// Calling two downstream services in parallel and merging
Mono<UserProfile> userMono = userService.getProfile(userId);
Mono<List<Order>> ordersMono = orderService.getRecentOrders(userId);
 
Mono<DashboardResponse> result = Mono.zip(userMono, ordersMono)
    .map(tuple -> DashboardResponse.builder()
        .user(tuple.getT1())
        .orders(tuple.getT2())
        .build());

public interface ServerWebExchange {
    ServerHttpRequest getRequest();      // immutable request
    ServerHttpResponse getResponse();   // mutable response
    Map<String, Object> getAttributes(); // mutable bag for filter-to-filter communication
    Mono<WebSession> getSession();
    <T> Mono<T> getPrincipal();
    // mutate() returns a builder to create modified copies
    ServerWebExchange.Builder mutate();
}

ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
    .header("X-Downstream-Caller", "bff")
    .build();
return chain.filter(exchange.mutate().request(mutatedRequest).build());

import org.springframework.boot.gradle.tasks.bundling.BootJar
 
plugins {
    id("org.springframework.boot") version "3.4.3"
    id("io.spring.dependency-management") version "1.1.7"
    kotlin("jvm") version "2.0.21"
    kotlin("plugin.spring") version "2.0.21"
}
 
group = "com.example"
version = "0.0.1-SNAPSHOT"
 
java {
    toolchain {
        languageVersion = JavaLanguageVersion.of(21)
    }
}
 
repositories {
    mavenCentral()
}
 
extra["springCloudVersion"] = "2024.0.1"
 
dependencyManagement {
    imports {
        mavenBom("org.springframework.cloud:spring-cloud-dependencies:${property("springCloudVersion")}")
    }
}
 
dependencies {
    // Spring Cloud Gateway (pulls in spring-boot-starter-webflux + reactor-netty)
    implementation("org.springframework.cloud:spring-cloud-starter-gateway")
 
    // Security — OAuth2 client for OIDC login + token relay
    implementation("org.springframework.boot:spring-boot-starter-security")
    implementation("org.springframework.boot:spring-boot-starter-oauth2-client")
 
    // Actuator — health + gateway management endpoints
    implementation("org.springframework.boot:spring-boot-starter-actuator")
 
    // Circuit breaker via Resilience4j (reactive)
    implementation("org.springframework.cloud:spring-cloud-starter-circuitbreaker-reactor-resilience4j")
 
    // Metrics
    implementation("io.micrometer:micrometer-registry-prometheus")
 
    // Redis for rate limiting (optional, comment out if not using RequestRateLimiter)
    // implementation("org.springframework.boot:spring-boot-starter-data-redis-reactive")
 
    testImplementation("org.springframework.boot:spring-boot-starter-test")
    testImplementation("io.projectreactor:reactor-test")
}
 
tasks.withType<Test> {
    useJUnitPlatform()
}

spring:
  application:
    name: bff-gateway
 
  cloud:
    gateway:
      # Global CORS configuration
      globalcors:
        corsConfigurations:
          '[/**]':
            allowedOrigins:
              - "http://localhost:4200"   # Angular dev server
              - "https://app.example.com"
            allowedMethods: [GET, POST, PUT, DELETE, OPTIONS]
            allowedHeaders: ["*"]
            allowCredentials: true
            maxAge: 3600
 
      # Route definitions
      routes:
        # User service route
        - id: user-service
          uri: lb://user-service       # load-balanced via Spring Cloud LoadBalancer
          predicates:
            - Path=/api/users/**
          filters:
            - StripPrefix=1            # removes /api before forwarding
            - TokenRelay=              # forwards OAuth2 access token to downstream
            - name: CircuitBreaker
              args:
                name: userServiceCB
                fallbackUri: forward:/fallback/users
            - name: Retry
              args:
                retries: 3
                statuses: BAD_GATEWAY,SERVICE_UNAVAILABLE
 
        # Order service route
        - id: order-service
          uri: lb://order-service
          predicates:
            - Path=/api/orders/**
          filters:
            - StripPrefix=1
            - TokenRelay=
            - name: CircuitBreaker
              args:
                name: orderServiceCB
                fallbackUri: forward:/fallback/orders
 
        # BFF aggregation endpoint — handled by a local controller
        - id: dashboard-aggregate
          uri: http://localhost:${server.port}   # self-referencing for local controllers
          predicates:
            - Path=/api/dashboard/**
          filters:
            - TokenRelay=
 
  # OAuth2 resource server — validate JWTs from upstream IdP
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://idp.example.com
 
server:
  port: 8080
 
management:
  endpoints:
    web:
      exposure:
        include: health, info, prometheus, gateway
  endpoint:
    health:
      show-details: always
    gateway:
      enabled: true     # exposes /actuator/gateway/routes etc.
  health:
    circuitbreakers:
      enabled: true
 
logging:
  level:
    org.springframework.cloud.gateway: DEBUG  # remove in production
    reactor.netty: INFO

package com.example.bff.filter;
 
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;
 
import java.util.UUID;
 
/**
 * GlobalFilter that:
 *  - PRE:  injects a correlation ID into the request (X-Correlation-Id header)
 *  - POST: echoes the correlation ID back in the response header
 *
 * Runs before all route-specific filters (order = -1).
 */
@Component
public class CorrelationIdGlobalFilter implements GlobalFilter, Ordered {
 
    private static final Logger log = LoggerFactory.getLogger(CorrelationIdGlobalFilter.class);
    private static final String CORRELATION_ID_HEADER = "X-Correlation-Id";
 
