Spring Boot Interview — The Complete Guide

// ❌ Without IoC — tight coupling
public class OrderService {
    private final OrderRepository repo = new OrderRepository(); // creates its own dependency
}

// ✅ With IoC — container injects the dependency
@Service
public class OrderService {
    private final OrderRepository repo;

    public OrderService(OrderRepository repo) {
        this.repo = repo; // injected by Spring
    }
}

// @Component — Spring discovers and creates this automatically
@Service // specialization of @Component
public class UserService {
    // ...
}

// @Bean — you control instantiation (useful for third-party classes)
@Configuration
public class AppConfig {
    @Bean
    public RestTemplate restTemplate() {
        return new RestTemplateBuilder()
            .setConnectTimeout(Duration.ofSeconds(5))
            .setReadTimeout(Duration.ofSeconds(10))
            .build();
    }
}

@Component
public class CacheWarmer {

    @PostConstruct
    public void warmCache() {
        // Runs after DI is complete — load frequently accessed data
        log.info("Warming cache...");
        cacheService.loadHotData();
    }

    @PreDestroy
    public void cleanup() {
        // Runs on application shutdown — release resources
        log.info("Flushing cache to disk...");
        cacheService.flush();
    }
}

// Different implementations per environment
@Profile("dev")
@Service
public class MockPaymentGateway implements PaymentGateway {
    public PaymentResult charge(Money amount) {
        return PaymentResult.success(); // always succeeds in dev
    }
}

@Profile("prod")
@Service
public class StripePaymentGateway implements PaymentGateway {
    public PaymentResult charge(Money amount) {
        return stripeClient.charge(amount); // real payment in prod
    }
}

// How Spring Boot auto-configures a DataSource
@AutoConfiguration
@ConditionalOnClass(DataSource.class)                    // only if JDBC is on classpath
@ConditionalOnProperty(name = "spring.datasource.url")   // only if URL is configured
public class DataSourceAutoConfiguration {

    @Bean
    @ConditionalOnMissingBean                             // only if user hasn't defined their own
    public DataSource dataSource(DataSourceProperties props) {
        return DataSourceBuilder.create()
            .url(props.getUrl())
            .username(props.getUsername())
            .password(props.getPassword())
            .build();
    }
}

// ✅ Constructor injection (preferred)
@Service
public class OrderService {
    private final OrderRepository repo;
    private final NotificationService notifications;

    // @Autowired is optional with single constructor (Spring 4.3+)
    public OrderService(OrderRepository repo, NotificationService notifications) {
        this.repo = repo;
        this.notifications = notifications;
    }
}

// ❌ Field injection (avoid)
@Service
public class OrderService {
    @Autowired private OrderRepository repo;           // not final, hidden dependency
    @Autowired private NotificationService notifications; // can't easily mock in tests
}

public interface NotificationService {
    void send(String message);
}

@Service
@Primary // default when no qualifier specified
public class EmailNotificationService implements NotificationService { ... }

@Service("smsNotifier")
public class SmsNotificationService implements NotificationService { ... }

// Uses EmailNotificationService (the @Primary)
@Service
public class OrderService {
    public OrderService(NotificationService notifications) { ... }
}

// Uses SmsNotificationService (explicit @Qualifier)
@Service
public class AlertService {
    public AlertService(@Qualifier("smsNotifier") NotificationService notifications) { ... }
}

// ❌ Circular dependency — fails at startup with constructor injection
@Service
public class ServiceA {
    public ServiceA(ServiceB b) { }
}
@Service
public class ServiceB {
    public ServiceB(ServiceA a) { }
}

// ✅ Fix 1: @Lazy — creates a proxy, resolves lazily
@Service
public class ServiceA {
    public ServiceA(@Lazy ServiceB b) { }
}

// ✅ Fix 2 (better): Redesign — extract shared logic
@Service
public class SharedLogic { }

@Service
public class ServiceA {
    public ServiceA(SharedLogic shared) { }
}
@Service
public class ServiceB {
    public ServiceB(SharedLogic shared) { }
}

@RestController
@RequestMapping("/api/v1/users")
public class UserController {

    @GetMapping                          // GET /api/v1/users
    public List<UserDto> listUsers(@RequestParam(defaultValue = "0") int page,
                                   @RequestParam(defaultValue = "20") int size) {
        return userService.findAll(page, size);
    }

