Backend Engineering Masterclass

@RestController
@RequestMapping("/api/incidents")
class IncidentController {
  private final IncidentService service;

  @GetMapping
  List<Incident> list() { return service.findAll(); }

  @PostMapping
  ResponseEntity<Incident> create(@Valid @RequestBody CreateIncident request) {
    return ResponseEntity.status(201).body(service.create(request));
  }

  @DeleteMapping("/{id}")
  ResponseEntity<Void> delete(@PathVariable long id) {
    service.delete(id);
    return ResponseEntity.noContent().build();
  }
}

@Service
class IncidentService {
  private final IncidentRepository repository;

  Incident create(CreateIncident input) {
    // Business policy belongs here, not in the browser.
    if (input.severity() == Severity.P0 && input.owner() == null)
      throw new ValidationException("P0 incidents require an owner");
    return repository.save(Incident.from(input));
  }
}

HTTP/1.1 201 Created
Location: /api/incidents/42
Content-Type: application/json

{
  "id": 42,
  "title": "Payment API latency",
  "severity": "P1",
  "status": "OPEN",
  "createdAt": "2026-08-28T10:15:00Z"
}

paths:
  /api/incidents:
    post:
      summary: Create an incident
      responses:
        '201': { description: Created }
        '400': { description: Invalid request }
        '401': { description: Authentication required }

http.authorizeHttpRequests(auth -> auth
    .requestMatchers(HttpMethod.GET, "/api/incidents/**").authenticated()
    .requestMatchers(HttpMethod.DELETE, "/api/incidents/**").hasRole("ADMIN")
    .anyRequest().denyAll());

// UNSAFE: input changes SQL meaning
String sql = "SELECT * FROM incidents WHERE title LIKE '%" + term + "%'";

// SAFE: the driver binds input as data
String sql = "SELECT * FROM incidents WHERE title LIKE ?";
jdbcTemplate.query(sql, mapper, "%" + term + "%");

FROM eclipse-temurin:21-jre
COPY target/incident-api.jar app.jar
USER 10001
ENTRYPOINT ["java", "-jar", "/app.jar"]

@Test
void p0RequiresOwner() {
  var request = new CreateIncident("Database down", Severity.P0, null);
  assertThrows(ValidationException.class, () -> service.create(request));
}