Java Enterprise Security & Secure Integration

import java.util.Base64;

public final class UnsafeJwtReader {
    public String subject(String jwt) {
        String payload = jwt.split("\.")[1];
        return new String(Base64.getUrlDecoder().decode(payload)); // keine Signaturprüfung
    }
}

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Base64;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public final class HmacJwtSignatureValidator {
    public boolean hasValidSignature(String jwt, byte[] secret) throws Exception {
        String[] parts = jwt.split("\.");
        if (parts.length != 3) return false;
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret, "HmacSHA256"));
        byte[] expected = mac.doFinal((parts[0] + "." + parts[1]).getBytes(StandardCharsets.US_ASCII));
        byte[] actual = Base64.getUrlDecoder().decode(parts[2]);
        return MessageDigest.isEqual(expected, actual);
    }
}

public final class WeakClaimPolicy {
    public boolean trusted(TokenClaims claims) {
        return claims.subject() != null; // issuer/audience werden ignoriert
    }
}
record TokenClaims(String subject, String issuer, String audience) {}

import java.util.Set;

public final class StrictClaimPolicy {
    private final String expectedIssuer = "https://idp.acme.example/realms/enterprise";
    private final Set<String> allowedAudiences = Set.of("order-api", "partner-gateway");

    public boolean trusted(TokenClaims claims) {
        return claims.subject() != null
            && expectedIssuer.equals(claims.issuer())
            && allowedAudiences.contains(claims.audience());
    }
}
record TokenClaims(String subject, String issuer, String audience) {}

import java.time.Instant;

public final class WeakExpiryCheck {
    public boolean active(long expiresAtEpochSeconds) {
        return expiresAtEpochSeconds > Instant.now().getEpochSecond();
    }
}

import java.time.Duration;
import java.time.Instant;

public final class TokenLifetimePolicy {
    private static final Duration CLOCK_SKEW = Duration.ofSeconds(60);

    public boolean active(long issuedAt, long expiresAt, Instant now) {
        Instant earliest = Instant.ofEpochSecond(issuedAt).minus(CLOCK_SKEW);
        Instant latest = Instant.ofEpochSecond(expiresAt).plus(CLOCK_SKEW);
        return !now.isBefore(earliest) && now.isBefore(latest);
    }
}

public final class WeakRefreshService {
    public String refresh(String refreshToken) {
        return TokenIssuer.newAccessToken(refreshToken); // alter Token bleibt gültig
    }
}

import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;

public final class RotatingRefreshTokenService {
    private final Set<String> usedTokenIds = ConcurrentHashMap.newKeySet();

    public TokenPair refresh(RefreshToken token) {
        if (!usedTokenIds.add(token.id())) {
            throw new SecurityException("Refresh token reuse detected");
        }
        return TokenIssuer.rotate(token.subject(), token.clientId());
    }
}
record RefreshToken(String id, String subject, String clientId) {}
record TokenPair(String accessToken, String refreshToken) {}
final class TokenIssuer { static TokenPair rotate(String s, String c){ return new TokenPair("access-"+s, "refresh-"+c); } }

import java.security.MessageDigest;

public final class WeakPasswordStore {
    public byte[] hash(String password) throws Exception {
        return MessageDigest.getInstance("SHA-256").digest(password.getBytes());
    }
}

import java.security.SecureRandom;
import java.util.Base64;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;

public final class Pbkdf2PasswordHasher {
    private static final SecureRandom RANDOM = new SecureRandom();

    public String hash(char[] password) throws Exception {
        byte[] salt = new byte[16];
        RANDOM.nextBytes(salt);
        PBEKeySpec spec = new PBEKeySpec(password, salt, 210_000, 256);
        byte[] hash = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded();
        return "pbkdf2$210000$" + Base64.getEncoder().encodeToString(salt) + "$" + Base64.getEncoder().encodeToString(hash);
    }
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-api
spec:
  template:
    spec:
      serviceAccountName: default
      automountServiceAccountToken: true

apiVersion: v1
kind: ServiceAccount
metadata:
  name: order-api-reader
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-api
spec:
  template:
    spec:
      serviceAccountName: order-api-reader
      automountServiceAccountToken: false

public record ApiClient(String clientId, String apiKey) {}

public final class ApiKeyRepository {
    public void save(ApiClient client) {
        System.out.println("store apiKey=" + client.apiKey());
    }
}

import java.security.MessageDigest;
import java.util.HexFormat;

