

record CreateOrderRequest(@NotNull @Positive Long userId, @NotNull @Positive BigDecimal total) {}
record OrderResponse(long id, String status, BigDecimal total) {
    static OrderResponse from(Order o) {
        return new OrderResponse(o.getId(), o.getStatus().name(), o.getTotal());
    }
}

@RestControllerAdvice
class ApiErrors {
    @ExceptionHandler(NotFound.class)
    ProblemDetail notFound(NotFound ex) {
        return ProblemDetail.forStatusAndDetail(HttpStatus.NOT_FOUND, "Order not found");
    }

    @ExceptionHandler({MethodArgumentNotValidException.class, HandlerMethodValidationException.class})
    ProblemDetail invalid(Exception ex) {
        HttpStatus status = ex instanceof HandlerMethodValidationException validation
                && validation.isForReturnValue()
                ? HttpStatus.INTERNAL_SERVER_ERROR : HttpStatus.BAD_REQUEST;
        return ProblemDetail.forStatusAndDetail(status, "Validation failed");
    }
}

public record UserIn(
    @Email @NotBlank String email,
    @NotNull @Size(min = 8) String password
) {}

@Entity
@Table(name = "orders")
class Order {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Version
    private Long version;        // optimistic conflict detection

    @ManyToOne(fetch = FetchType.LAZY, optional = false)
    private User user;

    @Enumerated(EnumType.STRING)
    private Status status;

    private BigDecimal total;

    protected Order() {}          // JPA
    // getters, domain methods
}

interface OrderRepository extends JpaRepository<Order, Long> {
    @Query("select o from Order o join fetch o.user where o.id = :id")
    Optional<Order> findWithUser(@Param("id") long id);

    Page<Order> findByUserId(long userId, Pageable pageable);

    @Transactional
    @Modifying(flushAutomatically = true, clearAutomatically = true)
    @Query("update Order o set o.status = :s where o.id = :id")
    int updateStatus(@Param("id") long id, @Param("s") Status s);
}

@Transactional                 // proxy, rollback on RuntimeException
public void pay(long id) { ... }

@Transactional(readOnly = true)
public Order get(long id) { ... }

@Transactional(propagation = Propagation.REQUIRES_NEW)
public void audit() { ... }

import static org.springframework.security.config.http.SessionCreationPolicy.STATELESS;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
class SecurityConfig {

    @Bean
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        return http
            .csrf(csrf -> csrf.disable())          // stateless JWT API; keep CSRF for cookie sessions
            .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
            .authorizeHttpRequests(a -> a
                .requestMatchers("/actuator/health/**", "/api/public/**").permitAll()
                .requestMatchers(HttpMethod.POST, "/api/orders/**").hasAuthority("SCOPE_orders:write")
                .anyRequest().authenticated())
            .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
            .build();
    }
}

@PreAuthorize("hasAuthority('SCOPE_orders:write')")
public Order create(...) { ... }

@PreAuthorize("#subject == authentication.name")
public List<Order> bySubject(String subject) { ... }

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.example.com/realms/app
          audiences: orders-api   # match the audience issued for this API

@RestController
class ReactiveOrderController {
    private final OrderR2dbcRepo repo;

    ReactiveOrderController(OrderR2dbcRepo repo) { this.repo = repo; }

    @GetMapping("/{id}")
    Mono<Order> get(@PathVariable long id) {
        return repo.findById(id).switchIfEmpty(Mono.error(
            new ResponseStatusException(HttpStatus.NOT_FOUND)));
    }

    @GetMapping
    Flux<Order> all() {
        return repo.findAll();
    }
}

spring.threads.virtual.enabled: true

management:
  tracing:
    sampling:
      probability: 0.1
  opentelemetry:
    tracing:
      export:
        otlp:
          endpoint: http://otel-collector:4318/v1/traces

@ConfigurationProperties(prefix = "app")
record AppProps(int pageSize, URI billingBase) {}

@SpringBootTest
@AutoConfigureMockMvc
class OrderIT {
    @Autowired MockMvc mvc;
    @MockitoBean OrderRepository repo;   // Boot 3.4+/4: @MockitoBean not @MockBean

    @Test
    void getOrder() throws Exception {
        when(repo.findById(1L)).thenReturn(Optional.of(order));
        mvc.perform(get("/api/orders/1").with(jwt().jwt(j -> j.subject("u"))))
           .andExpect(status().isOk())
           .andExpect(jsonPath("$.id").value(1));
    }
}

@DataJpaTest
class OrderRepoTest {
    @Autowired OrderRepository repo;
    @Test
    void save() { ... }
}

@WebMvcTest(OrderController.class)
class OrderWebTest {
    @Autowired MockMvc mvc;
    @MockitoBean OrderService service;
}

@Service
class OrderService {
    private final ApplicationEventPublisher events;
    private final OrderRepository repo;

    OrderService(ApplicationEventPublisher events, OrderRepository repo) {
        this.events = events;
        this.repo = repo;
    }

    @Transactional
    public Order pay(long id) {
        Order o = repo.findById(id).orElseThrow(() -> new NotFound(id));
        o.pay();  // domain transition; implement idempotency/payment verification
        events.publishEvent(new OrderPaid(o.getId())); // listener after commit if @TransactionalEventListener
        return o;
    }
}

@Component
class PaidListener {
    @TransactionalEventListener(phase = TransactionPhase.AFTER_COMMIT)
    public void on(OrderPaid e) { /* queue email */ }
}

@EnableCaching
@Configuration
class CacheConfig {
    @Bean
    CacheManager cacheManager() {
        return new ConcurrentMapCacheManager("orders"); // local demo: no eviction/TTL
    }
}

@Cacheable("orders")
public Order get(long id) { ... }

@CacheEvict(value = "orders", key = "#result.id", condition = "#result != null")
public Order save(Order order) { ... }

@Bean
RestClient billingClient(RestClient.Builder b) {
    return b.baseUrl("https://billing.internal").build();
}

@HttpExchange("/v1/invoices")
interface BillingApi {
    @GetExchange("/{id}")
    Invoice get(@PathVariable long id);
}

HTTP → Tomcat VT/platform thread
    → Filters (Security, CORS, tracing)
    → DispatcherServlet
    → Controller
    → Service @Transactional (proxy)
    → Repository (EntityManager / Hikari connection)

@SpringBootApplication
public class App {
    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }
}

@RestController
@RequestMapping("/api/orders")
class OrderController {
    private final OrderRepository repo;
    OrderController(OrderRepository repo) { this.repo = repo; }

    @GetMapping("/{id}")
    Order get(@PathVariable Long id) {
        return repo.findById(id).orElseThrow(() -> new ResponseStatusException(NOT_FOUND));
    }
}

interface OrderRepository extends JpaRepository<Order, Long> {}