DTO Layer (Data Transfer Objects)

What is a Data Transfer Object (DTO)?

A DTO (Data Transfer Object) is a simple Java object designed specifically to carry data between software processes (like between your frontend React app and your backend Spring Boot API) without exposing internal database entities.

Why Should You NEVER Expose JPA Entities Directly?

• 🛡️ Security Leak Prevention: Prevents exposing confidential fields like password hashes, secret tokens, or internal audit fields in JSON responses.
• ⚡ Over-fetching & Payload Reduction: Database tables often contain 30+ columns. A DTO sends only the 4 fields the frontend actually needs, saving network bandwidth.
• 🔓 Decoupling & Stability: Database schema refactoring (e.g. renaming DB column usr_nm to user_name) will never break frontend API contracts if a DTO is used.
• 🚫 Mass Assignment Vulnerability: Malicious users could send extra JSON properties (e.g. "isAdmin": true) to overwrite database columns if entities are passed directly into @RequestBody.

Complete Beginner Code Example:

package com.anujsingh.digitalguru.dto;

import java.time.LocalDateTime;

// Using Java 14+ Record for 100% immutable, zero-boilerplate DTO!
public record UserResponseDto(
    Long id,
    String fullName,
    String email,
    LocalDateTime createdAt
) {}

package com.anujsingh.digitalguru.dto;

import jakarta.validation.constraints.Email;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Size;

public class CreateUserRequestDto {

    @NotBlank(message = "Name cannot be empty")
    private String fullName;

    @Email(message = "Please provide a valid email address")
    @NotBlank(message = "Email is required")
    private String email;

    @Size(min = 8, message = "Password must be at least 8 characters long")
    private String password;

    // Getters and Setters
    public String getFullName() { return fullName; }
    public void setFullName(String fullName) { this.fullName = fullName; }

    public String getEmail() { return email; }
    public void setEmail(String email) { this.email = email; }

    public String getPassword() { return password; }
    public void setPassword(String password) { this.password = password; }
}

package com.anujsingh.digitalguru.controller;

import org.springframework.web.bind.annotation.*;
import jakarta.validation.Valid;
import com.anujsingh.digitalguru.dto.CreateUserRequestDto;
import com.anujsingh.digitalguru.dto.UserResponseDto;
import com.anujsingh.digitalguru.service.UserService;

@RestController
@RequestMapping("/api/v1/users")
public class UserController {

    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @PostMapping
    public UserResponseDto createUser(@Valid @RequestBody CreateUserRequestDto requestDto) {
        // Service converts DTO -> Entity -> Database -> DTO
        return userService.createUser(requestDto);
    }
}

Line-by-Line Breakdown:

1. public record UserResponseDto(...): Java Records auto-generate constructor, getters, equals(), hashCode(), and toString() in 1 single line!
2. @Valid @RequestBody: Instructs Spring to validate the incoming JSON against constraint annotations (`@NotBlank`, `@Email`, `@Size`) before running any method logic.
3. UserResponseDto return type: Guarantees that sensitive fields like password are filtered out before sending JSON back to the browser.