Spring AOP — The Complete Interview Guide

// CGLIB (default) — generates: OrderService$$EnhancerBySpringCGLIB
@Service
public class OrderService {  // No interface — CGLIB is the only option
    public Order placeOrder(OrderRequest req) { ... }
}

// JDK Proxy — only if you explicitly configure it AND have an interface
public interface PaymentGateway {
    PaymentResult charge(PaymentRequest req);
}

@Service
public class StripePaymentGateway implements PaymentGateway {
    public PaymentResult charge(PaymentRequest req) { ... }
}
// With spring.aop.proxy-target-class=false → JDK proxy implementing PaymentGateway
// Default (true) → CGLIB subclass regardless

// Simplified view of what happens inside Spring:
public class AbstractAutoProxyCreator implements BeanPostProcessor {

    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) {
        // 1. Find all Advisor beans (aspects compiled into advisors)
        List<Advisor> advisors = findEligibleAdvisors(bean.getClass());

        // 2. If any pointcut matches this bean's methods, create a proxy
        if (!advisors.isEmpty()) {
            ProxyFactory proxyFactory = new ProxyFactory();
            proxyFactory.setTarget(bean);
            proxyFactory.addAdvisors(advisors);

            // 3. Choose proxy type
            if (shouldUseJdkProxy(bean)) {
                proxyFactory.setProxyTargetClass(false);  // JDK
            } else {
                proxyFactory.setProxyTargetClass(true);   // CGLIB
            }

            return proxyFactory.getProxy();  // Return proxy instead of real bean
        }
        return bean;  // No aspects match — return original
    }
}

// All public methods in service package
@Pointcut("execution(public * com.app.service.*.*(..))")
public void allServiceMethods() {}

// All methods in service package AND sub-packages (note the ..)
@Pointcut("execution(* com.app.service..*.*(..))")
public void serviceAndSubPackages() {}

// Only methods returning Order
@Pointcut("execution(Order com.app.service.*.*(..))")
public void orderReturningMethods() {}

// Methods starting with "find" (typically read operations)
@Pointcut("execution(* com.app.service.*.find*(..))")
public void finderMethods() {}

// Methods with exactly one Long parameter
@Pointcut("execution(* com.app.service.*.*(Long))")
public void methodsWithSingleLong() {}

// Methods with Long as first param, anything else after
@Pointcut("execution(* com.app.service.*.*(Long, ..))")
public void methodsWithLongFirst() {}

// All methods annotated with @Transactional
@Pointcut("@annotation(org.springframework.transaction.annotation.Transactional)")
public void transactionalMethods() {}

// Custom annotation — bind it to access annotation values in advice
@Around("@annotation(timed)")
public Object measureTime(ProceedingJoinPoint pjp, Timed timed) throws Throwable {
    String metricName = timed.value();  // Access annotation attributes!
    long warnThreshold = timed.warnThresholdMs();
    // ...
}

// All methods within OrderService (regardless of method name)
@Pointcut("within(com.app.service.OrderService)")
public void withinOrderService() {}

// All methods in any @RestController class
@Pointcut("within(@org.springframework.web.bind.annotation.RestController *)")
public void withinControllers() {}

// All methods in service package and sub-packages
@Pointcut("within(com.app.service..*)")
public void withinServiceLayer() {}

// Match specific bean by name
@Pointcut("bean(orderService)")
public void orderServiceBean() {}

// Wildcard — all beans ending with "Service"
@Pointcut("bean(*Service)")
public void allServiceBeans() {}

// Methods accepting exactly one String
@Pointcut("args(String)")
public void singleStringArg() {}

// Bind arguments for use in advice
@Before("execution(* com.app.service.UserService.*(..)) && args(userId,..)")
public void logUserAction(Long userId) {
    log.info("Action initiated by user: {}", userId);
}

@Aspect
@Component
public class CombinedPointcuts {

    @Pointcut("execution(* com.app.service.*.*(..))")
    public void serviceLayer() {}

