🤿 Diving Deeper Into Spring Boot (2)

curl https://start.spring.io/starter.zip \
  -d dependencies=web,data-jpa \
  -d javaVersion=17 \
  -d type=maven-project \
  -d bootVersion=3.4.4 \
  -d groupId=com.aziz \
  -d artifactId=hello \
  -output o.zip && unzip o.zip -d . && rm o.zip

@SpringBootConfiguration
@EnableAutoConfiguration
@ComponentScan(basePackages = "com.example.myapp") // Optional: scans for components in specified package
public class MyApplication {}

// ------- easier ------- //
@SpringBootApplication
public class MyApplication {}

// java -jar app.jar --import
@Component
public class MyCommandLineRunner implements CommandLineRunner {
    @Override
    public void run(String... args) {
        if (args.length > 0 && args[0].equals("--import")) {
            System.out.println("Importing data from CSV...");
        }
    }
}

// java -jar app.jar --import=data.csv
@Component
public class MyApplicationRunner implements ApplicationRunner {
    @Override
    public void run(ApplicationArguments args) {
        if (args.containsOption("import")) {
            String path = args.getOptionValues("import").get(0);
            System.out.println("Importing from: " + path);
        }
    }
}

<!------------ SPRING BOOT PARENT POM ------------>
<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>5.6.7.Final</version>
        </dependency>
    </dependencies>
</dependencyManagement>

<!------------ PROJECT POM ------------>
<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
</parent>
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId> <!-- No version needed -->
    </dependency>
</dependencies>

@Configuration
@ConditionalOnClass(DataSource.class) // Only applies if DataSource is on the classpath
@EnableConfigurationProperties(DataSourceProperties.class) // Binds DataSource properties
public class DataSourceAutoConfiguration {
    @Bean
    @ConditionalOnMissingBean // Only creates this bean if it does not exist
    public DataSource dataSource(DataSourceProperties properties) {
        return properties.initializeDataSourceBuilder().build();
    }
}

@Profile("development")
@Bean
public DataSource dataSource() {}

logging.level.com.example: DEBUG

@AutoConfiguration
@ConditionalOnClass(SecurityFilterChain.class)
public class SecurityAutoConfiguration {
    @ConditionalOnMissingBean(SecurityFilterChain.class)
    @Bean
    SecurityFilterChain defaultSecurityFilterChain(/* ... */) { /* ... */ }
}

@Bean
SecurityFilterChain defaultSecurityFilterChain(/* ... */) { /* ... */ }

@Configuration
public class SecurityConfig {
    @Bean
    SecurityFilterChain securityFilterChain(/* ... */) { /* ... */ }
}

@SpringBootApplication(exclude = {SecurityAutoConfiguration.class})
public class MyApplication {}
// OR
spring.autoconfigure.exclude: org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration

<!-- override the Spring Boot version -->
<properties>
    <spring-boot.version>2.6.4</spring-boot.version>
</properties>

<!-- override the used Servlet container -->
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <exclusions>
            <exclusion>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-tomcat</artifactId> <!-- Exclude Tomcat -->
            </exclusion>
        </exclusions>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-jetty</artifactId> <!-- Replaces Tomcat -->
    </dependency>
</dependencies>

/**
mail.host=10.10.10.10
mail.port=465
**/

@Data
@Component
@ConfigurationProperties(prefix = "mail")
public class MailConfig {
    private String host;
    private int port;
}

/* 
 * [Action][Limit][Distinct]By[Property][Condition][LogicalOperator]...[OrderBy...]
 * 
 * Segments:
 * ─────────
 * [Action]           → find == read == get == query == search == stream // Required 
 * [Limit]            → First == Top | Top3 == First3                    // Optional
 * [Distinct]         → Distinct                                         // Optional
 * By                 → (literal)
 * [Property]         → Entity field names (can be nested)
 * [Condition]        → Is | Not | GreaterThan | LessThanEqual | Between | Like | Containing | ... 
 * [LogicalOperator]  → And | Or                                         // Optional chaining
 * [OrderBy...]       → OrderByFieldAsc | OrderByFieldDesc               // Optional sorting
 */
public interface UserRepository extends JpaRepository<User, Long> {

