Response
Here's the complete implementation, following the house conventions (domain exceptions mapped by a `@RestControllerAdvice`, `ApiResponse` wrapping, constructor injection, authorization check inside the service itself).
```java
package com.acme.billing;
/**
* Thrown when no invoice exists for the given id.
*/
public class InvoiceNotFoundException extends RuntimeException {
public InvoiceNotFoundException(long invoiceId) {
super("Invoice " + invoiceId + " was not found");
}
}
```
```java
package com.acme.billing;
/**
* Thrown when a customer attempts to act on an invoice that does not belong to them.
*/
public class InvoiceAccessDeniedException extends RuntimeException {
public InvoiceAccessDeniedException(long invoiceId) {
super("Invoice " + invoiceId + " does not belong to the current customer");
}
}
```
```java
package com.acme.billing;
/**
* Thrown when an invoice cannot be cancelled because it is no longer unpaid.
*/
public class InvoiceNotCancellableException extends RuntimeException {
public InvoiceNotCancellableException(long invoiceId, InvoiceStatus currentStatus) {
super("Invoice " + invoiceId + " cannot be cancelled while in status " + currentStatus);
}
}
```
```java
package com.acme.billing;
import java.time.Instant;
public record ApiResponse<T>(boolean success, T data, ApiError error, Instant timestamp) {
public static <T> ApiResponse<T> ok(T data) {
return new ApiResponse<>(true, data, null, Instant.now());
}
public static <T> ApiResponse<T> error(String code, String message) {
return new ApiResponse<>(false, null, new ApiError(code, message), Instant.now());
}
public record ApiError(String code, String message) {
}
}
```
```java
package com.acme.billing;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;
@RestControllerAdvice
public class InvoiceExceptionHandler {
@ExceptionHandler(InvoiceNotFoundException.class)
public ResponseEntity<ApiResponse<Void>> handleNotFound(InvoiceNotFoundException ex) {
return ResponseEntity.status(HttpStatus.NOT_FOUND)
.body(ApiResponse.error("INVOICE_NOT_FOUND", ex.getMessage()));
}
@ExceptionHandler(InvoiceAccessDeniedException.class)
public ResponseEntity<ApiResponse<Void>> handleAccessDenied(InvoiceAccessDeniedException ex) {
return ResponseEntity.status(HttpStatus.FORBIDDEN)
.body(ApiResponse.error("INVOICE_ACCESS_DENIED", ex.getMessage()));
}
@ExceptionHandler(InvoiceNotCancellableException.class)
public ResponseEntity<ApiResponse<Void>> handleNotCancellable(InvoiceNotCancellableException ex) {
return ResponseEntity.status(HttpStatus.CONFLICT)
.body(ApiResponse.error("INVOICE_NOT_CANCELLABLE", ex.getMessage()));
}
}
```
```java
package com.acme.billing;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
@Service
public class InvoiceService {
private final InvoiceRepository invoiceRepository;
public InvoiceService(InvoiceRepository invoiceRepository) {
this.invoiceRepository = invoiceRepository;
}
@Transactional
public void cancelInvoice(long customerId, long invoiceId) {
Invoice invoice = invoiceRepository.findById(invoiceId)
.orElseThrow(() -> new InvoiceNotFoundException(invoiceId));
if (invoice.customerId() != customerId) {
throw new InvoiceAccessDeniedException(invoiceId);
}
if (invoice.status() != InvoiceStatus.UNPAID) {
throw new InvoiceNotCancellableException(invoiceId, invoice.status());
}
invoice.markCancelled();
}
}
```
```java
package com.acme.billing;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.PatchMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api/invoices")
public class InvoiceController {
private final InvoiceService invoiceService;
public InvoiceController(InvoiceService invoiceService) {
this.invoiceService = invoiceService;
}
@PatchMapping("/{invoiceId}/cancel")
public ResponseEntity<ApiResponse<Void>> cancelInvoice(
@PathVariable long invoiceId,
@AuthenticationPrincipal CustomerPrincipal currentCustomer) {
invoiceService.cancelInvoice(currentCustomer.id(), invoiceId);
return ResponseEntity.ok(ApiResponse.ok(null));
}
}
```
Two assumptions I had to make beyond what was given: `Invoice.status()` returns an `InvoiceStatus` enum with an `UNPAID` constant, and the controller resolves the caller's id via an existing `CustomerPrincipal` (`@AuthenticationPrincipal`) — swap that for however your app actually extracts the authenticated customer. Ownership and status checks throw distinct exceptions (403 vs. 409) rather than collapsing into a generic 404; if you'd rather not reveal that an invoice exists for someone who doesn't own it, say so and I'll fold `InvoiceAccessDeniedException` into the 404 path instead.