public record ApiClientSecret(String clientId, String apiKeyHash) {}

public final class ApiKeyHasher {
    public ApiClientSecret protect(String clientId, String presentedApiKey) throws Exception {
        byte[] digest = MessageDigest.getInstance("SHA-256").digest(presentedApiKey.getBytes());
        return new ApiClientSecret(clientId, HexFormat.of().formatHex(digest));
    }
}

public final class LoginServlet {
    void login(HttpRequest req, User user) {
        req.session().put("user", user.name()); // gleiche Session-ID bleibt bestehen
    }
}

public final class LoginHandler {
    void login(HttpRequest req, User user) {
        req.invalidateSession();
        Session session = req.createSession();
        session.put("principal", user.name());
        session.put("loginTime", java.time.Instant.now().toString());
    }
}
interface HttpRequest { Session session(); void invalidateSession(); Session createSession(); }
interface Session { void put(String key, String value); }
record User(String name) {}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-internal
spec:
  podSelector: {}
  ingress:
    - {}

import java.net.http.HttpClient;
import javax.net.ssl.SSLContext;

public final class MtlsClientFactory {
    public HttpClient create(SSLContext serviceSslContext) {
        return HttpClient.newBuilder()
            .sslContext(serviceSslContext)
            .connectTimeout(java.time.Duration.ofSeconds(3))
            .build();
    }
}

public final class PartnerController {
    public Response getContract(String id) {
        return Response.ok("contract " + id); // Sicherheitsabsicht unklar
    }
}

@RequiresPermission("partner:contract:read")
public final class PartnerController {
    public Response getContract(Principal principal, String id) {
        return Response.ok("contract " + id + " for " + principal.subject());
    }
}
@interface RequiresPermission { String value(); }
record Principal(String subject) {}
record Response(String body) { static Response ok(String body){ return new Response(body); } }

public final class PermissionGuard {
    public boolean allowed(User user, String permission) {
        return true; // während Entwicklung vergessen
    }
}

import java.util.Set;

public final class PermissionGuard {
    public void require(User user, String permission) {
        if (!user.permissions().contains(permission)) {
            throw new AccessDeniedException(permission);
        }
    }
}
record User(String subject, Set<String> permissions) {}
final class AccessDeniedException extends RuntimeException { AccessDeniedException(String p){ super("missing permission: " + p); } }

public final class OrderQueryService {
    public List<Order> find(String tenantIdFromRequest) {
        return database.findByTenant(tenantIdFromRequest);
    }
    private final OrderDatabase database = new OrderDatabase();
}
record Order(String id) {}
class OrderDatabase { List<Order> findByTenant(String tenant){ return List.of(new Order("o-1")); } }

import java.util.List;

public final class OrderQueryService {
    private final OrderDatabase database = new OrderDatabase();

    public List<Order> find(SecurityPrincipal principal) {
        return database.findByTenant(principal.tenantId());
    }
}
record SecurityPrincipal(String subject, String tenantId) {}
record Order(String id) {}
class OrderDatabase { List<Order> findByTenant(String tenant){ return List.of(new Order("o-1")); } }

public final class InvoiceController {
    public Invoice get(String invoiceId, User user) {
        if (user.hasRole("USER")) return repo.find(invoiceId);
        throw new SecurityException();
    }
    private final InvoiceRepository repo = new InvoiceRepository();
}

public final class InvoiceController {
    private final InvoiceRepository repo = new InvoiceRepository();

    public Invoice get(String invoiceId, User user) {
        Invoice invoice = repo.find(invoiceId);
        if (!invoice.tenantId().equals(user.tenantId())) throw new SecurityException("tenant mismatch");
        return invoice;
    }
}
record User(String tenantId) { boolean hasRole(String role){ return true; } }
record Invoice(String id, String tenantId) {}
class InvoiceRepository { Invoice find(String id){ return new Invoice(id, "tenant-a"); } }

if (user.role().equals("SUPER_ADMIN") || user.role().equals("ORDER_MANAGER")) {
    order.cancel();
}

enum Permission { ORDER_CANCEL, ORDER_READ, INVOICE_READ }

public final class RolePermissionMapper {
    public java.util.Set<Permission> permissionsFor(String role) {
        return switch (role) {
            case "ORDER_MANAGER" -> java.util.Set.of(Permission.ORDER_CANCEL, Permission.ORDER_READ);
            case "AUDITOR" -> java.util.Set.of(Permission.ORDER_READ, Permission.INVOICE_READ);
            default -> java.util.Set.of();
        };
    }
}

