Dev Log: June 16 Wrap-up

Today felt like one of those 'infrastructure' days. You know the ones—where you don't actually build a flashy new feature, but you spend eight hours making sure the foundation isn't made of sand. I spent most of my time in the guts of the e-commerce backend, specifically around how we handle multiple tenants and keep things secure.

The Jump to Java 21

First things first: I decided to bump the project from Java 17 to Java 21. Since this is a fresh build, there’s really no reason not to be on the latest LTS. I updated the POM and the README to reflect that. It’s a small change, but it keeps us modern and opens the door for better performance and some of the newer language features down the road.

Multi-Tenancy Foundation

I spent a good chunk of the afternoon working on how we're going to handle multi-tenancy. This is always a bit of a puzzle because you want it to be seamless for the developers writing the business logic.

I implemented a tenant-based request interceptor that captures the context early in the request lifecycle. The idea is that the frontend can pass a specific header—or even use a path variable for SEO-friendly public links—and we'll automatically scope the data to that tenant.

// A simplified look at how I'm capturing the tenant context
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
    String tenantId = request.getHeader("X-Tenant-ID");
    
    if (tenantId != null && !tenantId.isEmpty()) {
        // Store it in a thread-local context for the services to use
        TenantContext.setCurrentTenant(tenantId);
        return true;
    }
    
    // If no header, we might check the URL path or just fail fast
    return handleMissingTenant(request, response);
}

It took a bit of fiddling with the WebMvcConfig to make sure the interceptor was hitting the right patterns without breaking static resources, but it's humming along now. Setting this up early is going to save us a massive headache later when we start adding complex catalog and checkout logic.

Security and Documentation Cleanup

I also synced up some security configurations. We’re using ephemeral RSA-2048 key pairs that get generated on startup. The public key is exposed so clients can encrypt sensitive data (like passwords) before they even send them over the wire. It’s an extra layer of defense that I really like.

I did have a bit of a "facepalm" moment today. I realized I’d left some absolute file paths from my local machine in the documentation—literally file:///home/user/... links. Embarrassing, but easily fixed. I spent some time converting those to relative paths and fleshed out the integration guides. If the frontend team is going to use this thing, they need to know how the auth and tenant scoping actually work without having to read my mind.

Wrapping Up

Overall, a solid day. The repo feels a lot cleaner, the docs actually make sense, and the core architecture is starting to take a real shape. Tomorrow I'll probably start looking at the actual entity partitioning now that the interceptor is in place. Catch you later.