A full-featured RESTful API backend for a food ordering platform built with Spring Boot 3.5 and Java 21. Khaddo supports multi-role user management, menu browsing, cart management, order processing, online payments, and real-time notifications.
Frontend: github.com/abdulazizzisan/Khaddo-Frontend
| Category | Technology |
|---|---|
| Language | Java 21 |
| Framework | Spring Boot 3.5.5 |
| Security | Spring Security, JWT (jjwt 0.13), BCrypt |
| Database | PostgreSQL |
| ORM | Spring Data JPA / Hibernate |
| Payment Gateway | SSLCommerz |
| Cloud Storage | AWS S3 |
| Spring Boot Mail + Thymeleaf Templates | |
| API Documentation | Swagger / OpenAPI 3 (springdoc 2.8) |
| Object Mapping | ModelMapper 3.2 |
| Build Tool | Maven |
| Containerization | Docker Compose |
spring-boot-starter-webspring-boot-starter-data-jpaspring-boot-starter-securityspring-boot-starter-mailspring-boot-starter-validationspring-boot-starter-thymeleaf
Controller Layer → Service Layer → Repository Layer
↓ ↓ ↓
DTOs / Validation Business Logic JPA / PostgreSQL
- Package-by-feature modular structure (
auth_users,menu,order,carts,payment,review,category,role,email_notification) - DTO Pattern — entities are never exposed directly via API responses
- Generic Response Wrapper (
Response<T>) for consistent API response structure - Service Interface + Implementation pattern for all business logic
- Global Exception Handling via
@RestControllerAdvice
- JWT-based stateless authentication with 30-day token expiry
- Role-based access control (
ADMIN,USER) via Spring Security - BCrypt password encoding
- Public, authenticated, and admin-only endpoint segregation
- Custom
AuthenticationEntryPointandAccessDeniedHandlerfor structured error responses
- Registration with role assignment and input validation
- Login with JWT token generation
- Profile update with image upload to AWS S3
- Account deactivation with email confirmation
- Admin dashboard for viewing all users
- Full CRUD for menu items (admin-only creation, update, deletion)
- Dynamic filtering using JPA Specifications (by category, search by name/description)
- Menu image upload/delete via AWS S3
- Each menu item linked to a category with customer reviews
- Per-user cart with add, increment, decrement, and remove item operations
- Automatic subtotal calculation per item
- Cart clearing on checkout
- Cart created on-demand when first item is added
- One-click checkout converting cart items to a confirmed order
- Order status lifecycle:
INITIALIZED → CONFIRMED → ON_THE_WAY → DELIVERED(orCANCELLED / FAILED) - Paginated order listing for admins with optional status filtering
- Order history for users (sorted by date, descending)
- Unique customer count metric for admin analytics
- Order confirmation email with itemized summary and payment link (Thymeleaf HTML template)
- Full SSLCommerz sandbox payment gateway integration
- Payment initialization with order validation
- IPN (Instant Payment Notification) webhook handler
- Server-side payment validation via SSLCommerz validation API
- Automated success/failure email notifications via Thymeleaf templates
- Payment tracking with status:
PENDING → PROCESSING → COMPLETED / FAILED / REFUNDED
- Authenticated users can review menu items for delivered orders
- Duplicate review prevention per user + menu + order combination
- Average rating calculation per menu item
- Reviews sorted by newest first
- Full CRUD for food categories (admin-only modifications)
- Public read access for menu browsing
- Admin-only CRUD for user roles
- Dynamic role assignment during registration
- Asynchronous email delivery (
@Async) viaJavaMailSender - HTML email templates rendered with Thymeleaf (
order-confirmation,payment-success,payment-failed) - Notification persistence to database for audit trail
- Fully annotated Swagger / OpenAPI 3 documentation
- Interactive Swagger UI with JWT bearer token support
- Accessible at
/swagger-ui.htmland/api/docs
| Module | Method | Endpoint | Access |
|---|---|---|---|
| Auth | POST |
/api/auth/register |
Public |