    @Override
    public int getOrder() {
        // Negative order = runs before most other filters.
        // Use Ordered.HIGHEST_PRECEDENCE for absolute first position.
        return -1;
    }
 
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        // --- PRE-processing ---
        String correlationId = exchange.getRequest().getHeaders()
                .getFirst(CORRELATION_ID_HEADER);
 
        if (correlationId == null || correlationId.isBlank()) {
            correlationId = UUID.randomUUID().toString();
        }
 
        log.debug("Request [{}] {} {}",
                correlationId,
                exchange.getRequest().getMethod(),
                exchange.getRequest().getURI().getPath());
 
        // Mutate request to add correlation ID (request is immutable, must use mutate())
        final String finalCorrelationId = correlationId;
        ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
                .header(CORRELATION_ID_HEADER, finalCorrelationId)
                .build();
 
        // Store in exchange attributes for downstream filters to read
        exchange.getAttributes().put(CORRELATION_ID_HEADER, finalCorrelationId);
 
        // Build a mutated exchange with the new request
        ServerWebExchange mutatedExchange = exchange.mutate()
                .request(mutatedRequest)
                .build();
 
        // --- Continue filter chain, then POST-processing ---
        return chain.filter(mutatedExchange)
                .then(Mono.fromRunnable(() -> {
                    // POST: runs after the downstream response is received
                    ServerHttpResponse response = mutatedExchange.getResponse();
                    response.getHeaders().add(CORRELATION_ID_HEADER, finalCorrelationId);
 
                    log.debug("Response [{}] status={}",
                            finalCorrelationId,
                            response.getStatusCode());
                }));
    }
}

package com.example.bff.aggregation;
 
import org.springframework.stereotype.Service;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.core.publisher.Mono;
 
import java.time.Duration;
import java.util.List;
 
/**
 * BFF aggregation service: calls User Service and Order Service in parallel,
 * merges the results into a single DashboardResponse.
 */
@Service
public class DashboardAggregationService {
 
    private final WebClient userServiceClient;
    private final WebClient orderServiceClient;
 
    public DashboardAggregationService(WebClient.Builder webClientBuilder) {
        // In production, use Spring Cloud LoadBalancer: "lb://user-service"
        this.userServiceClient = webClientBuilder
                .baseUrl("http://user-service")
                .build();
        this.orderServiceClient = webClientBuilder
                .baseUrl("http://order-service")
                .build();
    }
 
    /**
     * Aggregates user profile + recent orders into a single response.
     * Both downstream calls happen in PARALLEL; total latency ≈ max(t1, t2).
     */
    public Mono<DashboardResponse> getDashboard(String userId, String bearerToken) {
 
        Mono<UserProfile> userProfileMono = fetchUserProfile(userId, bearerToken)
                .timeout(Duration.ofSeconds(3))
                .onErrorResume(ex -> {
                    // graceful degradation: return a minimal profile on failure
                    return Mono.just(UserProfile.empty(userId));
                });
 
        Mono<List<Order>> recentOrdersMono = fetchRecentOrders(userId, bearerToken)
                .timeout(Duration.ofSeconds(3))
                .onErrorResume(ex -> {
                    // graceful degradation: return empty order list on failure
                    return Mono.just(List.of());
                });
 
        // Mono.zip subscribes to BOTH monos simultaneously.
        // When BOTH complete, the combinator function is called with their results.
        return Mono.zip(userProfileMono, recentOrdersMono)
                .map(tuple -> DashboardResponse.builder()
                        .userId(userId)
                        .user(tuple.getT1())      // result of userProfileMono
                        .orders(tuple.getT2())    // result of recentOrdersMono
                        .build());
    }
 
    private Mono<UserProfile> fetchUserProfile(String userId, String token) {
        return userServiceClient.get()
                .uri("/users/{id}", userId)
                .headers(h -> h.setBearerAuth(token))
                .retrieve()
                .bodyToMono(UserProfile.class);
    }
 
    private Mono<List<Order>> fetchRecentOrders(String userId, String token) {
        return orderServiceClient.get()
                .uri(uriBuilder -> uriBuilder
                        .path("/orders")
                        .queryParam("userId", userId)
                        .queryParam("limit", 10)
                        .build())
                .headers(h -> h.setBearerAuth(token))
                .retrieve()
                .bodyToFlux(Order.class)
                .collectList();
    }
 
    // DTO stubs (would be in separate files in production)
    public record UserProfile(String id, String name, String email) {
        public static UserProfile empty(String id) {
            return new UserProfile(id, "Unknown", "");
        }
    }
 
    public record Order(String orderId, String status, double total) {}
 
    public record DashboardResponse(String userId, UserProfile user, List<Order> orders) {
        public static Builder builder() { return new Builder(); }
 
        public static class Builder {
            private String userId;
            private UserProfile user;
            private List<Order> orders;
 
            public Builder userId(String v) { this.userId = v; return this; }
            public Builder user(UserProfile v) { this.user = v; return this; }
            public Builder orders(List<Order> v) { this.orders = v; return this; }
            public DashboardResponse build() {
                return new DashboardResponse(userId, user, orders);
            }
        }
    }
}