    // ────── [Action] ──────
    List<User> findByUsername(String username);
    List<User> readByEmail(String email);
    List<User> getByPhoneNumber(String phone);

    // ────── [Limit] ──────
    User findTopByOrderByCreatedAtDesc();                     // LIMIT 1 (latest)
    List<User> findTop3ByStatus(String status);               // Top 3
    List<User> findFirst5ByRole(String role);                 // First 5

    // ────── [Distinct] ──────
    List<User> findDistinctByLastName(String lastName);       // SELECT DISTINCT
    List<User> findTop5DistinctByAgeGreaterThan(int age);     // DISTINCT + LIMIT

    // ────── [Boolean Field] ──────
    List<User> findByIsActiveTrue();                          // isActive == true
    List<User> findByIsActiveFalse();                         // isActive == false
    List<User> findByEnabledIs(Boolean enabled);              // Boolean = ?
    List<User> findByEnabled(Boolean enabled);                // same as above

    // ────── [Null Checks] ──────
    List<User> findByEmailIsNull();
    List<User> findByEmailIsNotNull();

    // ────── [Equality / Is] ──────
    List<User> findByUsernameIs(String username);             // Same as findByUsername

    // ────── [Not Equal / Negation] ──────
    List<User> findByStatusNot(String status);                // status != ?

    // ────── [Comparison: Numbers / Dates] ──────
    List<User> findByAgeGreaterThan(int age);                 // age > ?
    List<User> findByAgeGreaterThanEqual(int age);            // age >= ?
    List<User> findByCreatedAtAfter(LocalDateTime time);      // created_at > ?
    List<User> findByCreatedAtBefore(LocalDateTime time);     // created_at < ?
    List<User> findByAgeBetween(int min, int max);            // age BETWEEN

    // ────── [Text / Pattern Matching] ──────
    List<User> findByEmailLike(String pattern);               // LIKE '%abc%'
    List<User> findByUsernameContaining(String part);         // LIKE '%part%'
    List<User> findByUsernameNotContaining(String part);      // NOT LIKE
    List<User> findByFirstNameStartingWith(String prefix);    // LIKE 'prefix%'
    List<User> findByLastNameEndingWith(String suffix);       // LIKE '%suffix'
    List<User> findByUsernameIgnoreCase(String username);     // Case-insensitive

    // ────── [IN / NOT IN] ──────
    List<User> findByRoleIn(List<String> roles);              // role IN (...)
    List<User> findByIdNotIn(List<Long> ids);                 // id NOT IN (...)

    // ────── [Logical Operators] ──────
    List<User> findByUsernameAndEmail(String u, String e);
    List<User> findByStatusOrRole(String status, String role);

    // ────── [Nested / Embedded Properties] ──────
    List<User> findByCompany_Name(String name);               // join on entity
    List<User> findByAddress_City(String city);               // embedded/nested

    // ────── [Collection Fields] ──────
    List<User> findByTagsContaining(String tag);              // collection contains

    // ────── [Ordering / Sorting] ──────
    List<User> findByCountryOrderByAgeAsc(String country);
    List<User> findByDepartmentOrderBySalaryDesc(String dept);
    List<User> findTop3ByStatusOrderByCreatedAtDesc(String status);
    User findFirstByOrderByUsernameAsc();                     // Top 1 alphabetically
}

public interface OrderRepository extends JpaRepository<Order, Long> {
    
    // Count orders in date range
    long countByOrderDateBetween(LocalDate start, LocalDate end);
    
    // Delete unpaid expired orders
    long deleteByStatusAndPaymentDateIsNull(String status);
    
    // Check if high-value order exists
    boolean existsByTotalAmountGreaterThan(BigDecimal amount);
}

// **Native SQL**
@Repository
public interface UserRepository extends CrudRepository<User, Long> {
    @Query(value = "SELECT * FROM users WHERE last_name = ?1", nativeQuery = true)
    List<User> findByLastNameNative(String lastName);

    @Query(value = "SELECT COUNT(*) FROM users", nativeQuery = true)
    Long countUsers();

    @Query(value = "SELECT * FROM users WHERE age BETWEEN ?1 AND ?2", nativeQuery = true)
    List<User> findUsersBetweenAges(int startAge, int endAge);
}

