Springboot Patterns

@RestController@RequestMapping("/api/markets")@Validatedclass MarketController {  private final MarketService marketService;
  MarketController(MarketService marketService) {    this.marketService = marketService;  }
  @GetMapping  ResponseEntity<Page<MarketResponse>> list(      @RequestParam(defaultValue = "0") int page,      @RequestParam(defaultValue = "20") int size) {    Page<Market> markets = marketService.list(PageRequest.of(page, size));    return ResponseEntity.ok(markets.map(MarketResponse::from));  }
  @PostMapping  ResponseEntity<MarketResponse> create(@Valid @RequestBody CreateMarketRequest request) {    Market market = marketService.create(request);    return ResponseEntity.status(HttpStatus.CREATED).body(MarketResponse::from(market));  }}

public interface MarketRepository extends JpaRepository<MarketEntity, Long> {  @Query("select m from MarketEntity m where m.status = :status order by m.volume desc")  List<MarketEntity> findActive(@Param("status") MarketStatus status, Pageable pageable);}

@Servicepublic class MarketService {  private final MarketRepository repo;
  public MarketService(MarketRepository repo) {    this.repo = repo;  }
  @Transactional  public Market create(CreateMarketRequest request) {    MarketEntity entity = MarketEntity.from(request);    MarketEntity saved = repo.save(entity);    return Market.from(saved);  }}

public record CreateMarketRequest(    @NotBlank @Size(max = 200) String name,    @NotBlank @Size(max = 2000) String description,    @NotNull @FutureOrPresent Instant endDate,    @NotEmpty List<@NotBlank String> categories) {}
public record MarketResponse(Long id, String name, MarketStatus status) {  static MarketResponse from(Market market) {    return new MarketResponse(market.id(), market.name(), market.status());  }}

@ControllerAdviceclass GlobalExceptionHandler {  @ExceptionHandler(MethodArgumentNotValidException.class)  ResponseEntity<ApiError> handleValidation(MethodArgumentNotValidException ex) {    String message = ex.getBindingResult().getFieldErrors().stream()        .map(e -> e.getField() + ": " + e.getDefaultMessage())        .collect(Collectors.joining(", "));    return ResponseEntity.badRequest().body(ApiError.validation(message));  }
  @ExceptionHandler(AccessDeniedException.class)  ResponseEntity<ApiError> handleAccessDenied() {    return ResponseEntity.status(HttpStatus.FORBIDDEN).body(ApiError.of("Forbidden"));  }
  @ExceptionHandler(Exception.class)  ResponseEntity<ApiError> handleGeneric(Exception ex) {    // スタックトレース付きで予期しないエラーをログ    return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)        .body(ApiError.of("Internal server error"));  }}

@Servicepublic class MarketCacheService {  private final MarketRepository repo;
  public MarketCacheService(MarketRepository repo) {    this.repo = repo;  }
  @Cacheable(value = "market", key = "#id")  public Market getById(Long id) {    return repo.findById(id)        .map(Market::from)        .orElseThrow(() -> new EntityNotFoundException("Market not found"));  }
  @CacheEvict(value = "market", key = "#id")  public void evict(Long id) {}}

@Servicepublic class NotificationService {  @Async  public CompletableFuture<Void> sendAsync(Notification notification) {    // メール/SMS送信    return CompletableFuture.completedFuture(null);  }}

@Servicepublic class ReportService {  private static final Logger log = LoggerFactory.getLogger(ReportService.class);
  public Report generate(Long marketId) {    log.info("generate_report marketId={}", marketId);    try {      // ロジック    } catch (Exception ex) {      log.error("generate_report_failed marketId={}", marketId, ex);      throw ex;    }    return new Report();  }}

@Componentpublic class RequestLoggingFilter extends OncePerRequestFilter {  private static final Logger log = LoggerFactory.getLogger(RequestLoggingFilter.class);
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain filterChain) throws ServletException, IOException {    long start = System.currentTimeMillis();    try {      filterChain.doFilter(request, response);    } finally {      long duration = System.currentTimeMillis() - start;      log.info("req method={} uri={} status={} durationMs={}",          request.getMethod(), request.getRequestURI(), response.getStatus(), duration);    }  }}

PageRequest page = PageRequest.of(pageNumber, pageSize, Sort.by("createdAt").descending());Page<Market> results = marketService.list(page);

public <T> T withRetry(Supplier<T> supplier, int maxRetries) {  int attempts = 0;  while (true) {    try {      return supplier.get();    } catch (Exception ex) {      attempts++;      if (attempts >= maxRetries) {        throw ex;      }      try {        Thread.sleep((long) Math.pow(2, attempts) * 100L);      } catch (InterruptedException ie) {        Thread.currentThread().interrupt();        throw ex;      }    }  }}

@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  /*   * セキュリティ: このフィルターはレート制限のためにクライアントを識別するために   * request.getRemoteAddr()を使用します。   *   * アプリケーションがリバースプロキシ（nginx、AWS ALBなど）の背後にある場合、   * 正確なクライアントIP検出のために転送ヘッダーを適切に処理するようSpringを   * 設定する必要があります:   *   * 1. application.properties/yamlで server.forward-headers-strategy=NATIVE   *    （クラウドプラットフォーム用）またはFRAMEWORKを設定   * 2. FRAMEWORK戦略を使用する場合、ForwardedHeaderFilterを登録:   *   *    @Bean   *    ForwardedHeaderFilter forwardedHeaderFilter() {   *        return new ForwardedHeaderFilter();   *    }   *   * 3. プロキシが偽装を防ぐためにX-Forwarded-Forヘッダーを上書き（追加ではなく）   *    することを確認   * 4. コンテナに応じてserver.tomcat.remoteip.trusted-proxiesまたは同等を設定   *   * この構成なしでは、request.getRemoteAddr()はクライアントIPではなくプロキシIPを返します。   * X-Forwarded-Forを直接読み取らないでください。信頼できるプロキシ処理なしでは簡単に偽装できます。   */  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain filterChain) throws ServletException, IOException {    // ForwardedHeaderFilterが構成されている場合は正しいクライアントIPを返す    // getRemoteAddr()を使用。そうでなければ直接接続IPを返す。    // X-Forwarded-Forヘッダーを適切なプロキシ構成なしで直接信頼しない。    String clientIp = request.getRemoteAddr();
    Bucket bucket = buckets.computeIfAbsent(clientIp,        k -> Bucket.builder()            .addLimit(Bandwidth.classic(100, Refill.greedy(100, Duration.ofMinutes(1))))            .build());
    if (bucket.tryConsume(1)) {      filterChain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());    }  }}