    @Pointcut("execution(* com.app.controller.*.*(..))")
    public void controllerLayer() {}

    @Pointcut("@annotation(com.app.annotation.Auditable)")
    public void auditable() {}

    // AND — both must match (service method that is also @Auditable)
    @Before("serviceLayer() && auditable()")
    public void auditServiceMethods(JoinPoint jp) { }

    // OR — either matches
    @Before("serviceLayer() || controllerLayer()")
    public void logAllEntryPoints(JoinPoint jp) { }

    // NOT — exclude getters from service logging
    @Before("serviceLayer() && !execution(* com.app.service.*.get*(..))")
    public void nonGetterServiceMethods(JoinPoint jp) { }

    // Complex composition
    @Around("serviceLayer() && !execution(* com.app.service.*.toString(..)) && !execution(* com.app.service.*.hashCode(..))")
    public Object monitorExcludingObjectMethods(ProceedingJoinPoint pjp) throws Throwable {
        return pjp.proceed();
    }
}

@Aspect
@Component
public class InputValidationAspect {

    @Before("execution(* com.app.service.OrderService.placeOrder(..)) && args(request)")
    public void validateOrderRequest(OrderRequest request) {
        if (request.getItems() == null || request.getItems().isEmpty()) {
            throw new IllegalArgumentException("Order must contain at least one item");
        }
        if (request.getItems().stream().anyMatch(i -> i.getQuantity() <= 0)) {
            throw new IllegalArgumentException("All items must have positive quantity");
        }
        // If we get here, execution continues to placeOrder()
        // If we throw, placeOrder() NEVER executes
    }
}

@Aspect
@Component
public class ThreadLocalCleanupAspect {

    @After("execution(* com.app.service.*.*(..))")
    public void clearRequestContext() {
        RequestContextHolder.clear();  // Prevent ThreadLocal leaks in thread pools
        MDC.clear();                   // Clean up logging context
    }
}

@Aspect
@Component
public class OrderAuditAspect {

    private final AuditRepository auditRepo;
    private final ApplicationEventPublisher eventPublisher;

    @AfterReturning(
        pointcut = "execution(* com.app.service.OrderService.placeOrder(..))",
        returning = "order"
    )
    public void auditAndPublish(JoinPoint jp, Order order) {
        // Audit trail
        String username = SecurityContextHolder.getContext()
            .getAuthentication().getName();

        auditRepo.save(AuditEntry.builder()
            .action("ORDER_PLACED")
            .entityId(order.getId().toString())
            .actor(username)
            .details("Amount: " + order.getTotalAmount())
            .timestamp(Instant.now())
            .build());

        // Domain event for downstream systems
        eventPublisher.publishEvent(new OrderPlacedEvent(order));
    }
}

@Aspect
@Component
public class ExceptionAlertingAspect {

    private final MeterRegistry meterRegistry;
    private final SlackClient slackClient;

    @AfterThrowing(
        pointcut = "execution(* com.app.service.*.*(..))",
        throwing = "ex"
    )
    public void alertOnException(JoinPoint jp, Exception ex) {
        String method = jp.getSignature().toShortString();

        // Metrics
        meterRegistry.counter("app.exceptions",
            "method", method,
            "type", ex.getClass().getSimpleName()
        ).increment();

        // Alert on-call for critical failures
        if (ex instanceof PaymentProcessingException
            || ex instanceof DataIntegrityViolationException) {
            slackClient.sendAlert("#oncall",
                String.format("CRITICAL: %s failed with %s: %s",
                    method, ex.getClass().getSimpleName(), ex.getMessage()));
        }
    }
}

@Aspect
@Component
@Slf4j
public class PerformanceMonitoringAspect {

    private final MeterRegistry meterRegistry;

    @Around("execution(* com.app.service.*.*(..))")
    public Object monitorPerformance(ProceedingJoinPoint pjp) throws Throwable {
        String className = pjp.getTarget().getClass().getSimpleName();
        String methodName = pjp.getSignature().getName();
        String metricName = className + "." + methodName;

        Timer.Sample sample = Timer.start(meterRegistry);

        try {
            Object result = pjp.proceed();  // ← Execute the actual method

            sample.stop(Timer.builder("method.duration")
                .tag("class", className)
                .tag("method", methodName)
                .tag("status", "success")
                .register(meterRegistry));

            return result;  // ← MUST return this!

