Implementing Data Validation

@PostMapping("/orders")
public OrderResponse create(@Valid @RequestBody CreateOrderRequest req) { ... }

public void approve(Approver a) {
    if (status != PENDING) throw new BusinessRuleException("only pending can be approved");
    if (a.equals(submittedBy)) throw new BusinessRuleException("submitter cannot approve");
    this.status = APPROVED;
}

@Constraint(validatedBy = StrongPasswordValidator.class)
@Target({FIELD}) @Retention(RUNTIME)
public @interface StrongPassword {
    String message() default "weak password";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

public class StrongPasswordValidator implements ConstraintValidator<StrongPassword, String> {
    public boolean isValid(String v, ConstraintValidatorContext c) {
        return v != null && v.length() >= 12 && v.matches(".*\\d.*") && v.matches(".*[A-Z].*");
    }
}

@DateRangeValid  // class-level
public record DateRange(LocalDate from, LocalDate to) {}

public class DateRangeValidator implements ConstraintValidator<DateRangeValid, DateRange> {
    public boolean isValid(DateRange v, ConstraintValidatorContext c) {
        return v.from() == null || v.to() == null || !v.from().isAfter(v.to());
    }
}

Validator<User> v = Validator.<User>builder()
    .require(u -> u.name() != null, "name.required")
    .check(u -> u.age() >= 18, "age.adult")
    .check(u -> u.email().contains("@"), "email.invalid")
    .build();
ValidationResult r = v.validate(user);