    @GetMapping("/{id}")                 // GET /api/v1/users/123
    public UserDto getUser(@PathVariable Long id) {
        return userService.findById(id);
    }

    @PostMapping                         // POST /api/v1/users
    @ResponseStatus(HttpStatus.CREATED)
    public UserDto createUser(@Valid @RequestBody CreateUserRequest request) {
        return userService.create(request);
    }

    @PutMapping("/{id}")                 // PUT /api/v1/users/123
    public UserDto updateUser(@PathVariable Long id,
                              @Valid @RequestBody UpdateUserRequest request) {
        return userService.update(id, request);
    }

    @DeleteMapping("/{id}")              // DELETE /api/v1/users/123
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void deleteUser(@PathVariable Long id) {
        userService.delete(id);
    }
}

public record CreateUserRequest(
    @NotBlank(message = "Name is required")
    String name,

    @Email(message = "Must be a valid email")
    @NotBlank
    String email,

    @Size(min = 8, max = 100, message = "Password must be 8-100 characters")
    String password,

    @Min(value = 18, message = "Must be at least 18")
    Integer age
) {}

// Custom validator
@Constraint(validatedBy = UniqueEmailValidator.class)
@Target(ElementType.FIELD)
@Retention(RetentionPolicy.RUNTIME)
public @interface UniqueEmail {
    String message() default "Email already exists";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(ResourceNotFoundException.class)
    public ResponseEntity<ErrorResponse> handleNotFound(ResourceNotFoundException ex) {
        var error = new ErrorResponse("NOT_FOUND", ex.getMessage());
        return ResponseEntity.status(404).body(error);
    }

    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<ErrorResponse> handleValidation(MethodArgumentNotValidException ex) {
        List<FieldError> errors = ex.getBindingResult().getFieldErrors().stream()
            .map(f -> new FieldError(f.getField(), f.getDefaultMessage()))
            .toList();
        var error = new ErrorResponse("VALIDATION_ERROR", "Invalid input", errors);
        return ResponseEntity.badRequest().body(error);
    }

    @ExceptionHandler(DataIntegrityViolationException.class)
    public ResponseEntity<ErrorResponse> handleConflict(DataIntegrityViolationException ex) {
        var error = new ErrorResponse("CONFLICT", "Resource already exists");
        return ResponseEntity.status(409).body(error);
    }

    @ExceptionHandler(Exception.class)
    public ResponseEntity<ErrorResponse> handleGeneric(Exception ex) {
        log.error("Unhandled exception", ex);
        var error = new ErrorResponse("INTERNAL_ERROR", "Something went wrong");
        return ResponseEntity.internalServerError().body(error);
    }
}

// Always return the same shape — clients can parse predictably
public record ErrorResponse(
    String code,
    String message,
    List<FieldError> details,  // null for non-validation errors
    Instant timestamp,
    String requestId
) {
    public ErrorResponse(String code, String message) {
        this(code, message, null, Instant.now(), MDC.get("requestId"));
    }
    public ErrorResponse(String code, String message, List<FieldError> details) {
        this(code, message, details, Instant.now(), MDC.get("requestId"));
    }
}

public record FieldError(String field, String message) {}

public interface UserRepository extends JpaRepository<User, Long> {

    // Spring generates: SELECT * FROM users WHERE email = ?
    Optional<User> findByEmail(String email);

    // SELECT * FROM users WHERE status = ? AND age > ?
    List<User> findByStatusAndAgeGreaterThan(String status, int age);

    // SELECT * FROM users WHERE name LIKE '%keyword%' ORDER BY created_at DESC
    List<User> findByNameContainingOrderByCreatedAtDesc(String keyword);

    // SELECT COUNT(*) FROM users WHERE status = ?
    long countByStatus(String status);

    // SELECT * FROM users WHERE email = ? (returns boolean)
    boolean existsByEmail(String email);

    // Custom JPQL when method names get too long
    @Query("SELECT u FROM User u WHERE u.department.name = :dept AND u.active = true")
    List<User> findActiveByDepartment(@Param("dept") String department);

    // Native SQL for complex queries
    @Query(value = "SELECT * FROM users WHERE created_at > NOW() - INTERVAL '30 days'",
           nativeQuery = true)
    List<User> findRecentUsers();
}

// ❌ N+1 — 101 queries for 100 orders
List<Order> orders = orderRepo.findAll();
orders.forEach(o -> log.info(o.getUser().getName())); // 100 extra SELECTs!

