// ✅ Good：意圖清晰、命名有意義、職責單一
public class TransferService {
    
    private final AccountRepository accountRepository;
    private final TransactionLogger transactionLogger;
    
    /**
     * 執行帳戶間轉帳
     * @param fromAccountId 轉出帳號
     * @param toAccountId 轉入帳號
     * @param amount 金額（必須大於零）
     * @throws InsufficientFundsException 餘額不足時拋出
     */
    public TransferResult transfer(String fromAccountId, String toAccountId, BigDecimal amount) {
        validateAmount(amount);
        
        Account fromAccount = accountRepository.findById(fromAccountId)
            .orElseThrow(() -> new AccountNotFoundException(fromAccountId));
        Account toAccount = accountRepository.findById(toAccountId)
            .orElseThrow(() -> new AccountNotFoundException(toAccountId));
        
        fromAccount.debit(amount);
        toAccount.credit(amount);
        
        accountRepository.save(fromAccount);
        accountRepository.save(toAccount);
        
        transactionLogger.log(fromAccountId, toAccountId, amount);
        
        return TransferResult.success(fromAccountId, toAccountId, amount);
    }
    
    private void validateAmount(BigDecimal amount) {
        if (amount == null || amount.compareTo(BigDecimal.ZERO) <= 0) {
            throw new InvalidAmountException("轉帳金額必須大於零");
        }
    }
}

// ❌ Bad：命名模糊、邏輯混亂、沒有校驗
public class Svc {
    public void doIt(String a, String b, double amt) {
        // 直接操作 DB，沒有交易控制
        db.execute("UPDATE account SET balance = balance - " + amt + " WHERE id = '" + a + "'");
        db.execute("UPDATE account SET balance = balance + " + amt + " WHERE id = '" + b + "'");
    }
}

// ❌ Bad：巢狀太深、命名不清
public void proc(List<Map<String, Object>> d) {
    for (Map<String, Object> m : d) {
        if (m.get("type") != null) {
            if (m.get("type").equals("A")) {
                if (m.get("status") != null) {
                    if (m.get("status").equals("1")) {
                        // 處理邏輯...
                    }
                }
            }
        }
    }
}

// ✅ Good：Early Return + 有意義命名 + Guard Clause
public void processTransactions(List<Transaction> transactions) {
    for (Transaction transaction : transactions) {
        if (!transaction.isTypeA()) {
            continue;
        }
        if (!transaction.isActive()) {
            continue;
        }
        processActiveTypeATransaction(transaction);
    }
}

private void processActiveTypeATransaction(Transaction transaction) {
    // 處理邏輯...
}

// ❌ Bad：違反 SRP，一個類別包辦帳務、通知、報表
public class AccountManager {
    public void createAccount(AccountDto dto) { /* ... */ }
    public void sendEmail(String to, String body) { /* ... */ }
    public void generateReport(Date from, Date to) { /* ... */ }
    public void calculateInterest(String accountId) { /* ... */ }
}

// ✅ Good：職責分離
public class AccountService {
    public void createAccount(AccountDto dto) { /* ... */ }
    public void calculateInterest(String accountId) { /* ... */ }
}

public class NotificationService {
    public void sendEmail(String to, String body) { /* ... */ }
}

public class ReportService {
    public void generateReport(Date from, Date to) { /* ... */ }
}

// ❌ Bad：在方法內部直接 new 依賴，無法 Mock
public class OrderService {
    public void placeOrder(OrderDto dto) {
        // 直接 new，無法替換
        EmailService emailService = new EmailService();
        PaymentGateway gateway = new PaymentGateway();
        
        gateway.charge(dto.getAmount());
        emailService.send(dto.getEmail(), "訂單成功");
    }
}

// ✅ Good：依賴注入，可輕鬆 Mock
@Service
public class OrderService {
    
    private final EmailService emailService;
    private final PaymentGateway paymentGateway;
    
