spring-boot

Keep controllers thin with only HTTP mapping and validation, put business logic and @Transactional boundaries in services, and use Spring Data JPA repositories for persistence. Requests and responses should be record DTOs so JPA entities are never exposed at the API boundary.

Define domain exceptions that know nothing about HTTP, then map them in a single @RestControllerAdvice using ProblemDetail.forStatusAndDetail. Validation failures return 400 with a field-level errors extension, and 500 responses never leak stack traces or internal messages.

Yes, Spring Boot 3.x uses the Jakarta EE 9+ namespace, so imports must be jakarta.persistence.* and jakarta.validation.* instead of javax.*. The skill assumes Spring Boot 3.x with Java 21 as its baseline.

Register a BCryptPasswordEncoder bean from spring-security-crypto and call passwordEncoder.encode() in the service before persisting. Verify logins with matches() rather than decrypting, and never include the password or its hash in response DTOs.

Use @WebMvcTest with MockMvc for controller slices covering mapping, validation, and status codes, and @DataJpaTest for repository queries. Reserve @SpringBootTest with Testcontainers for end-to-end flows that need the real database dialect and constraints.

Follow your existing project's conventions first. The skill explicitly treats its templates as defaults for projects without established patterns, so it mimics existing layering, error formats, and naming rather than imposing new rules.