// ✅ Fix 1: JOIN FETCH in JPQL — single query
@Query("SELECT o FROM Order o JOIN FETCH o.user")
List<Order> findAllWithUsers();

// ✅ Fix 2: @EntityGraph — declarative
@EntityGraph(attributePaths = {"user", "items"})
List<Order> findAll();

// ✅ Fix 3: @BatchSize — Hibernate batches lazy loads
@Entity
public class Order {
    @ManyToOne(fetch = FetchType.LAZY)
    @BatchSize(size = 50) // loads users in batches of 50
    private User user;
}

// Repository — just add Pageable parameter
Page<User> findByStatus(String status, Pageable pageable);

// Service
public Page<UserDto> getActiveUsers(int page, int size) {
    Pageable pageable = PageRequest.of(page, size, Sort.by("createdAt").descending());
    return userRepo.findByStatus("ACTIVE", pageable)
        .map(this::toDto); // map entity to DTO
}

// Controller
@GetMapping
public Page<UserDto> listUsers(@RequestParam(defaultValue = "0") int page,
                                @RequestParam(defaultValue = "20") int size) {
    return userService.getActiveUsers(page, size);
}
// Response includes: content, totalElements, totalPages, number, size

@Service
public class OrderService {

    // ✅ Correct — public method, proxy intercepts
    @Transactional
    public void placeOrder(OrderRequest request) {
        Order order = orderRepo.save(toEntity(request));
        paymentService.charge(order);  // if this fails, order save is rolled back
    }

    // ❌ Self-invocation — proxy is bypassed!
    public void processOrders(List<OrderRequest> requests) {
        requests.forEach(this::placeOrder); // calls through 'this', not proxy
    }

    // ✅ Fix: inject self or use TransactionTemplate
    @Autowired private OrderService self; // proxy reference
    public void processOrders(List<OrderRequest> requests) {
        requests.forEach(self::placeOrder); // calls through proxy
    }

    // ✅ Rollback on checked exceptions
    @Transactional(rollbackFor = Exception.class)
    public void riskyOperation() throws PaymentException {
        // checked exception will now trigger rollback
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(csrf -> csrf.disable())                    // stateless API — no CSRF needed
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()  // public endpoints
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers(HttpMethod.GET, "/api/posts/**").permitAll()
                .anyRequest().authenticated()                 // everything else needs auth
            )
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint((req, res, e) ->
                    res.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"))
                .accessDeniedHandler((req, res, e) ->
                    res.sendError(HttpServletResponse.SC_FORBIDDEN, "Forbidden"))
            )
            .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

@Component
public class JwtAuthFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain chain) throws ServletException, IOException {
        String header = request.getHeader("Authorization");

        if (header == null || !header.startsWith("Bearer ")) {
            chain.doFilter(request, response); // no token — let other filters handle
            return;
        }

        String token = header.substring(7);
        try {
            Claims claims = jwtService.validateToken(token);
            var auth = new UsernamePasswordAuthenticationToken(
                claims.getSubject(),
                null,
                List.of(new SimpleGrantedAuthority("ROLE_" + claims.get("role")))
            );
            SecurityContextHolder.getContext().setAuthentication(auth);
        } catch (JwtException e) {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token");
            return;
        }

        chain.doFilter(request, response);
    }
}

@Configuration
@EnableMethodSecurity // enables @PreAuthorize, @PostAuthorize
public class MethodSecurityConfig {}

@Service
public class UserService {

    @PreAuthorize("hasRole('ADMIN')")
    public void deleteUser(Long id) { ... }

    @PreAuthorize("#userId == authentication.principal.id or hasRole('ADMIN')")
    public UserDto getUser(Long userId) { ... }

    @PostAuthorize("returnObject.owner == authentication.principal.username")
    public Document getDocument(Long docId) { ... }
}

