java-springboot

Organize packages by domain or bounded context, such as com.example.app.order, instead of by layer like controller or service. Each feature package contains its own controller, service, and repository so modules never import another module's internals.

Expose a record DTO at the controller boundary, never the JPA entity itself. Validate the request record with Bean Validation annotations, delegate to a @Transactional service, and persist through a Spring Data JPA repository.

Place @Transactional only on service-layer classes, never on controllers or repositories. Use @Transactional(readOnly = true) for read operations to optimize database access.

Always use constructor injection for required dependencies, declaring fields as private final. This makes dependencies explicit, enforces immutability, and simplifies unit testing with Mockito.

Centralize error handling in a single @RestControllerAdvice that returns ProblemDetail following RFC 7807. This keeps controllers free of try-catch blocks and produces consistent error responses across endpoints.

Never hardcode secrets in application.yml or source code. Use environment variables locally and Azure Key Vault via Managed Identity in Azure, binding configuration through @ConfigurationProperties for type-safe access.