        } catch (Throwable ex) {
            sample.stop(Timer.builder("method.duration")
                .tag("class", className)
                .tag("method", methodName)
                .tag("status", "error")
                .tag("exception", ex.getClass().getSimpleName())
                .register(meterRegistry));

            throw ex;  // ← Re-throw or you silently swallow errors
        }
    }
}

@Service
public class OrderService {

    @Transactional
    public void processOrders(List<OrderRequest> requests) {
        for (OrderRequest req : requests) {
            placeOrder(req);  // ← Calls this.placeOrder() — BYPASSES PROXY!
        }
    }

    @Transactional(propagation = Propagation.REQUIRES_NEW)
    public Order placeOrder(OrderRequest request) {
        // REQUIRES_NEW is IGNORED when called internally!
        // No new transaction is created. It runs in the outer transaction.
        // If one order fails, ALL orders roll back — not what you wanted.
        return orderRepository.save(Order.from(request));
    }
}

@Aspect
@Component
@Order(1)  // Outermost — trace context must be set before anything else
public class DistributedTracingAspect {

    @Around("execution(* com.app.service.*.*(..))")
    public Object addTraceContext(ProceedingJoinPoint pjp) throws Throwable {
        String traceId = MDC.get("traceId");
        if (traceId == null) {
            traceId = UUID.randomUUID().toString().replace("-", "").substring(0, 16);
            MDC.put("traceId", traceId);
        }

        String spanId = UUID.randomUUID().toString().replace("-", "").substring(0, 8);
        String parentSpanId = MDC.get("spanId");
        MDC.put("spanId", spanId);
        MDC.put("parentSpanId", parentSpanId != null ? parentSpanId : "root");
        MDC.put("operation", pjp.getSignature().toShortString());

        try {
            return pjp.proceed();
        } finally {
            MDC.put("spanId", parentSpanId);  // Restore parent span
            MDC.remove("parentSpanId");
            MDC.remove("operation");
        }
    }
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface RetryOnFailure {
    int maxAttempts() default 3;
    long initialDelayMs() default 100;
    double backoffMultiplier() default 2.0;
    Class<? extends Throwable>[] retryOn() default {RuntimeException.class};
    Class<? extends Throwable>[] noRetryOn() default {};
}

@Aspect
@Component
@Slf4j
public class RetryAspect {

    @Around("@annotation(retry)")
    public Object retryOnFailure(ProceedingJoinPoint pjp, RetryOnFailure retry) throws Throwable {
        String method = pjp.getSignature().toShortString();
        Throwable lastException = null;
        long delay = retry.initialDelayMs();

        for (int attempt = 1; attempt <= retry.maxAttempts(); attempt++) {
            try {
                Object result = pjp.proceed();
                if (attempt > 1) {
                    log.info("Method {} succeeded on attempt {}", method, attempt);
                }
                return result;
            } catch (Throwable ex) {
                lastException = ex;

                // Don't retry non-retryable exceptions
                if (isExcluded(ex, retry.noRetryOn())) {
                    log.warn("Non-retryable exception in {}: {}", method, ex.getMessage());
                    throw ex;
                }