public final class CancelOrderService {
    public void cancel(String orderId) {
        repository.cancel(orderId); // keine fachliche Berechtigungsprüfung
    }
}

public final class CancelOrderService {
    private final AuthorizationPolicy authorization;
    private final OrderRepository repository;

    public void cancel(SecurityPrincipal principal, String orderId) {
        authorization.require(principal, "order:cancel");
        repository.cancel(orderId);
    }
    public CancelOrderService(AuthorizationPolicy authorization, OrderRepository repository) {
        this.authorization = authorization; this.repository = repository;
    }
}
interface AuthorizationPolicy { void require(SecurityPrincipal p, String permission); }
interface OrderRepository { void cancel(String id); }
record SecurityPrincipal(String subject) {}

boolean allowed = user.roles().contains("ADMIN");

import java.util.Set;

public final class AdminScopePolicy {
    public void requirePriceAdmin(Principal p) {
        if (!p.permissions().contains("price:write")) throw new SecurityException("price admin required");
    }
}
record Principal(String subject, Set<String> permissions) {}

public final class PermissionCache {
    private final Map<String, Set<String>> cache = new HashMap<>();
    public Set<String> permissions(String user) { return cache.computeIfAbsent(user, this::load); }
    private Set<String> load(String user) { return Set.of("order:write"); }
}

import java.time.*;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;

public final class ExpiringPermissionCache {
    private final Map<String, Entry> cache = new ConcurrentHashMap<>();
    public Set<String> permissions(String user) {
        Entry entry = cache.get(user);
        if (entry == null || entry.validUntil().isBefore(Instant.now())) {
            entry = new Entry(load(user), Instant.now().plus(Duration.ofMinutes(5)));
            cache.put(user, entry);
        }
        return entry.permissions();
    }
    public void invalidate(String user) { cache.remove(user); }
    private Set<String> load(String user) { return Set.of("order:read"); }
    record Entry(Set<String> permissions, Instant validUntil) {}
}

public final class PriceController {
    public void updatePrice(String sku, BigDecimal price) {
        priceService.update(sku, price); // UI hat Button versteckt, API prüft nicht
    }
}

import java.math.BigDecimal;

public final class PriceController {
    private final AuthorizationPolicy auth;
    private final PriceService priceService;
    public void updatePrice(Principal principal, String sku, BigDecimal price) {
        auth.require(principal, "price:write");
        priceService.update(sku, price);
    }
    public PriceController(AuthorizationPolicy auth, PriceService priceService) { this.auth = auth; this.priceService = priceService; }
}
interface AuthorizationPolicy { void require(Principal p, String permission); }
interface PriceService { void update(String sku, BigDecimal price); }
record Principal(String subject) {}

catch (AccessDeniedException ex) {
    return Response.status(403);
}

public final class AccessDeniedHandler {
    private final AuditSink audit;
    public Response handle(Principal p, String action, RuntimeException ex) {
        audit.record(new AuditEvent("ACCESS_DENIED", p.subject(), action, java.time.Instant.now()));
        return Response.status(403, "access denied");
    }
}
interface AuditSink { void record(AuditEvent event); }
record AuditEvent(String type, String subject, String action, java.time.Instant at) {}
record Principal(String subject) {}
record Response(int status, String body) { static Response status(int s, String b){ return new Response(s,b); } }

public final class OrderController {
    boolean allowed(User u) { return u.role().equals("ADMIN") || u.name().equals("batch"); }
}

public final class OrderPolicy {
    public boolean canCancel(User user, Order order) {
        return user.permissions().contains("order:cancel") && user.tenantId().equals(order.tenantId());
    }
}
record User(String tenantId, java.util.Set<String> permissions) {}
record Order(String id, String tenantId) {}

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder(URI.create(url)).GET().build();
client.send(request, BodyHandlers.ofString());

import java.net.URI;
import java.net.http.*;
import java.time.Duration;

public final class PartnerClient {
    private final HttpClient client = HttpClient.newBuilder()
        .connectTimeout(Duration.ofSeconds(2))
        .build();

    public String getStatus(URI uri) throws Exception {
        HttpRequest request = HttpRequest.newBuilder(uri)
            .timeout(Duration.ofSeconds(4))
            .GET().build();
        return client.send(request, HttpResponse.BodyHandlers.ofString()).body();
    }
}

for (int i = 0; i < 3; i++) {
    client.send(createPaymentRequest(), BodyHandlers.ofString());
}

public final class RetryPolicy {
    public boolean mayRetry(String method, int statusCode) {
        boolean idempotent = method.equals("GET") || method.equals("PUT") || method.equals("DELETE");
        boolean transientFailure = statusCode == 429 || statusCode == 503 || statusCode == 504;
        return idempotent && transientFailure;
    }
}