// **JPQL Queries**: offers a level of abstraction over native SQL.
@Repository
public interface UserRepository extends CrudRepository<User, Long> {
    @Query("SELECT u FROM User u WHERE u.lastName = :lastName")
    List<User> findByLastName(@Param("lastName") String lastName);

      @Query("SELECT u FROM User u JOIN u.orders o WHERE u.lastName = :lastName")
    List<User> findUsersWithOrdersByLastName(@Param("lastName") String lastName);

      @Query("SELECT u, SUM(o.amount) AS totalAmount " +
           "FROM User u JOIN u.orders o " +
           "GROUP BY u.id " +
           "HAVING totalAmount > 1000")
    List<Object[]> findUsersWithTotalOrderAmountAbove1000();
}

@Entity  // Marks this class as a JPA entity (will be mapped to a database table)
public class User {

    @Embedded  // An embeddable component (fields will be included directly in the User's table rather than a separate table)
    @AttributeOverrides({
        @AttributeOverride(name = "street", column = @Column(name = "user_street")),
        @AttributeOverride(name = "zipCode", column = @Column(name = "postal_code"))
    })
    private Address address;  // Embedded Address object with customized column mappings
}```
### <a id="criteria-queries"></a> 6.4. Criteria Queries:
- A `CriteriaBuilder` is used to build `CriteriaQuery` objects which is used to perform a query.
- The `Predicate` class is part of the Criteria API and is used to construct where clauses.
```java
public class UserCriteriaQuery {
    public List<User> findUsers(String name, Integer age) {
        CriteriaBuilder criteriaBuilder = entityManager.getCriteriaBuilder();

        CriteriaQuery<User> criteriaQuery = criteriaBuilder.createQuery(User.class);

        // DEFINE THE ROOT ENTITY (FROM CLAUSE)
        Root<User> userRoot = criteriaQuery.from(User.class);

        // INITIALIZE PREDICATE WITH CONJUNCTION (WHERE 1=1 EQUIVALENT). SERVES AS A BASE TO ADD MORE CONDITIONS
        Predicate predicate = criteriaBuilder.conjunction();

        // ADDING CONDITIONS
        predicate = criteriaBuilder.and(
            predicate,
            criteriaBuilder.equal(userRoot.get("name"), name)
        );
        predicate = criteriaBuilder.and(
            predicate,
            criteriaBuilder.greaterThan(userRoot.get("age"), age)
        );

        // APPLY THE CONSTRUCTED PREDICATE AS WHERE CLAUSE
        criteriaQuery.where(predicate);
        
        // ADDING MORE CLAUSES
        criteriaQuery.orderBy(criteriaBuilder.asc(userRoot.get("name"))); // ORDER BY
        criteriaQuery.groupBy(userRoot.get("email"));  // GROUP BY

        return entityManager.createQuery(criteriaQuery).getResultList();
    }
}

class UserSpecification {
    public static Specification<User> hasName(String name) {
        return (root, query, criteriaBuilder) ->
            name == null ? null : criteriaBuilder.equal(root.get("name"), name);
    }

    public static Specification<User> hasEmail(String email) {
        return (root, query, criteriaBuilder) ->
            email == null ? null : criteriaBuilder.equal(root.get("email"), email);
    }
}

interface UserRepository extends CrudRepository<User, Long>, JpaSpecificationExecutor<User> {}

@Service
class UserService {
    @Autowired
    private UserRepository userRepository;

    public List<User> findUsers(String name, String email, Integer age) {
        return userRepository.findAll(
            Specification
              .where(UserSpecification.hasName(name))
              .and(UserSpecification.hasEmail(email))
        );
    }
}

spring.sql.init.schema-locations=classpath:/db/schema.sql
spring.sql.init.data-locations=classpath:/db/data.sql

spring.jpa.hibernate.ddl-auto=create  # or update, validate, none, etc.

spring.flyway.baseline-on-migrate=true  # Creates baseline if no schema history exists
spring.flyway.baseline-version=1       # Starts migration tracking from version 1

spring.jpa.hibernate.ddl-auto=validate

mvn flyway:migrate -Dflyway.dryRunOutput=/tmp/planned_migrations.sql

-- src/main/resources/db/migration/V1__Create_customers.sql
CREATE TABLE customers (
    id SERIAL PRIMARY KEY,
    name VARCHAR(100) NOT NULL
);

mvn flyway:migrate
#  Successfully applied 1 migration (execution time 00:00.123s)

mvn flyway:info