POST |
/api/auth/login |
Public | |
| Users | GET |
/api/users/account |
Authenticated |
PUT |
/api/users/update |
Authenticated | |
DELETE |
/api/users/deactivate |
Authenticated | |
GET |
/api/users/all |
Admin | |
| Menu | GET |
/api/menu |
Public |
GET |
/api/menu/{id} |
Public | |
POST |
/api/menu |
Admin | |
PUT |
/api/menu/{id} |
Admin | |
DELETE |
/api/menu/{id} |
Admin | |
| Categories | GET |
/api/categories |
Public |
POST / PUT / DELETE |
/api/categories |
Admin | |
| Cart | GET |
/api/cart |
Authenticated |
POST |
/api/cart/items |
Authenticated | |
PUT |
/api/cart/items/increment/{menuId} |
Authenticated | |
PUT |
/api/cart/items/decrement/{menuId} |
Authenticated | |
DELETE |
/api/cart/items/{cartItemId} |
Authenticated | |
| Orders | POST |
/api/orders/checkout |
User |
GET |
/api/orders/my-orders |
Authenticated | |
GET |
/api/orders/all |
Admin | |
PUT |
/api/orders/update |
Admin | |
| Reviews | POST |
/api/reviews |
Authenticated |
GET |
/api/reviews/menu-item/{menuId} |
Public | |
GET |
/api/reviews/menu-item/rating/{menuId} |
Public | |
| Payments | POST |
/api/payments/pay |
Authenticated |
POST |
/api/payments/sslcommerz-ipn |
Webhook | |
GET |
/api/payments/all |
Admin | |
| Roles | GET / POST / PUT / DELETE |
/api/roles |
Admin |
User ──┐
├── @ManyToMany ────── Role
├── @OneToOne ──────── Cart ──→ CartItem ──→ Menu
├── @OneToMany ─────── Order ──→ OrderItem ──→ Menu
├── @OneToMany ─────── Review ──→ Menu
└── @OneToMany ─────── Payment ──→ Order
Category ──→ Menu ──→ Review
- Layered Architecture — strict separation of controllers, services, and repositories
- DTO Pattern — request/response objects decoupled from JPA entities
- Generic Response Wrapper —
Response<T>with status code, message, data, and metadata - Global Exception Handling — centralized error handling with custom exception classes
- Service Interface Segregation — interfaces for all service layers
- Asynchronous Processing —
@Asyncemail notifications - Transaction Management —
@Transactionalon critical operations (cart, checkout, review) - Builder Pattern — Lombok
@Builderon entities and DTOs - Input Validation — Bean Validation (Jakarta) on all request DTOs
- SLF4J Logging — structured logging across all service classes
- Java 21+
- Maven 3.9+
- Docker (for PostgreSQL)
- AWS S3 bucket (for image storage)
- SSLCommerz sandbox account (for payments)
docker compose up -dThis starts a PostgreSQL instance on port 5437 with database fooddb.
Set the following in src/main/resources/application.properties:
# Database
spring.datasource.url=jdbc:postgresql://localhost:5437/fooddb
spring.datasource.username=zisan
spring.datasource.password=zisan
# JWT
secrets.jwt.string=<your-jwt-secret>
# AWS S3
aws.access_key_id=<your-access-key>
aws.secret_key=<your-secret-key>
aws.s3.bucket=<your-bucket-name>
aws.s3.region=<your-region>
# Mail
spring.mail.host=<smtp-host>
spring.mail.port=<smtp-port>
spring.mail.username=<email>
spring.mail.password=<email-password>
# SSLCommerz
sslcommerze.store.id=<store-id>
sslcommerze.store.password=<store-password>./mvnw spring-boot:runThe API will be available at http://localhost:8080 and Swagger UI at http://localhost:8080/swagger-ui.html.
src/main/java/com/kolu/FoodApp/
├── auth_users/ # Authentication, user registration, login, profile
│ ├── controller/
│ ├── service/
│ ├── repository/
│ ├── dto/
│ └── entity/
├── role/ # Role management (admin)
├── category/ # Food category management
├── menu/ # Menu items CRUD + search/filter
├── carts/ # Shopping cart operations
├── order/ # Order placement & tracking
├── review/ # Menu item reviews & ratings
├── payment/ # SSLCommerz payment integration
├── email_notification/ # Async email service with persistence
├── aws/ # AWS S3 configuration & service
├── security/ # JWT, SecurityConfig, filters, CORS
├── config/ # ModelMapper, RestTemplate beans
├── swagger/ # OpenAPI JWT bearer config
├── enums/ # OrderStatus, PaymentStatus, etc.
├── exception/ # Custom exceptions & global handler
└── response/ # Generic Response<T> wrapper