HttpRequest request = HttpRequest.newBuilder(paymentUri)
    .POST(BodyPublishers.ofString(json))
    .build();

import java.net.http.HttpRequest;

HttpRequest request = HttpRequest.newBuilder(paymentUri)
    .header("Idempotency-Key", orderId + "-" + paymentAttempt)
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(json))
    .build();

public byte[] fetch(String urlFromRequest) throws Exception {
    return http.get(URI.create(urlFromRequest));
}

import java.net.URI;
import java.util.Set;

public final class OutboundUrlPolicy {
    private final Set<String> allowedHosts = Set.of("api.partner-a.example", "files.partner-b.example");

    public URI requireAllowed(String candidate) {
        URI uri = URI.create(candidate);
        if (!"https".equals(uri.getScheme()) || !allowedHosts.contains(uri.getHost())) {
            throw new SecurityException("outbound host not allowed: " + uri.getHost());
        }
        return uri;
    }
}

request.header("X-Correlation-ID", user.email());

import java.util.UUID;

public final class CorrelationId {
    public static String fromHeaderOrNew(String headerValue) {
        if (headerValue != null && headerValue.matches("[a-zA-Z0-9_.:-]{8,80}")) return headerValue;
        return UUID.randomUUID().toString();
    }
}

catch (Exception ex) {
    return Response.status(500, ex.toString());
}

public final class ErrorMapper {
    public ApiError toClientError(Exception ex, String correlationId) {
        logInternal(correlationId, ex);
        return new ApiError("INTERNAL_ERROR", "Die Anfrage konnte nicht verarbeitet werden.", correlationId);
    }
    private void logInternal(String correlationId, Exception ex) { System.err.println(correlationId + " " + ex.getClass().getName()); }
}
record ApiError(String code, String message, String correlationId) {}

public String callPartner() throws Exception {
    return partnerClient.call();
}

import java.time.*;
import java.util.concurrent.atomic.AtomicInteger;

public final class SimpleCircuitBreaker {
    private final AtomicInteger failures = new AtomicInteger();
    private volatile Instant openUntil = Instant.EPOCH;

    public boolean allowRequest() {
        return Instant.now().isAfter(openUntil);
    }
    public void recordFailure() {
        if (failures.incrementAndGet() >= 5) openUntil = Instant.now().plusSeconds(30);
    }
    public void recordSuccess() { failures.set(0); openUntil = Instant.EPOCH; }
}

public boolean allowed(String clientId) {
    return true;
}

import java.time.Instant;
import java.util.concurrent.ConcurrentHashMap;

public final class FixedWindowRateLimiter {
    private final ConcurrentHashMap<String, Counter> counters = new ConcurrentHashMap<>();
    public boolean allowed(String clientId) {
        long minute = Instant.now().getEpochSecond() / 60;
        Counter c = counters.compute(clientId, (k, old) -> old == null || old.minute != minute ? new Counter(minute, 1) : old.increment());
        return c.count <= 600;
    }
    record Counter(long minute, int count) { Counter increment(){ return new Counter(minute, count + 1); } }
}

public void receive(String payload) {
    eventService.apply(payload); // jeder kann Events senden
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

public final class WebhookSignatureVerifier {
    public boolean valid(byte[] payload, byte[] secret, byte[] signature) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret, "HmacSHA256"));
        return MessageDigest.isEqual(mac.doFinal(payload), signature);
    }
}

List<Event> all = partnerClient.readAll();
all.forEach(processor::process);

import java.util.concurrent.*;

public final class BoundedPartnerImport {
    private final BlockingQueue<Event> queue = new ArrayBlockingQueue<>(1_000);
    public boolean offer(Event event) throws InterruptedException {
        return queue.offer(event, 200, TimeUnit.MILLISECONDS);
    }
    public Event take() throws InterruptedException { return queue.take(); }
}
record Event(String id, String body) {}

