instruction.md

Project Instructions

Architecture

• Layered: Controller → Service → Repository
• DTOs are Java records. Never expose JPA entities in API responses.
• Constructor injection only. No field injection.

Code Style

• No catch-all catch (Exception e). Handle specific exceptions.
• Validate inputs at the controller layer using Jakarta Validation.
• Use Optional return types from repositories. No returning null.

Testing

• Every non-trivial service method gets a unit test.
• Use @WebMvcTest for controller tests, not @SpringBootTest.
• Test names follow: should_expectedBehavior_when_condition

Security

• No secrets, credentials, or customer data in prompts or instruction files.
• Sanitize all model output before rendering or storing.
• Treat model-generated SQL or config as untrusted input.