Bean-validering: @NotNull, @Size, @Pattern

public record CreateUserRequest(
    @NotBlank(message = "Name is required")
    String name,
    @NotBlank @Email
    String email,
    @NotNull
    UserRole role
) {}

@Size(min = 3, max = 50, message = "Name must be 3-50 characters")
private String name;
@Size(min = 1, max = 10, message = "Cart must have 1-10 items")
private List<CartItem> items;

@Min(1) @Max(100)
private int quantity;
@DecimalMin("0.01") @DecimalMax("99999.99")
private BigDecimal price;
@Positive
private long orderId;

@Pattern(regexp = "^\\+?[1-9]\\d{7,14}$", message = "Invalid phone number")
private String phone;
@Pattern(regexp = "^[A-Z]{2}\\d{5}$", message = "Invalid postal code (e.g. AB12345)")
private String postalCode;

@NotBlank @Email
private String email;
// Hibernate-specific:
@URL(protocol = "https")
private String profileUrl;

@Past(message = "Birth date must be in the past")
private LocalDate birthDate;
@Future(message = "Expiry must be in the future")
private LocalDate expiryDate;

@PostMapping("/users")
public ResponseEntity<UserDto> create(@Valid @RequestBody CreateUserRequest req) {
    User user = userService.create(req);
    return ResponseEntity.status(201).body(UserDto.from(user));
}

public record OrderRequest(
    @NotNull @Valid
    AddressRequest shippingAddress, // validates AddressRequest constraints too
    @Valid @NotEmpty
    List<@Valid LineItemRequest> items
) {}

public interface CreateGroup {}
public interface UpdateGroup {}
public record UserRequest(
    @NotBlank(groups = CreateGroup.class) String password,
    @NotNull(groups = UpdateGroup.class)  Long id
) {}
// Controller:
@PutMapping("/{id}")
public UserDto update(@Validated(UpdateGroup.class) @RequestBody UserRequest req) { ... }

@ExceptionHandler(MethodArgumentNotValidException.class)
public ResponseEntity<Map<String, String>> handleValidation(MethodArgumentNotValidException ex) {
    Map<String, String> errors = new LinkedHashMap<>();
    ex.getBindingResult().getFieldErrors().forEach(e ->
        errors.put(e.getField(), e.getDefaultMessage()));
    return ResponseEntity.badRequest().body(errors);
}