                // Only retry specified exception types
                if (!isRetryable(ex, retry.retryOn())) {
                    throw ex;
                }

                if (attempt < retry.maxAttempts()) {
                    log.warn("Attempt {}/{} failed for {}: {}. Retrying in {} ms",
                        attempt, retry.maxAttempts(), method, ex.getMessage(), delay);
                    Thread.sleep(delay);
                    delay = (long) (delay * retry.backoffMultiplier());  // Exponential backoff
                } else {
                    log.error("All {} attempts exhausted for {}", retry.maxAttempts(), method);
                }
            }
        }
        throw lastException;
    }

    private boolean isRetryable(Throwable ex, Class<? extends Throwable>[] retryOn) {
        for (Class<? extends Throwable> clazz : retryOn) {
            if (clazz.isInstance(ex)) return true;
        }
        return false;
    }

    private boolean isExcluded(Throwable ex, Class<? extends Throwable>[] noRetryOn) {
        for (Class<? extends Throwable> clazz : noRetryOn) {
            if (clazz.isInstance(ex)) return true;
        }
        return false;
    }
}

@Service
public class PaymentService {

    @RetryOnFailure(
        maxAttempts = 3,
        initialDelayMs = 200,
        backoffMultiplier = 2.0,
        retryOn = {TimeoutException.class, ConnectionException.class},
        noRetryOn = {InsufficientFundsException.class}
    )
    public PaymentResult chargeCard(PaymentRequest request) {
        return stripeClient.charge(request);  // Retries on network issues, fails fast on business errors
    }
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface RateLimit {
    int maxRequests() default 100;
    int windowSeconds() default 60;
    String keyExpression() default "";  // SpEL for dynamic key
}

@Aspect
@Component
public class RateLimitAspect {

    private final Map<String, Deque<Long>> requestLog = new ConcurrentHashMap<>();

    @Around("@annotation(rateLimit)")
    public Object enforceRateLimit(ProceedingJoinPoint pjp, RateLimit rateLimit) throws Throwable {
        String key = resolveKey(pjp, rateLimit);
        long now = System.currentTimeMillis();
        long windowStart = now - (rateLimit.windowSeconds() * 1000L);

        Deque<Long> timestamps = requestLog.computeIfAbsent(key, k -> new ConcurrentLinkedDeque<>());

        // Evict expired entries
        while (!timestamps.isEmpty() && timestamps.peekFirst() < windowStart) {
            timestamps.pollFirst();
        }

        if (timestamps.size() >= rateLimit.maxRequests()) {
            throw new RateLimitExceededException(String.format(
                "Rate limit exceeded for key '%s': %d/%d requests in %d seconds. Retry after %d ms.",
                key, timestamps.size(), rateLimit.maxRequests(), rateLimit.windowSeconds(),
                timestamps.peekFirst() + (rateLimit.windowSeconds() * 1000L) - now));
        }

        timestamps.addLast(now);
        return pjp.proceed();
    }

    private String resolveKey(ProceedingJoinPoint pjp, RateLimit rateLimit) {
        if (!rateLimit.keyExpression().isEmpty()) {
            // Evaluate SpEL: e.g., "#userId" resolves to the method parameter named userId
            return evaluateSpEL(pjp, rateLimit.keyExpression());
        }
        // Default: current user + method name
        String user = SecurityContextHolder.getContext().getAuthentication().getName();
        return user + ":" + pjp.getSignature().toShortString();
    }
}

@Aspect
@Component
@Slf4j
public class AuditLoggingAspect {

    private final AuditEventRepository auditRepo;
    private final ObjectMapper objectMapper;

    @AfterReturning(
        pointcut = "@annotation(audit)",
        returning = "result"
    )
    public void recordSuccessAudit(JoinPoint jp, Auditable audit, Object result) {
        persistAuditEntry(jp, audit, result, null);
    }

    @AfterThrowing(
        pointcut = "@annotation(audit)",
        throwing = "ex"
    )
    public void recordFailureAudit(JoinPoint jp, Auditable audit, Exception ex) {
        persistAuditEntry(jp, audit, null, ex);
    }

    private void persistAuditEntry(JoinPoint jp, Auditable audit, Object result, Exception ex) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();

