Request binding — @PathVariable, @RequestParam, @RequestBody, @Valid

@GetMapping("/orders/{id}")
public OrderDto get(@PathVariable Long id) { ... }

@GetMapping("/users/{userId}/orders/{orderId}")
public OrderDto get(@PathVariable Long userId, @PathVariable Long orderId) { ... }

@GetMapping("/orders/{order_id}")
public OrderDto get(@PathVariable("order_id") Long orderId) { ... }

@GetMapping("/orders/{id}/items/{itemId}")
public Object get(@PathVariable Map<String, String> vars) {
    String id = vars.get("id");
    String itemId = vars.get("itemId");
}

@GetMapping({"/orders", "/orders/{id}"})
public List<OrderDto> get(@PathVariable(required = false) Long id) {
    return id == null ? listAll() : List.of(findById(id));
}

@GetMapping("/orders")
public List<OrderDto> list(
    @RequestParam(defaultValue = "active") String status,
    @RequestParam(required = false) Long minTotal,
    @RequestParam(defaultValue = "0") int page,
    @RequestParam(defaultValue = "20") int size
) { ... }

@RequestParam(defaultValue = "0") int page         // missing → 0
@RequestParam(defaultValue = "true") boolean activeOnly
@RequestParam(defaultValue = "ASC") SortDirection direction   // enum

@RequestParam Long userId                          // required, missing → 400
@RequestParam(required = false) Long userId        // optional, null nếu missing
@RequestParam(defaultValue = "0") Long userId      // optional với default

@RequestParam List<String> tags                    // ?tags=java&tags=spring
@RequestParam Set<String> roles                    // ?roles=admin&roles=user

@RequestParam Map<String, String> allParams        // bind tat ca param

@GetMapping("/orders")
public Page<OrderDto> list(Pageable pageable) { ... }

@PostMapping("/orders")
public OrderDto create(@RequestBody OrderRequest req) { ... }

public record OrderRequest(
    String customer,
    BigDecimal total,
    List<OrderItem> items
) {}

POST /api/orders
Content-Type: application/json

{
  "customer": "Alice",
  "total": 99.99,
  "items": [{"sku": "ABC", "quantity": 2}]
}

public record OrderRequest(String customer, BigDecimal total) {}

public class OrderRequest {
    private String customer;
    private BigDecimal total;
    public String getCustomer() { return customer; }
    public void setCustomer(String customer) { this.customer = customer; }
    // ... lặp cho mọi field
}

public record OrderRequest(
    @NotBlank String customer,
    @NotNull @Positive BigDecimal total,
    @NotEmpty @Valid List<OrderItem> items
) {}

public record OrderItem(
    @NotBlank String sku,
    @Min(1) int quantity
) {}

@PostMapping("/orders")
public OrderDto create(@Valid @RequestBody OrderRequest req) { ... }

@PostMapping("/orders")
public OrderDto create(@RequestBody(required = false) OrderRequest req) {
    if (req == null) return defaultOrder();
}

@GetMapping("/orders/{id}")
public OrderDto get(
    @PathVariable Long id,
    @RequestHeader("Authorization") String authToken,
    @RequestHeader(value = "X-Request-Id", required = false) String requestId,
    @RequestHeader(defaultValue = "en") String acceptLanguage
) { ... }

@RequestHeader Map<String, String> headers        // bind tat ca header
@RequestHeader HttpHeaders headers                 // Spring's wrapper

@GetMapping("/dashboard")
public DashboardDto get(
    @CookieValue("JSESSIONID") String sessionId,
    @CookieValue(value = "theme", defaultValue = "light") String theme
) { ... }

@Component
public class AuthFilter extends OncePerRequestFilter {
    protected void doFilterInternal(HttpServletRequest req, ...) {
        Authentication auth = jwtService.validate(req.getHeader("Authorization"));
        req.setAttribute("currentUser", auth.getPrincipal());
        chain.doFilter(req, res);
    }
}

@GetMapping("/profile")
public UserDto profile(@RequestAttribute("currentUser") User user) { ... }

public interface HandlerMethodArgumentResolver {
    boolean supportsParameter(MethodParameter parameter);
    Object resolveArgument(MethodParameter parameter,
                            ModelAndViewContainer mavContainer,
                            NativeWebRequest webRequest,
                            WebDataBinderFactory binderFactory) throws Exception;
}

public class CurrentUserResolver implements HandlerMethodArgumentResolver {
    public boolean supportsParameter(MethodParameter param) {
        return param.hasParameterAnnotation(CurrentUser.class);
    }

    public Object resolveArgument(MethodParameter param, ...) {
        SecurityContext ctx = SecurityContextHolder.getContext();
        return ctx.getAuthentication().getPrincipal();
    }
}