Path base = Path.of("/srv/app/files");
Path target = base.resolve(requestedFileName);
return Files.readAllBytes(target);

import java.nio.file.*;

public final class SafeDownloadPath {
    private final Path base = Path.of("/srv/app/files").toAbsolutePath().normalize();
    public Path resolve(String requestedFileName) {
        Path target = base.resolve(requestedFileName).normalize();
        if (!target.startsWith(base)) throw new SecurityException("path traversal blocked");
        return target;
    }
}

byte[] bytes = inputStream.readAllBytes();
repository.save(bytes);

import java.io.*;

public final class LimitedUploadReader {
    public byte[] read(InputStream in, long maxBytes) throws IOException {
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        byte[] buffer = new byte[8192];
        long total = 0;
        for (int read; (read = in.read(buffer)) != -1;) {
            total += read;
            if (total > maxBytes) throw new IOException("upload too large");
            out.write(buffer, 0, read);
        }
        return out.toByteArray();
    }
}

if (fileName.endsWith(".csv")) {
    importCsv(input);
}

import java.io.*;
import java.nio.charset.StandardCharsets;

public final class CsvUploadPolicy {
    public void requireCsv(String fileName, byte[] firstBytes) {
        if (!fileName.toLowerCase().endsWith(".csv")) throw new SecurityException("extension not allowed");
        String prefix = new String(firstBytes, 0, Math.min(firstBytes.length, 128), StandardCharsets.UTF_8);
        if (prefix.indexOf('') >= 0 || prefix.startsWith("MZ")) throw new SecurityException("content not csv-like");
    }
}

Path out = targetDir.resolve(zipEntry.getName());
Files.copy(zip.getInputStream(zipEntry), out);

import java.nio.file.*;
import java.util.zip.ZipEntry;

public final class SafeZipExtractor {
    public Path resolveEntry(Path targetDir, ZipEntry entry) {
        Path root = targetDir.toAbsolutePath().normalize();
        Path out = root.resolve(entry.getName()).normalize();
        if (!out.startsWith(root)) throw new SecurityException("zip slip blocked: " + entry.getName());
        return out;
    }
}

writer.write(customerName + ";" + amount + "
");

public final class SafeCsvCell {
    public String escape(String value) {
        String v = value == null ? "" : value.replace(""", """");
        if (!v.isEmpty() && "=+-@".indexOf(v.charAt(0)) >= 0) v = "'" + v;
        return """ + v + """;
    }
}

response.header("Content-Disposition", "attachment; filename=" + fileName);

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

public final class DownloadHeaderFactory {
    public String attachment(String fileName) {
        String safe = fileName.replaceAll("[\r\n\\/]", "_");
        String encoded = URLEncoder.encode(safe, StandardCharsets.UTF_8).replace("+", "%20");
        return "attachment; filename="download"; filename*=UTF-8''" + encoded;
    }
}

Path tmp = Path.of("/tmp/upload.csv");
Files.writeString(tmp, content);

import java.nio.file.*;

public final class TempFileService {
    public Path createUploadTemp(byte[] content) throws java.io.IOException {
        Path tmp = Files.createTempFile("upload-", ".bin");
        Files.write(tmp, content, StandardOpenOption.TRUNCATE_EXISTING);
        tmp.toFile().deleteOnExit();
        return tmp;
    }
}

documentStore.save(uploadedFile);
importer.importNow(uploadedFile);

public final class UploadPipeline {
    private final MalwareScanner scanner;
    private final DocumentStore store;
    public StoredDocument accept(UploadedFile file) {
        scanner.requireClean(file.bytes());
        return store.save(file);
    }
}
interface MalwareScanner { void requireClean(byte[] bytes); }
interface DocumentStore { StoredDocument save(UploadedFile file); }
record UploadedFile(String name, byte[] bytes) {}
record StoredDocument(String id) {}

public byte[] download(String fileId) {
    return fileStore.read(fileId);
}

public final class DocumentDownloadService {
    private final AuthorizationPolicy auth;
    private final DocumentRepository repo;
    public byte[] download(Principal principal, String documentId) {
        Document doc = repo.find(documentId);
        auth.requireTenant(principal, doc.tenantId());
        return doc.bytes();
    }
}
interface AuthorizationPolicy { void requireTenant(Principal p, String tenantId); }
interface DocumentRepository { Document find(String id); }
record Principal(String tenantId) {}
record Document(String tenantId, byte[] bytes) {}

store.save(bytes);
log.info("file imported");

import java.security.MessageDigest;
import java.util.HexFormat;

public final class FileFingerprint {
    public String sha256(byte[] bytes) throws Exception {
        return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(bytes));
    }
}