#  +-----------+---------+---------------------+------+---------------------+---------+
#  | Version   | State   | Description         | Type | Installed On        | Script  |
#  +-----------+---------+---------------------+------+---------------------+---------+
#  | 1         | Success | Create customers    | SQL  | 2024-03-20 10:00:00 | V1__... |
#  +-----------+---------+---------------------+------+---------------------+---------+

-- src/main/resources/db/migration/V2__Add_email_column.sql
ALTER TABLE customers ADD COLUMN email VARCHAR(255) UNIQUE;

mvn flyway:migrate
#  Successfully applied 1 migration (V2), now at version 2

@RestController
@RequestMapping("/api/items")
public class ItemController {

    @Autowired
    private ItemService itemService;

    @GetMapping
    public List<Item> getAllItems() {
        return itemService.getAllItems();
    }

    @GetMapping("/{id}")
    public ResponseEntity<Item> getItemById(@PathVariable Long id) {
        Item item = itemService.getItemById(id);
        return item != null ? ResponseEntity.ok(item) : ResponseEntity.notFound().build();
    }

    @PostMapping
    public ResponseEntity<Item> createItem(@RequestBody Item item) {
        Item createdItem = itemService.saveItem(item);
        URI location = ServletUriComponentsBuilder.fromCurrentRequest()
                .path("/{id}")
                .buildAndExpand(createdItem.getId())
                .toUri();
        return ResponseEntity.created(location).body(createdItem);
    }
}

import org.springframework.http.*;
import org.springframework.stereotype.Service;
import org.springframework.web.client.RequestCallback;
import org.springframework.web.client.ResponseExtractor;
import org.springframework.web.client.RestTemplate;

@Service
public class ItemService {

    private final RestTemplate restTemplate = new RestTemplate();
    private final String baseUrl = "https://jsonplaceholder.typicode.com/items";

    public void start() {
        // 1. GET: getForObject()
        Item item = this.restTemplate.getForObject(baseUrl + "/1", Item.class);

        // 2. GET: getForEntity()
        ResponseEntity<Item> getResponse = this.restTemplate.getForEntity(baseUrl + "/1", Item.class);
        Item result = getResponse.getBody();

        // 3. POST: postForObject()
        Item newItem = new Item(null, "Post Title", "Post Body", 1);
        Item createdItem = restTemplate.postForObject(baseUrl, newItem, Item.class);

        // 4. POST: postForEntity()
        ResponseEntity<Item> postResponse = this.restTemplate.postForEntity(baseUrl, newItem, Item.class);
        System.out.println("POST Status=" + postResponse.getStatusCode());
        Item result = getResponse.getBody();

        // 5. PUT: put()
        Item updatedItem = new Item(1, "Updated Title", "Updated Body", 1);
        this.restTemplate.put(baseUrl + "/1", updatedItem);

        // 6. PUT (alternative): exchange()
        HttpHeaders headers = new HttpHeaders();
        HttpEntity<Item> putEntity = new HttpEntity<>(updatedItem, headers);
        ResponseEntity<Item> putResponse = restTemplate.exchange(baseUrl + "/1", HttpMethod.PUT, putEntity, Item.class);
        Item updated = putResponse.getBody();

        // 7. DELETE: delete()
        this.restTemplate.delete(baseUrl + "/1");
    }
}

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // returns an instance which helps in building request matcher rules.
            .authorizeHttpRequests()
                // public resources
                .antMatchers("/resources/**", "/static/**").permitAll()
                // stored as a list of `RequestMatcher` → `AuthorizationManager` mappings.
                // it builds up into a filter called `AuthorizationFilter` or `FilterSecurityInterceptor`.
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/manager/**").hasAnyRole("MANAGER", "ADMIN")
                .antMatchers("/finance/**").hasAuthority("ROLE_FINANCE")
                .antMatchers("/report/**").hasPermission("READ_REPORT")
                // any request that hasn't already matched a rule will require a user to be logged
                .anyRequest().authenticated()

            // returns a HttpSecurity so we can chain other configurers
            .and()
                // sets up a filter for processing form submissions + /login + /logout + Where to go on login success/failure:
                .formLogin()
                .loginPage("/login")
                .permitAll()

