OrderHub Day 4: never trust the client. Today the backend gets proper Bean Validation — bad requests are rejected at the edge with a clear 400, long before they reach the business logic. And it's all declarative.
✅ Try the validating form (see the 400 body): https://dev48v.infy.uk/orderhub/day4-validation.html
Three DTOs, three jobs
A common beginner mistake is using one class everywhere. OrderHub keeps them separate:
-
Request DTO (
CreateOrderRequest) — what the client sends, and where validation lives. -
Domain/Entity (
Order) — the internal model. -
Response DTO (
OrderResponse) — what the API returns, so internal fields never leak.
Validation is just annotations
public record CreateOrderRequest(
@NotBlank @Size(max = 120) @CleanText String customer,
@NotBlank @Size(max = 200) @CleanText String item,
@Min(1) @Max(1000) int quantity) {}
Add @Valid @RequestBody on the controller and Spring checks every rule before your method runs. Break one and it throws MethodArgumentNotValidException.
A custom constraint + clean errors
@CleanText is a custom ConstraintValidator (rejects blank-after-trim + a small blocklist) — you can write your own rules, not just the built-ins. A @RestControllerAdvice turns validation failures into a tidy 400 with a field→message map. (Day 5 upgrades this to full RFC-7807 ProblemDetail.)
🔨 Full walkthrough (constraints → @valid → custom validator → 400 handler) on the page: https://dev48v.infy.uk/orderhub/day4-validation.html
OrderHub — a production-grade Spring Boot backend, one feature a day.
🌐 https://dev48v.infy.uk · Code: https://github.com/dev48v/order-hub-from-zero
