PaperclipOrg
Claude Agent Skill · by Affaan M

Springboot Patterns

This covers the bread and butter patterns you'll use building Spring Boot APIs: proper controller-service-repository layering, JPA repositories with custom quer

Install
Terminal · npx
$npx skills add https://github.com/affaan-m/everything-claude-code --skill springboot-patterns
Works with Paperclip

How Springboot Patterns fits into a Paperclip company.

Springboot Patterns drops into any Paperclip agent that handles this kind of work. Assign it to a specialist inside a pre-configured PaperclipOrg company and the skill becomes available on every heartbeat — no prompt engineering, no tool wiring.

S
SaaS FactoryPaired

Pre-configured AI company — 18 agents, 18 skills, one-time purchase.

$27$59
Explore pack
Source file
SKILL.md314 lines
Expand
---name: springboot-patternsdescription: Spring Boot architecture patterns, REST API design, layered services, data access, caching, async processing, and logging. Use for Java Spring Boot backend work.origin: ECC--- # Spring Boot Development Patterns Spring Boot architecture and API patterns for scalable, production-grade services. ## When to Activate - Building REST APIs with Spring MVC or WebFlux- Structuring controller → service → repository layers- Configuring Spring Data JPA, caching, or async processing- Adding validation, exception handling, or pagination- Setting up profiles for dev/staging/production environments- Implementing event-driven patterns with Spring Events or Kafka ## REST API Structure ```java@RestController@RequestMapping("/api/markets")@Validatedclass MarketController {  private final MarketService marketService;   MarketController(MarketService marketService) {    this.marketService = marketService;  }   @GetMapping  ResponseEntity<Page<MarketResponse>> list(      @RequestParam(defaultValue = "0") int page,      @RequestParam(defaultValue = "20") int size) {    Page<Market> markets = marketService.list(PageRequest.of(page, size));    return ResponseEntity.ok(markets.map(MarketResponse::from));  }   @PostMapping  ResponseEntity<MarketResponse> create(@Valid @RequestBody CreateMarketRequest request) {    Market market = marketService.create(request);    return ResponseEntity.status(HttpStatus.CREATED).body(MarketResponse.from(market));  }}``` ## Repository Pattern (Spring Data JPA) ```javapublic interface MarketRepository extends JpaRepository<MarketEntity, Long> {  @Query("select m from MarketEntity m where m.status = :status order by m.volume desc")  List<MarketEntity> findActive(@Param("status") MarketStatus status, Pageable pageable);}``` ## Service Layer with Transactions ```java@Servicepublic class MarketService {  private final MarketRepository repo;   public MarketService(MarketRepository repo) {    this.repo = repo;  }   @Transactional  public Market create(CreateMarketRequest request) {    MarketEntity entity = MarketEntity.from(request);    MarketEntity saved = repo.save(entity);    return Market.from(saved);  }}``` ## DTOs and Validation ```javapublic record CreateMarketRequest(    @NotBlank @Size(max = 200) String name,    @NotBlank @Size(max = 2000) String description,    @NotNull @FutureOrPresent Instant endDate,    @NotEmpty List<@NotBlank String> categories) {} public record MarketResponse(Long id, String name, MarketStatus status) {  static MarketResponse from(Market market) {    return new MarketResponse(market.id(), market.name(), market.status());  }}``` ## Exception Handling ```java@ControllerAdviceclass GlobalExceptionHandler {  @ExceptionHandler(MethodArgumentNotValidException.class)  ResponseEntity<ApiError> handleValidation(MethodArgumentNotValidException ex) {    String message = ex.getBindingResult().getFieldErrors().stream()        .map(e -> e.getField() + ": " + e.getDefaultMessage())        .collect(Collectors.joining(", "));    return ResponseEntity.badRequest().body(ApiError.validation(message));  }   @ExceptionHandler(AccessDeniedException.class)  ResponseEntity<ApiError> handleAccessDenied() {    return ResponseEntity.status(HttpStatus.FORBIDDEN).body(ApiError.of("Forbidden"));  }   @ExceptionHandler(Exception.class)  ResponseEntity<ApiError> handleGeneric(Exception ex) {    // Log unexpected errors with stack traces    return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)        .body(ApiError.of("Internal server error"));  }}``` ## Caching Requires `@EnableCaching` on a configuration class. ```java@Servicepublic class MarketCacheService {  private final MarketRepository repo;   public MarketCacheService(MarketRepository repo) {    this.repo = repo;  }   @Cacheable(value = "market", key = "#id")  public Market getById(Long id) {    return repo.findById(id)        .map(Market::from)        .orElseThrow(() -> new EntityNotFoundException("Market not found"));  }   @CacheEvict(value = "market", key = "#id")  public void evict(Long id) {}}``` ## Async Processing Requires `@EnableAsync` on a configuration class. ```java@Servicepublic class NotificationService {  @Async  public CompletableFuture<Void> sendAsync(Notification notification) {    // send