            // returns a HttpSecurity so we can chain other configurers
            .and()
                .logout()
                .logoutUrl("/logout")
                .permitAll();

          return http.build();
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // SecurityContextPersistenceFilter - Loads and saves SecurityContext
        http.csrf().disable().addFilterBefore(new SecurityContextPersistenceFilter(), UsernamePasswordAuthenticationFilter.class);

        // UsernamePasswordAuthenticationFilter - Handles login form submits
        http.formLogin().loginProcessingUrl("/login");

        // BasicAuthenticationFilter - Handles HTTP Basic Authentication
        http.httpBasic();

        // BearerTokenAuthenticationFilter - Parses and authenticates JWT tokens
        http.oauth2ResourceServer().jwt(); // For JWT-based authorization

        // LogoutFilter - Handles logout requests
        http.logout().logoutUrl("/logout");

        // SecurityContextHolderFilter - Sets SecurityContext into thread-local
        http.addFilterBefore(new SecurityContextHolderFilter(), BasicAuthenticationFilter.class);

        // AnonymousAuthenticationFilter - Assigns anonymous authentication if not authenticated
        http.addFilterBefore(new AnonymousAuthenticationFilter("anonymousKey"), BearerTokenAuthenticationFilter.class);

        // ExceptionTranslationFilter - Translates access denied/authentication exceptions
        http.addFilterAfter(new ExceptionTranslationFilter(), SecurityContextHolderFilter.class);

        // FilterSecurityInterceptor - Final decision on authorization (can user access this resource?)
        http.addFilterBefore(new FilterSecurityInterceptor(), ExceptionTranslationFilter.class);

        // Authorization example for paths
        http.authorizeRequests()
          .antMatchers("/admin/**").hasRole("ADMIN")
          .anyRequest().authenticated();
    }
}

@Service
public class OrderService {
    @Secured({"ROLE_ADMIN", "ROLE_MANAGER"})
    public void deleteOrder(Long orderId) { }

    @PreAuthorize("hasRole('USER') and #order.owner.username == authentication.name")
    public void placeOrder(Order order) {}

    @PostAuthorize("returnObject.owner.username == authentication.name")
    public Order getOrderById(Long id) { return orderRepository.findById(id).orElseThrow(); }
      
    @PreFilter("filterObject.owner == authentication.name")  
    public void saveDocuments(List<Document> docs) { ... }  

    @PostFilter("filterObject.isPublic or filterObject.owner == principal.username")  
    public List<Document> getAllDocuments() { ... }
}

orders.count.us-east.premium
orders.latency.us-east.premium

orders_count{region="us-east", tier="premium"}
orders_latency{region="us-east", tier="premium"}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

@Service
public class OrderService {
    private final MeterRegistry registry;

    @Timed(value = "order.process.time", description = "Time taken to process order")
    @Counted(value = "order.count", description = "Total orders processed")
    public void processOrder(Order order) { }
}

{
  "name": "order.process.time",
  "description": "Time taken to process order",
  "measurements": [
    {"statistic": "COUNT", "value": 42},
    {"statistic": "TOTAL_TIME", "value": 5.2},
    {"statistic": "MAX", "value": 0.25}
  ]
}

# HELP order_process_time_seconds Time taken to process order
# TYPE order_process_time_seconds summary
order_process_time_seconds_count 42
order_process_time_seconds_sum 5.2
order_process_time_seconds_max 0.25

@Service
@RequiredArgsConstructor
public class OrderService {
    private final MeterRegistry registry;

    public void refundOrder(Order order) {
        Counter.builder("order.refunds")
            .tag("reason", order.getRefundReason())
            .register(registry)
            .increment();
        // ... logic
    }
}

@Aspect
@Component
@RequiredArgsConstructor
public class ErrorCounterAspect {
    private final MeterRegistry registry;

    @Around("@annotation(MonitorExecution)")
    public Object count(ProceedingJoinPoint pjp) throws Throwable {
        registry.counter(
            "method.executions", // metric name
            "class", pjp.getTarget().getClass().getSimpleName(), // tag-key, tag-value
            "method", pjp.getSignature().getName()  // tag-key, tag-value
        )