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowedOrigins(List.of("https://myapp.com"));
    config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
    config.setAllowedHeaders(List.of("Authorization", "Content-Type"));
    config.setAllowCredentials(true);

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", config);
    return source;
}

@WebMvcTest(UserController.class) // loads only this controller
class UserControllerTest {

    @Autowired private MockMvc mockMvc;
    @MockBean private UserService userService; // mock the service layer

    @Test
    void shouldReturnUser() throws Exception {
        var user = new UserDto(1L, "Alice", "alice@example.com");
        when(userService.findById(1L)).thenReturn(user);

        mockMvc.perform(get("/api/v1/users/1"))
            .andExpect(status().isOk())
            .andExpect(jsonPath("$.name").value("Alice"))
            .andExpect(jsonPath("$.email").value("alice@example.com"));
    }

    @Test
    void shouldReturn400ForInvalidInput() throws Exception {
        var invalidBody = "{\"name\": \"\", \"email\": \"not-an-email\"}";

        mockMvc.perform(post("/api/v1/users")
                .contentType(MediaType.APPLICATION_JSON)
                .content(invalidBody))
            .andExpect(status().isBadRequest())
            .andExpect(jsonPath("$.code").value("VALIDATION_ERROR"));
    }

    @Test
    void shouldReturn404WhenNotFound() throws Exception {
        when(userService.findById(999L))
            .thenThrow(new ResourceNotFoundException("User not found"));

        mockMvc.perform(get("/api/v1/users/999"))
            .andExpect(status().isNotFound());
    }
}

@DataJpaTest // loads JPA components + embedded H2 by default
class UserRepositoryTest {

    @Autowired private UserRepository userRepo;
    @Autowired private TestEntityManager em;

    @Test
    void shouldFindByEmail() {
        em.persistAndFlush(new User("Alice", "alice@example.com"));

        Optional<User> found = userRepo.findByEmail("alice@example.com");

        assertThat(found).isPresent();
        assertThat(found.get().getName()).isEqualTo("Alice");
    }

    @Test
    void shouldReturnEmptyForNonExistentEmail() {
        Optional<User> found = userRepo.findByEmail("nobody@example.com");
        assertThat(found).isEmpty();
    }
}

@SpringBootTest
@Testcontainers
class OrderIntegrationTest {

    @Container
    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16")
        .withDatabaseName("testdb");

    @DynamicPropertySource
    static void configureProperties(DynamicPropertyRegistry registry) {
        registry.add("spring.datasource.url", postgres::getJdbcUrl);
        registry.add("spring.datasource.username", postgres::getUsername);
        registry.add("spring.datasource.password", postgres::getPassword);
    }

    @Test
    void shouldPlaceOrderEndToEnd() {
        // full integration test with real Postgres
    }
}

@Configuration
@EnableCaching
public class CacheConfig {
    @Bean
    public CacheManager cacheManager() {
        // Simple in-memory cache (use Redis in production)
        return new ConcurrentMapCacheManager("users", "products");
    }
}

@Service
public class UserService {

    @Cacheable(value = "users", key = "#id")
    public UserDto findById(Long id) {
        log.info("Cache miss — querying DB for user {}", id);
        return userRepo.findById(id).map(this::toDto)
            .orElseThrow(() -> new ResourceNotFoundException("User not found"));
    }

    @CacheEvict(value = "users", key = "#id")
    public UserDto updateUser(Long id, UpdateUserRequest request) {
        // cache entry for this id is evicted after method executes
        return userRepo.findById(id).map(user -> {
            user.setName(request.name());
            return toDto(userRepo.save(user));
        }).orElseThrow();
    }

    @CacheEvict(value = "users", allEntries = true)
    public void clearUserCache() {
        // evicts all entries in the "users" cache
    }
}

@Configuration
@EnableAsync
public class AsyncConfig {
    @Bean
    public Executor taskExecutor() {
        ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
        executor.setCorePoolSize(5);
        executor.setMaxPoolSize(10);
        executor.setQueueCapacity(100);
        executor.setThreadNamePrefix("async-");
        executor.initialize();
        return executor;
    }
}

@Service
public class NotificationService {

    @Async // runs on a separate thread from the pool
    public CompletableFuture<Void> sendWelcomeEmail(String email) {
        emailClient.send(email, "Welcome!", "...");
        return CompletableFuture.completedFuture(null);
    }