email/SMS    return CompletableFuture.completedFuture(null);  }}``` ## Logging (SLF4J) ```java@Servicepublic class ReportService {  private static final Logger log = LoggerFactory.getLogger(ReportService.class);   public Report generate(Long marketId) {    log.info("generate_report marketId={}", marketId);    try {      // logic    } catch (Exception ex) {      log.error("generate_report_failed marketId={}", marketId, ex);      throw ex;    }    return new Report();  }}``` ## Middleware / Filters ```java@Componentpublic class RequestLoggingFilter extends OncePerRequestFilter {  private static final Logger log = LoggerFactory.getLogger(RequestLoggingFilter.class);   @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain filterChain) throws ServletException, IOException {    long start = System.currentTimeMillis();    try {      filterChain.doFilter(request, response);    } finally {      long duration = System.currentTimeMillis() - start;      log.info("req method={} uri={} status={} durationMs={}",          request.getMethod(), request.getRequestURI(), response.getStatus(), duration);    }  }}``` ## Pagination and Sorting ```javaPageRequest page = PageRequest.of(pageNumber, pageSize, Sort.by("createdAt").descending());Page<Market> results = marketService.list(page);``` ## Error-Resilient External Calls ```javapublic <T> T withRetry(Supplier<T> supplier, int maxRetries) {  int attempts = 0;  while (true) {    try {      return supplier.get();    } catch (Exception ex) {      attempts++;      if (attempts >= maxRetries) {        throw ex;      }      try {        Thread.sleep((long) Math.pow(2, attempts) * 100L);      } catch (InterruptedException ie) {        Thread.currentThread().interrupt();        throw ex;      }    }  }}``` ## Rate Limiting (Filter + Bucket4j) **Security Note**: The `X-Forwarded-For` header is untrusted by default because clients can spoof it.Only use forwarded headers when:1. Your app is behind a trusted reverse proxy (nginx, AWS ALB, etc.)2. You have registered `ForwardedHeaderFilter` as a bean3. You have configured `server.forward-headers-strategy=NATIVE` or `FRAMEWORK` in application properties4. Your proxy is configured to overwrite (not append to) the `X-Forwarded-For` header When `ForwardedHeaderFilter` is properly configured, `request.getRemoteAddr()` will automaticallyreturn the correct client IP from the forwarded headers. Without this configuration, use`request.getRemoteAddr()` directly—it returns the immediate connection IP, which is the onlytrustworthy value. ```java@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();   /*   * SECURITY: This filter uses request.getRemoteAddr() to identify clients for rate limiting.   *   * If your application is behind a reverse proxy (nginx, AWS ALB, etc.), you MUST configure   * Spring to handle forwarded headers properly for accurate client IP detection:   *   * 1. Set server.forward-headers-strategy=NATIVE (for cloud platforms) or FRAMEWORK in   *    application.properties/yaml   * 2. If using FRAMEWORK strategy, register ForwardedHeaderFilter:   *   *    @Bean   *    ForwardedHeaderFilter forwardedHeaderFilter() {   *        return new ForwardedHeaderFilter();   *    }   *   * 3. Ensure your proxy overwrites (not appends) the X-Forwarded-For header to prevent spoofing   * 4. Configure server.tomcat.remoteip.trusted-proxies or equivalent for your container   *   * Without this configuration, request.getRemoteAddr() returns the proxy IP, not the client IP.   * Do NOT read X-Forwarded-For directly—it is trivially spoofable without trusted proxy handling.   */  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain filterChain) throws ServletException, IOException {    // Use getRemoteAddr() which returns the correct client IP when ForwardedHeaderFilter    // is configured, or the direct connection IP otherwise. Never trust X-Forwarded-For    // headers directly without proper proxy configuration.    String clientIp = request.getRemoteAddr();     Bucket bucket = buckets.computeIfAbsent(clientIp,        k -> Bucket.builder()            .addLimit(Bandwidth.classic(100, Refill.greedy(100, Duration.ofMinutes(1))))            .build());     if (bucket.tryConsume(1)) {      filterChain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());    }  }}``` ## Background Jobs Use Spring’s `@Scheduled` or integrate with queues (e.g., Kafka, SQS, RabbitMQ). Keep handlers idempotent and observable. ## Observability - Structured logging (JSON) via Logback encoder- Metrics: Micrometer + Prometheus/OTel- Tracing: Micrometer Tracing with OpenTelemetry or Brave backend ## Production Defaults - Prefer constructor injection, avoid field injection- Enable `spring.mvc.problemdetails.enabled=true` for RFC 7807 errors (Spring Boot 3+)- Configure HikariCP pool sizes for workload, set timeouts- Use `@Transactional(readOnly = true)` for queries- Enforce null-safety via `@NonNull` and `Optional` where appropriate **Remember**: Keep controllers thin, services focused, repositories simple, and errors handled centrally. Optimize for maintainability and testability.