@Configuration
public class WebConfig implements WebMvcConfigurer {
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
        resolvers.add(new CurrentUserResolver());
    }
}

// Use:
@GetMapping("/profile")
public UserDto profile(@CurrentUser User user) { ... }

@GetMapping("/orders")
public List<OrderDto> list(
    @RequestParam @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate from,
    @RequestParam @DateTimeFormat(pattern = "yyyy-MM-dd") LocalDate to
) { ... }

public enum OrderStatus { PENDING, ACTIVE, COMPLETED, CANCELLED }

@GetMapping("/orders")
public List<OrderDto> list(@RequestParam OrderStatus status) { ... }

@Component
public class OrderStatusConverter implements Converter<String, OrderStatus> {
    public OrderStatus convert(String source) {
        return OrderStatus.valueOf(source.toUpperCase());
    }
}

@GetMapping("/orders")
public Page<OrderDto> list(
    @RequestParam(required = false) OrderStatus status,
    @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate from,
    @RequestParam(required = false) @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate to,
    @RequestParam(defaultValue = "0") @Min(0) int page,
    @RequestParam(defaultValue = "20") @Min(1) @Max(100) int size,
    @RequestParam(defaultValue = "createdAt,desc") String sort
) { ... }

public record OrderFilter(
    OrderStatus status,
    LocalDate from,
    LocalDate to
) {}

@GetMapping("/orders")
public Page<OrderDto> list(@Valid OrderFilter filter, Pageable pageable) { ... }

@PostMapping("/orders/bulk")
public List<OrderDto> bulkCreate(@RequestBody @Valid List<OrderRequest> requests) {
    return orderService.createAll(requests);
}

@PutMapping("/orders/{id}")
public OrderDto update(@PathVariable Long id, @RequestBody @Valid OrderRequest req) {
    // PUT replace toan bo - require all fields
    return orderService.replace(id, req);
}

@PatchMapping("/orders/{id}")
public OrderDto patch(@PathVariable Long id, @RequestBody Map<String, Object> updates) {
    // PATCH partial - chi field present
    return orderService.patch(id, updates);
}

server:
  max-http-request-header-size: 8KB
  tomcat:
    max-swallow-size: 2MB                 # Spring read fail-fast neu vuot
    max-http-form-post-size: 10MB

spring:
  servlet:
    multipart:
      max-file-size: 10MB
      max-request-size: 50MB

@Bean
public ObjectMapper objectMapper() {
    return JsonMapper.builder()
        .configure(StreamReadConstraints.builder()
            .maxNestingDepth(20)
            .maxNumberLength(1000)
            .maxStringLength(20_000_000)        // 20MB max string
            .build())
        .build();
}

public record UserUpdateRequest(
    String name,
    String email,
    boolean isAdmin            // CLIENT khong nen set!
) {}

public record UserPublicUpdate(String name, String email) {}
public record UserAdminUpdate(String name, String email, boolean isAdmin) {}

@PutMapping("/users/{id}")
@PreAuthorize("hasRole('USER')")
public UserDto update(@RequestBody UserPublicUpdate req) { ... }

@PutMapping("/admin/users/{id}")
@PreAuthorize("hasRole('ADMIN')")
public UserDto adminUpdate(@RequestBody UserAdminUpdate req) { ... }

@ExceptionHandler(MethodArgumentTypeMismatchException.class)
public ProblemDetail handleTypeMismatch(MethodArgumentTypeMismatchException ex) {
    ProblemDetail pd = ProblemDetail.forStatus(400);
    pd.setDetail("Invalid value for parameter " + ex.getName() + ": " + ex.getValue());
    pd.setProperty("parameter", ex.getName());
    pd.setProperty("requiredType", ex.getRequiredType().getSimpleName());
    return pd;
}

@RequestParam(defaultValue = "abc") int page    // 400 runtime, "abc" → int fail

@GetMapping("/orders/{id}")
public OrderDto get(Long id) { ... }    // QUEN @PathVariable → null

@GetMapping("/orders/{id}")
public OrderDto get(@PathVariable Long id, @RequestParam(required = false) Long id2) { ... }

@GetMapping("/search")
public List<OrderDto> search(@RequestBody SearchRequest req) { ... }

@RequestParam LocalDate from    // Boot 3 ok với ISO, nhưng nếu format khác sẽ fail

public OrderDto create(@RequestBody OrderRequest req) { ... }    // KHONG validate