Where do request responsibilities belong?

Goal & mental model verified

DispatcherServlet delegates request mapping and invocation to MVC components. Validation checks request constraints. Error handling can produce ProblemDetail responses rather than leaking internal exception representations.

Worked example · design exercise synthesis

POST /quotes accepts a validated request DTO. The service enforces business eligibility; the repository persists. A validation failure returns a stable client error, while an internal failure gets a traceable sanitized response.

Engineering decision synthesis

Keep controllers focused on transport and services on use-case policy. DTOs decouple API shapes from persistence; the additional mapping is an intentional boundary cost.

Pitfall & diagnosis synthesis

Bean Validation cannot prove business eligibility or authorization. Returning persistence entities can expose fields and trigger unexpected serialization-time loads.

Improve & validate synthesis

Exercise malformed input, missing access and failure responses with HTTP tests. Keep stable problem types and correlate internal diagnostics without returning stack traces.