Response Nâng Cao: Streaming, Advice, HATEOAS và Security

// Anti-pattern: Load toan bo 1 trieu ban ghi gay OutOfMemoryError
@GetMapping("/orders/export")
public ResponseEntity<List<OrderDto>> exportAll() {
    List<OrderDto> all = orderService.findAll(); // Gay qua tai bo nho heap
    return ResponseEntity.ok(all);
}

@GetMapping("/orders/export")
public ResponseEntity<StreamingResponseBody> exportOrdersCsv() {
    StreamingResponseBody stream = outputStream -> {
        try (PrintWriter writer = new PrintWriter(outputStream);
             Stream<Order> orders = orderService.streamAll()) {

            writer.println("id,customer,total,createdAt");
            orders.forEach(order -> {
                writer.println(order.getId() + "," + order.getCustomer() + "," + order.getTotal() + "," + order.getCreatedAt());
            });
            writer.flush();
        }
    };

    return ResponseEntity.ok()
        .contentType(MediaType.parseMediaType("text/csv"))
        .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"orders.csv\"")
        .body(stream);
}

@Repository
public interface OrderRepository extends JpaRepository<Order, Long> {
    @QueryHints(@QueryHint(name = AvailableSettings.HINT_FETCH_SIZE, value = "500"))
    Stream<Order> streamAll();
}

@Service
public class OrderService {
    @Transactional(readOnly = true) // Bat buoc de giu mo DB cursor
    public Stream<Order> streamAll() {
        return orderRepository.streamAll();
    }
}

@GetMapping(value = "/orders/stream", produces = MediaType.TEXT_EVENT_STREAM_VALUE)
public SseEmitter streamOrderUpdates() {
    SseEmitter emitter = new SseEmitter(60_000L); // Timeout 60s

    orderEventBus.subscribe(event -> {
        try {
            emitter.send(SseEmitter.event()
                .id(String.valueOf(event.getId()))
                .name("order-status")
                .data(event, MediaType.APPLICATION_JSON));
        } catch (IOException ex) {
            emitter.completeWithError(ex);
        }
    });

    emitter.onTimeout(emitter::complete);
    emitter.onError(ex -> emitter.complete());
    return emitter;
}

{
  "success": true,
  "data": { "id": 1024, "status": "COMPLETED" },
  "requestId": "req-9872",
  "timestamp": "2026-04-15T10:00:00Z"
}

public record ApiResponse<T>(boolean success, T data, String requestId, Instant timestamp) {
    public static <T> ApiResponse<T> success(T data) {
        return new ApiResponse<>(true, data, MDC.get("requestId"), Instant.now());
    }
}

@RestControllerAdvice
public class ApiResponseEnvelopeAdvice implements ResponseBodyAdvice<Object> {

    @Override
    public boolean supports(MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
        // Chi ap dung cho JSON converter
        if (!converterType.isAssignableFrom(MappingJackson2HttpMessageConverter.class)) {
            return false;
        }
        // Bo qua neu controller tra ve String hoac da duoc wrap
        Class<?> paramType = returnType.getParameterType();
        return !paramType.isAssignableFrom(String.class)
            && !paramType.isAssignableFrom(ApiResponse.class)
            && !paramType.isAssignableFrom(Resource.class)
            && !paramType.isAssignableFrom(ProblemDetail.class);
    }

    @Override
    public Object beforeBodyWrite(
        Object body,
        MethodParameter returnType,
        MediaType selectedContentType,
        Class<? extends HttpMessageConverter<?>> selectedConverterType,
        ServerHttpRequest request,
        ServerHttpResponse response
    ) {
        return ApiResponse.success(body);
    }
}

@RestController
@RequestMapping("/api/orders")
public class OrderController {

    @GetMapping("/{id}")
    public EntityModel<OrderDto> getOrder(@PathVariable Long id) {
        OrderDto order = orderService.findById(id);

        return EntityModel.of(order,
            linkTo(methodOn(OrderController.class).getOrder(id)).withSelfRel(),
            linkTo(methodOn(OrderController.class).cancelOrder(id)).withRel("cancel"),
            linkTo(methodOn(OrderController.class).listItems(id)).withRel("items")
        );
    }

    @DeleteMapping("/{id}/cancel")
    public ResponseEntity<Void> cancelOrder(@PathVariable Long id) {
        orderService.cancel(id);
        return ResponseEntity.noContent().build();
    }
}

{
  "id": 1024,
  "status": "PENDING",
  "_links": {
    "self": { "href": "http://localhost:8080/api/orders/1024" },
    "cancel": { "href": "http://localhost:8080/api/orders/1024/cancel" },
    "items": { "href": "http://localhost:8080/api/orders/1024/items" }
  }
}

@GetMapping("/orders/{id}")
public ResponseEntity<OrderDto> getOrder(
    @PathVariable Long id,
    @RequestHeader(value = "If-None-Match", required = false) String ifNoneMatch
) {
    OrderDto order = orderService.findById(id);
    String currentEtag = "\"" + order.getVersion() + "\""; // Su dung version optimistic locking

    if (currentEtag.equals(ifNoneMatch)) {
        return ResponseEntity.status(HttpStatus.NOT_MODIFIED).eTag(currentEtag).build();
    }

    return ResponseEntity.ok()
        .eTag(currentEtag)
        .cacheControl(CacheControl.maxAge(Duration.ofMinutes(10)).cachePublic())
        .body(order);
}

server:
  compression:
    enabled: true
    mime-types: application/json,text/html,text/csv,application/xml
    min-response-size: 1024 # Chi nen khi body tu 1KB tro len

@Configuration
public class SecurityWebConfig implements WebMvcConfigurer {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new HandlerInterceptor() {
            @Override
            public boolean preHandle(HttpServletRequest req, HttpServletResponse res, Object handler) {
                res.setHeader("X-Content-Type-Options", "nosniff");
                res.setHeader("X-Frame-Options", "DENY");
                res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
                res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
                return true;
            }
        });
    }
}