        .increment();
        return pjp.proceed();
    }
}

@MonitorExecution
public void process() {}

{
    "status": "UP",
    "components": {
        "db": { "status": "UP" },
        "disk": { "status": "UP", "details": { "free": "500MB" } }
    }
}

@Component
public class ApiHealth implements HealthIndicator {
    @Override
    public Health health() {
        return this.checkApi()
            ? Health.up().withDetail("message", "reachable").build()
            : Health.down().withDetail("error", "unreachable").build();
    }
}

management:
  endpoint:
    health:
      group:
        critical:           # Custom group name
          include: db, api  # Only these indicators
          show-details: always

@Configuration
public class ActuatorSecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/actuator/health", "/actuator/info").permitAll()  // Public access
                .requestMatchers("/actuator/**").hasRole("ADMIN")                   // Restrict others
                .anyRequest().authenticated()
            )
            .httpBasic();  // Use basic auth
        return http.build();
    }
}

server:
  port: 8080  # Main application runs on port 8080

management:
  server:
    port: 8081  # Actuator endpoints will run on a separate port
    address: 127.0.0.1  # Actuator only accessible locally

  endpoints:
    enabled-by-default: true
    web:
      exposure:
        include: health, info, metrics  # Only expose selected safe endpoints over HTTP
        exclude: env, beans, threaddump # Explicitly exclude sensitive endpoints

  endpoint:
    health:
      show-details: when-authorized  # Show detailed health info only when the user is authenticated
      roles: ADMIN                   # Require this role to see details
    metrics:
      enabled: true  # Enable /metrics endpoint

spring:
  security:
    user:
      name: admin        # Username for basic auth
      password: secret   # Password (you can externalize this in env vars or vault for safety)
      roles: ADMIN       # Role used to restrict access to sensitive endpoints

management.endpoint.auditevents.enabled=true
management.endpoints.web.exposure.include=auditevents

{
  "events": [
    {
      "timestamp": "2024-03-20T10:00:00Z",
      "principal": "admin",
      "type": "DATA_MODIFIED",
      "data": { "entity": "Order", "action": "DELETE" }
    }
  ]
}

@Service
public class OrderService {
    private final AuditEventRepository auditRepo;

    public void deleteOrder(String orderId) {
        auditRepo.add(new AuditEvent(
            "admin", 
            "ORDER_DELETED", 
            Map.of("orderId", orderId)
        ));
    }
}

@Repository
public class JpaAuditRepository implements AuditEventRepository {
    @PersistenceContext
    private EntityManager em;

    @Override
    public void add(AuditEvent event) {
        em.persist(event);
    }
}

// Good - no string concatenation if DEBUG is disabled
log.debug("Processing transaction {} with amount {}", txId, amount);

// Bad - incurs string concatenation cost unconditionally
log.debug("Processing transaction " + txId + " with amount " + amount);

<configuration>
    <!-- 1. Start with Spring Boot defaults -->
    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>

    <!-- 2. Configure rolling file logs -->
    <appender name="ROLLING_FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${LOG_FILE:-logs/app.log}</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <!-- Rotate daily or when >100MB, keep 30 days max (compressed) -->
            <fileNamePattern>${LOG_FILE:-logs/app}.%d{yyyy-MM-dd}.%i.log.gz</fileNamePattern>
            <maxFileSize>100MB</maxFileSize>
            <maxHistory>30</maxHistory>
            <totalSizeCap>5GB</totalSizeCap>
        </rollingPolicy>
        <encoder>
            <pattern>${FILE_LOG_PATTERN}</pattern>
            <charset>UTF-8</charset>
        </encoder>
    </appender>

    <!-- 3. Environment-specific setup -->
    <springProfile name="prod">
        <root level="INFO">
            <appender-ref ref="ROLLING_FILE"/> <!-- Production: file only -->
        </root>
    </springProfile>
    
    <springProfile name="dev">
        <root level="DEBUG">
            <appender-ref ref="CONSOLE"/> <!-- Development: console + file -->
            <appender-ref ref="ROLLING_FILE"/>
        </root>
    </springProfile>
</configuration>