/devkit.java.code-review

allowed-tools: Read, Write, Bash, Edit, Grep, Glob
argument-hint: "[review-type] [file/directory-path] [options]"
description: Validates Java code quality for enterprise Spring applications with security, performance, architecture and best practices analysis. Use when reviewing code changes or before merging pull requests.
model: inherit

Java Enterprise Code Review - Spring Framework

Overview

Validates Java code quality for enterprise Spring applications with security, performance, architecture and best practices analysis. Use when reviewing code changes or before merging pull requests.

Usage

/devkit.java.code-review $ARGUMENTS

Arguments

| Argument | Description | |--------------|------------------------------------------| | `$ARGUMENTS` | Combined arguments passed to the command |

Current Context

• **Current Git Branch**: !`git branch --show-current`
• **Git Status**: !`git status --porcelain`
• **Recent Commits**: !`git log --oneline -5`
• **Modified Files**: !`git diff --name-only HEAD~1`

Execution Instructions

**Agent Selection**: To execute this code review, use the following agent with fallback:

• Primary: `developer-kit-java:spring-boot-code-review-expert`
• If not available: Use `developer-kit-java:spring-boot-code-review-expert` or fallback to `general-purpose` agent with

`spring-boot-crud-patterns` skill

Review Configuration

The review will analyze: **$ARGUMENTS**

**Available review types:**

• `full` - Complete 360° review (default)
• `security` - Focus on vulnerabilities and security
• `performance` - Performance and scalability analysis
• `architecture` - Architectural patterns and design review
• `testing` - Test coverage and quality analysis
• `best-practices` - Spring/Java best practices verification

Phase 1: Preliminary Analysis and Context

1.1 Identify Review Scope

IF "$1" CONTAINS ".java" OR "$1" CONTAINS "src/" THEN Analyze specific file/directory: $ARGUMENTS ELSE Analyze entire recently modified codebase ENDIF

1.2 Base Project Metrics

• **Detected Technology**: Spring Boot (Boot 3.5.x preferred)
• **Java Version**: Verify Java 16+ for records, Java 21+ LTS
• **Spring Framework**: Spring Boot, Spring Security, Spring Data JPA, etc.
• **Build System**: Maven or Gradle
• **Database**: PostgreSQL, MySQL, H2 for testing

Phase 2: Architecture and Design Patterns Review

2.1 Project Structure Analysis

Verify feature vs layer organization:

feature/
├── domain/           # Domain entities (Spring-free)
│   ├── model/
│   ├── repository/  # Domain ports (interfaces)
│   └── service/     # Domain services
├── application/     # Use cases (@Service)
│   ├── service/
│   └── dto/         # Immutable DTOs/records
├── presentation/    # Controllers and mappers
│   └── rest/
└── infrastructure/  # JPA adapters
    └── persistence/

2.2 SOLID Principles and Clean Architecture

• **Single Responsibility**: Each class has one responsibility
• **Open/Closed**: Extensible without modifying existing code
• **Liskov Substitution**: Subtypes substitutable with supertypes
• **Interface Segregation**: Specific, not generic interfaces
• **Dependency Inversion**: Depend on abstractions, not implementations

2.3 Spring Architectural Patterns

Verify correct pattern usage:

• **Constructor Injection**: `@RequiredArgsConstructor` (never field injection)
• **Repository Pattern**: Domain interfaces + infrastructure adapters
• **Service Layer**: Business logic in @Service separated from controllers
• **DTO Pattern**: Java 16+ records for immutable transfer objects
• **Configuration Management**: Spring profiles and @ConfigurationProperties

Phase 3: Security and Vulnerabilities

3.1 OWASP Top 10 - Java Applications

• **A01: Broken Access Control**: Verify @PreAuthorize, @Secured
• **A02: Cryptographic Failures**: Password hashing, JWT validation
• **A03: Injection**: SQL injection with JPA, input validation
• **A04: Insecure Design**: Security-by-design architecture
• **A05: Security Misconfiguration**: Security headers, CORS
• **A06: Vulnerable Components**: Dependency scanning
• **A07: Authentication Failures**: Spring Security configuration
• **A08: Software/Data Integrity**: Signed JWT, checksum validation
• **A09: Logging/Monitoring**: Security logging, audit trail
• **A10: Server-Side Request Forgery**: SSRF prevention

3.2 Spring Security Best Practices

// Correct SecurityFilterChain configuration
@Bean
public SecurityFilterChain applicationSecurity(HttpSecurity http) throws Exception {
    http
            .csrf(csrf -> csrf.disable()) // Only for stateless APIs
            .sessionManagement(session ->
                    session.sessionCreationPolicy(STATELESS))
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers("/api/public/**").permitAll()
                    .requestMatchers("/api/admin/**").hasRole(ADMIN)
                    .anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 ->
                    oauth2.jwt(Customizer.withDefaults()))
            .headers(headers -> headers
                    .contentSecurityPolicy(csp -> csp
                            .policyDirectives("default-src 'self'")));

    return http.build();
}

3.3 Input Validation and Sanitization

• **Bean Validation**: Proper use of @Valid, @NotNull, @Min, @Max
• **Custom Validators**: Validators for complex business logic
• **Input Sanitization**: Anti-XSS, SQL injection prevention
• **File Upload Security**: File type validation, size limits, virus scanning

Phase 4: Performance and Scalability

4.1 Code Performance Analysis

• **Database Queries**: N+1 problems, missing indexes, query optimization
• **Caching Strategy**: Spring Cache @Cacheable, @CachePut, @CacheEvict
• **Async Processing**: @Async, CompletableFuture, WebFlux reactive
• **Memory Management**: Memory leaks, garbage collection optimizat