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
Document doc = factory.newDocumentBuilder().parse(inputStream);

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory;

public final class SecureXmlFactory {
    public DocumentBuilderFactory create() throws Exception {
        DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
        f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        f.setFeature("http://xml.org/sax/features/external-general-entities", false);
        f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        f.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        f.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
        f.setXIncludeAware(false);
        f.setExpandEntityReferences(false);
        return f;
    }
}

ObjectInputStream in = new ObjectInputStream(requestBody);
Command command = (Command) in.readObject();
command.execute();

public record CreateOrderCommand(String customerId, java.util.List<String> skuIds) {}

public final class CommandValidator {
    public void requireValid(CreateOrderCommand command) {
        if (command.customerId() == null || command.customerId().isBlank()) throw new IllegalArgumentException("customer required");
        if (command.skuIds().size() > 100) throw new IllegalArgumentException("too many lines");
    }
}

public Response update(CustomerEntity entityFromRequest) {
    customerRepository.save(entityFromRequest);
    return Response.ok();
}

public record UpdateCustomerRequest(String displayName, String phoneNumber) {}

public final class CustomerUpdater {
    public void update(Customer customer, UpdateCustomerRequest request) {
        customer.changeDisplayName(request.displayName());
        customer.changePhoneNumber(request.phoneNumber());
    }
}

mapper.activateDefaultTyping(typeValidator, ObjectMapper.DefaultTyping.EVERYTHING);

sealed interface PartnerEvent permits OrderReceived, DeliveryFailed {}
record OrderReceived(String orderId) implements PartnerEvent {}
record DeliveryFailed(String orderId, String reason) implements PartnerEvent {}

public final class PartnerEventFactory {
    public PartnerEvent fromType(String type, String orderId, String reason) {
        return switch (type) {
            case "ORDER_RECEIVED" -> new OrderReceived(orderId);
            case "DELIVERY_FAILED" -> new DeliveryFailed(orderId, reason);
            default -> throw new IllegalArgumentException("unknown event type");
        };
    }
}

String html = "<div>" + customerName + "</div>";

public final class HtmlEscaper {
    public String text(String value) {
        return value.replace("&", "&")
            .replace("<", "&lt;")
            .replace(">", "&gt;")
            .replace(""", "&quot;")
            .replace("'", "&#x27;");
    }
}

log.info("payment request=" + requestJson);

public final class LogMasker {
    public String mask(String message) {
        return message
            .replaceAll("Bearer [A-Za-z0-9._-]+", "Bearer ***")
            .replaceAll("[A-Z]{2}[0-9A-Z]{13,32}", "IBAN-***")
            .replaceAll("[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+", "email-***");
    }
}

{
  "orderId": "O-4711",
  "status": "PAID"
}

{
  "schemaVersion": 2,
  "eventType": "OrderPaid",
  "eventId": "evt-20260707-001",
  "orderId": "O-4711",
  "paidAt": "2026-07-07T12:00:00Z"
}

Order order = mapper.toOrder(request);
repository.save(order);

public final class OrderRequestValidator {
    public void validate(CreateOrderRequest request) {
        if (request.customerId() == null || request.customerId().isBlank()) throw new IllegalArgumentException("customerId required");
        if (request.lines().isEmpty()) throw new IllegalArgumentException("at least one line required");
    }
}
record CreateOrderRequest(String customerId, java.util.List<String> lines) {}

byte[] bytes = payload.getBytes();
String text = new String(bytes);

import java.nio.charset.StandardCharsets;

byte[] bytes = payload.getBytes(StandardCharsets.UTF_8);
String text = new String(bytes, StandardCharsets.UTF_8);

byte[] signature = signer.sign(prettyPrintedJson.getBytes());

import java.nio.charset.StandardCharsets;

public final class CanonicalSignerInput {
    public byte[] bytes(String method, String path, String sha256Body) {
        String canonical = method.toUpperCase() + "
" + path + "
" + sha256Body;
        return canonical.getBytes(StandardCharsets.UTF_8);
    }
}

payment.api.key=live_1234567890
spring.datasource.password=secret-password

apiVersion: v1
kind: Secret
metadata:
  name: partner-payment-secret
type: Opaque
stringData:
  api-key: ${PAYMENT_API_KEY_FROM_VAULT_OR_PIPELINE}

env:
  - name: CLIENT_PRIVATE_KEY
    value: "-----BEGIN PRIVATE KEY-----..."