    @Async
    public CompletableFuture<ReportDto> generateReport(Long userId) {
        // heavy computation — doesn't block the caller
        ReportDto report = buildReport(userId);
        return CompletableFuture.completedFuture(report);
    }
}

@Configuration
@EnableScheduling
public class SchedulingConfig {}

@Component
public class ScheduledTasks {

    @Scheduled(fixedRate = 60000) // every 60 seconds
    public void refreshCache() {
        cacheService.refreshHotData();
    }

    @Scheduled(cron = "0 0 2 * * ?") // every day at 2 AM
    public void cleanupExpiredSessions() {
        sessionRepo.deleteExpired();
    }

    @Scheduled(fixedDelay = 30000) // 30s after previous execution completes
    public void processQueue() {
        queueService.processPendingItems();
    }
}

// Spring Cloud Gateway configuration
@Configuration
public class GatewayConfig {

    @Bean
    public RouteLocator routes(RouteLocatorBuilder builder) {
        return builder.routes()
            .route("user-service", r -> r
                .path("/api/users/**")
                .filters(f -> f
                    .stripPrefix(1)
                    .addRequestHeader("X-Request-Source", "gateway"))
                .uri("lb://user-service"))  // lb:// = load-balanced via discovery
            .route("order-service", r -> r
                .path("/api/orders/**")
                .uri("lb://order-service"))
            .build();
    }
}

// application.yml
// resilience4j.circuitbreaker.instances.paymentService:
//   failureRateThreshold: 50        # open after 50% failures
//   waitDurationInOpenState: 10s    # wait 10s before half-open
//   slidingWindowSize: 10           # evaluate last 10 calls

@Service
public class OrderService {

    @CircuitBreaker(name = "paymentService", fallbackMethod = "paymentFallback")
    public PaymentResult processPayment(Order order) {
        return paymentClient.charge(order.getTotal()); // calls external service
    }

    // Fallback when circuit is open or call fails
    private PaymentResult paymentFallback(Order order, Throwable throwable) {
        log.warn("Payment service unavailable, queuing for retry", throwable);
        retryQueue.enqueue(order);
        return PaymentResult.pending("Payment queued for retry");
    }
}

# Expose specific actuator endpoints
management:
  endpoints:
    web:
      exposure:
        include: health, info, metrics, prometheus
  endpoint:
    health:
      show-details: when-authorized  # show DB, disk, Redis status
  health:
    db:
      enabled: true
    redis:
      enabled: true

@Component
public class PaymentGatewayHealthIndicator implements HealthIndicator {

    @Override
    public Health health() {
        try {
            boolean reachable = paymentClient.ping();
            if (reachable) {
                return Health.up()
                    .withDetail("provider", "Stripe")
                    .withDetail("latency", "45ms")
                    .build();
            }
            return Health.down()
                .withDetail("error", "Payment gateway unreachable")
                .build();
        } catch (Exception e) {
            return Health.down(e).build();
        }
    }
}
// GET /actuator/health → { "status": "UP", "components": { "paymentGateway": { ... } } }

@Service
public class OrderService {
    private final Counter orderCounter;
    private final Timer orderTimer;

    public OrderService(MeterRegistry registry) {
        this.orderCounter = Counter.builder("orders.placed")
            .description("Total orders placed")
            .tag("type", "online")
            .register(registry);
        this.orderTimer = Timer.builder("orders.processing.time")
            .description("Order processing duration")
            .register(registry);
    }

    public OrderDto placeOrder(OrderRequest request) {
        return orderTimer.record(() -> {
            OrderDto order = processOrder(request);
            orderCounter.increment();
            return order;
        });
    }
}

@Component
public class RequestIdFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain chain) throws ServletException, IOException {
        String requestId = Optional.ofNullable(request.getHeader("X-Request-Id"))
            .orElse(UUID.randomUUID().toString());

        MDC.put("requestId", requestId);
        response.setHeader("X-Request-Id", requestId);

        try {
            chain.doFilter(request, response);
        } finally {
            MDC.clear(); // prevent memory leaks
        }
    }
}
// Every log line now includes: {"requestId": "abc-123", "message": "Order placed", ...}