        AuditEntry entry = AuditEntry.builder()
            .action(audit.action())
            .entity(audit.entity())
            .actor(auth != null ? auth.getName() : "SYSTEM")
            .method(jp.getSignature().toShortString())
            .args(sanitizeArgs(jp.getArgs()))
            .result(result != null ? summarize(result) : null)
            .error(ex != null ? ex.getMessage() : null)
            .success(ex == null)
            .timestamp(Instant.now())
            .traceId(MDC.get("traceId"))
            .build();

        auditRepo.save(entry);
    }

    private String sanitizeArgs(Object[] args) {
        // Remove sensitive data (passwords, tokens, credit card numbers)
        // ... implementation
    }
}

@Aspect
@Component
@Slf4j
public class CircuitBreakerAspect {

    private final Map<String, CircuitState> circuits = new ConcurrentHashMap<>();

    @Around("@annotation(circuitBreaker)")
    public Object withCircuitBreaker(ProceedingJoinPoint pjp, CircuitBreaker circuitBreaker) throws Throwable {
        String circuitName = circuitBreaker.name();
        CircuitState state = circuits.computeIfAbsent(circuitName,
            k -> new CircuitState(circuitBreaker.failureThreshold(), circuitBreaker.resetTimeoutMs()));

        if (state.isOpen()) {
            if (state.shouldAttemptReset()) {
                log.info("Circuit '{}' half-open — attempting reset", circuitName);
                // Fall through to try the call
            } else {
                throw new CircuitOpenException(
                    "Circuit '" + circuitName + "' is OPEN. Failing fast. Resets in " +
                    state.getTimeUntilReset() + " ms");
            }
        }

        try {
            Object result = pjp.proceed();
            state.recordSuccess();
            return result;
        } catch (Throwable ex) {
            state.recordFailure();
            if (state.isOpen()) {
                log.error("Circuit '{}' OPENED after {} consecutive failures",
                    circuitName, circuitBreaker.failureThreshold());
            }
            throw ex;
        }
    }
}

@Aspect @Component @Order(1)  // Outermost — first in, last out
public class SecurityAspect { }

@Aspect @Component @Order(2)
public class TransactionAspect { }

@Aspect @Component @Order(3)
public class RetryAspect { }

@Aspect @Component @Order(4)  // Innermost — closest to target
public class LoggingAspect { }

// STARTUP FAILURE — CGLIB cannot subclass final class
@Service
public final class PaymentService {  // ← BeanCreationException!
    @Transactional
    public void process() { }
}

// SILENT FAILURE — Method is final, proxy created but method not intercepted
@Service
public class PaymentService {
    @Transactional
    public final void process() { }  // ← @Transactional silently ignored!
}

@Service
public class ReportService {

    public Report generate() {
        return buildReport(fetchData());  // fetchData is private
    }

    @Timed  // COMPLETELY IGNORED — private method
    @Cacheable("data")  // COMPLETELY IGNORED — private method
    private List<Data> fetchData() {
        return repository.findAll();
    }
}

// AOP will NOT work — object created with 'new', not managed by Spring
OrderValidator validator = new OrderValidator();
validator.validate(order);  // No proxy, no advice, no interception

// AOP WILL work — bean obtained from Spring context
@Autowired
private OrderValidator validator;  // This is a proxy
validator.validate(order);  // Intercepted!

@Service
@Lazy
public class ExpensiveService {
    @Transactional
    public void doWork() { ... }
}

@Configuration
@EnableTransactionManagement(mode = AdviceMode.ASPECTJ)  // Compile-time woven transactions
@EnableAsync(mode = AdviceMode.ASPECTJ)                  // Compile-time woven async
@EnableCaching(mode = AdviceMode.ASPECTJ)                // Compile-time woven caching
public class AspectJConfig {}