🌱 Spring – Core, Boot, Data, Security, Cloud, Observability

Modules fréquents

Architecture “production-friendly”

• Layering : Controller → Service → Repository.
• DTO en API (éviter d’exposer directement des entités JPA).
• Observability : metrics + traces + logs corrélés + health checks.
• Configuration : profiles + secrets + validation.
• Tests : slices + Testcontainers pour les composants critiques.

Scopes (l’essentiel)

Bean lifecycle (hooks utiles)

// English-only sample
@Bean(initMethod = "start", destroyMethod = "stop")
public Worker worker() { return new Worker(); }

@PostConstruct
public void init() { /* init */ }

@PreDestroy
public void shutdown() { /* cleanup */ }

En prod : préférer des composants stateless + ressources explicites (DataSource, HTTP client).

application.yml : pattern sain

# English-only sample
spring:
  application:
    name: demo
  datasource:
    url: jdbc:postgresql://db:5432/app
    username: app
    password: ${DB_PASSWORD}
  jpa:
    hibernate:
      ddl-auto: validate
    open-in-view: false

management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus

Actuator : endpoints essentiels

# English-only sample
management.endpoint.health.probes.enabled=true
management.endpoint.health.show-details=never

Bean Validation sur DTO

// English-only sample
public record CreateCustomerRequest(
  @NotBlank @Size(max = 120) String name,
  @Email @NotBlank String email
) {}

@PostMapping
public CustomerDto create(@Valid @RequestBody CreateCustomerRequest req) {
  return service.createCustomer(req);
}

Valider côté API + contraintes DB (unique, not null) = robustesse.

Exception mapping propre

// English-only sample
@RestControllerAdvice
public class ApiErrors {
  @ExceptionHandler(NotFoundException.class)
  @ResponseStatus(HttpStatus.NOT_FOUND)
  public Map notFound(NotFoundException e) {
    return Map.of("error", "NOT_FOUND", "message", e.getMessage());
  }
}

Standardiser les erreurs = meilleure observabilité + intégration clients.

Pagination + sorting

// English-only sample
Page page = repo.findAll(PageRequest.of(0, 50, Sort.by("name").ascending()));

Specifications (filtres dynamiques)

// English-only sample
public static Specification hasStatus(String status) {
  return (root, query, cb) -> cb.equal(root.get("status"), status);
}

N+1 : le vrai sujet Data/JPA

• Ne pas exposer les entités directement en API.
• Préférer DTO projections / fetch plan explicite.
• Désactiver Open Session In View (Boot) et charger ce qui est nécessaire dans la TX.

# English-only sample
spring.jpa.open-in-view=false

Propagation : usage typique

// English-only sample
@Transactional(propagation = Propagation.REQUIRES_NEW)
public void writeAudit(AuditEvent e) { /* ... */ }

Pièges fréquents

• Self-invocation : un appel interne n’active pas le proxy → pas de TX.
• Read-only : hint, pas un “no-write firewall”.
• Large TX : locks longs + timeouts + mémoire (persistence context).

JWT (API stateless) – pattern

• Issuer, audience, expiration, rotation keys.
• Scopes/roles normalisés.
• Reject tokens on clock skew too large.

// English-only sample
http
  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
  .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));

Hardening checklist

• CSRF activé sur apps stateful, désactivé uniquement si API stateless maîtrisée.
• Headers : CSP, HSTS, X-Content-Type-Options.
• Limiter l’exposition Actuator (auth + réseau).
• Logs d’auth : corrélation request_id + user_id.

Secrets : règles simples

• Jamais en dur dans Git.
• Variables d’environnement + secret manager (Vault/Cloud provider).
• Rotation + audit + least privilege.

# English-only sample
spring.datasource.password=${DB_PASSWORD}

Patterns robustes

// English-only sample
@ConfigurationProperties(prefix = "app.billing")
public record BillingProps(int retryMax) {}

Tracing distribué

Objectif : suivre une requête bout-en-bout via trace_id et corréler logs + spans + DB calls.

# English-only sample
logging.pattern.level=%5p [trace=%X{traceId:-} span=%X{spanId:-}]

Readiness / Liveness

# English-only sample
management.endpoint.health.probes.enabled=true
management.health.livenessState.enabled=true
management.health.readinessState.enabled=true

@WebMvcTest

// English-only sample
@WebMvcTest(CustomerController.class)
class CustomerControllerTest {
  @Autowired MockMvc mvc;
  @MockBean CustomerService service;
}

@DataJpaTest

// English-only sample
@DataJpaTest
class CustomerRepositoryTest {
  @Autowired CustomerRepository repo;
}

DB “réelle” en test

// English-only sample
@Testcontainers
class DbIT {
  @Container static PostgreSQLContainer db = new PostgreSQLContainer<>("postgres:16");
}

Indispensable pour N+1, plans, locks, isolation, migrations.

Connection pool (Hikari) : points clés

• pool trop petit → timeouts / queueing.
• pool trop grand → surcharge DB.
• mesurer active/idle, wait time, saturation.

# English-only sample
spring.datasource.hikari.maximumPoolSize=20
spring.datasource.hikari.connectionTimeout=3000

Cache & async (prudence)

• Cache uniquement si stratégie d’invalidation définie.
• Async utile pour I/O (HTTP) mais attention au backpressure.
• Pour débit : limiter concurrency + timeouts + retries.

// English-only sample
@Cacheable("customerById")
public CustomerDto getCustomer(long id) { /* ... */ }

@Async
public CompletableFuture sync() { /* ... */ }

API Gateway : rôle

• Auth edge, routing, retries, rate limit, WAF-like.
• Observability centralisée (traces, headers).

# English-only sample (concept)
routes:
  - id: api
    uri: http://service
    predicates:
      - Path=/api/**

Resilience