    // 建構子注入
    public OrderService(EmailService emailService, PaymentGateway paymentGateway) {
        this.emailService = emailService;
        this.paymentGateway = paymentGateway;
    }
    
    public void placeOrder(OrderDto dto) {
        paymentGateway.charge(dto.getAmount());
        emailService.send(dto.getEmail(), "訂單成功");
    }
}

// ✅ 對應的測試
@ExtendWith(MockitoExtension.class)
class OrderServiceTest {
    
    @Mock
    private EmailService emailService;
    
    @Mock
    private PaymentGateway paymentGateway;
    
    @InjectMocks
    private OrderService orderService;
    
    @Test
    void placeOrder_shouldChargeAndSendEmail() {
        OrderDto dto = new OrderDto("user@bank.com", BigDecimal.valueOf(1000));
        
        orderService.placeOrder(dto);
        
        verify(paymentGateway).charge(BigDecimal.valueOf(1000));
        verify(emailService).send("user@bank.com", "訂單成功");
    }
}

// ❌ Bad：N+1 Query 問題
public List<OrderDetailDto> getOrders(List<String> orderIds) {
    List<OrderDetailDto> results = new ArrayList<>();
    for (String orderId : orderIds) {
        // 每筆訂單都查一次 DB（N+1）
        Order order = orderRepository.findById(orderId).orElse(null);
        if (order != null) {
            results.add(toDto(order));
        }
    }
    return results;
}

// ✅ Good：批次查詢
public List<OrderDetailDto> getOrders(List<String> orderIds) {
    return orderRepository.findAllById(orderIds)
        .stream()
        .map(this::toDto)
        .collect(Collectors.toList());
}

// ❌ Bad：SQL Injection（A05:2025 - Injection）
public User findUser(String username) {
    String sql = "SELECT * FROM users WHERE username = '" + username + "'";
    return jdbcTemplate.queryForObject(sql, User.class);
}

// ✅ Good：Parameterized Query
public User findUser(String username) {
    String sql = "SELECT * FROM users WHERE username = ?";
    return jdbcTemplate.queryForObject(sql, new Object[]{username}, userRowMapper);
}

// ✅ Better：使用 Spring Data JPA
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
}

// ❌ Bad：Hard-coded 設定、緊耦合
public class PaymentService {
    private static final String API_URL = "https://payment.bank.com/api/v1";
    private static final int TIMEOUT = 3000;
    
    public void pay(PaymentRequest request) {
        // 直接使用 HttpClient，無法切換實作
        HttpClient client = HttpClient.newHttpClient();
        // ...
    }
}

// ✅ Good：設定外部化 + 介面抽象
@ConfigurationProperties(prefix = "payment.gateway")
public class PaymentGatewayProperties {
    private String apiUrl;
    private int timeoutMs = 3000;
    // getters / setters
}

public interface PaymentGateway {
    PaymentResult pay(PaymentRequest request);
}

@Service
@Profile("production")
public class BankPaymentGateway implements PaymentGateway {
    
    private final PaymentGatewayProperties properties;
    private final RestTemplate restTemplate;
    
    public BankPaymentGateway(PaymentGatewayProperties properties, RestTemplate restTemplate) {
        this.properties = properties;
        this.restTemplate = restTemplate;
    }
    
    @Override
    public PaymentResult pay(PaymentRequest request) {
        return restTemplate.postForObject(
            properties.getApiUrl() + "/pay",
            request,
            PaymentResult.class
        );
    }
}

// ❌ Bad：一個方法做太多事
public TransactionResult processTransaction(TransactionRequest request) {
    // 驗證... (20行)
    // 查詢帳戶... (15行)
    // 計算手續費... (25行)
    // 執行轉帳... (20行)
    // 發送通知... (15行)
    // 產生報表... (10行)
    // 共 105 行
}

// ✅ Good：拆分為小方法
public TransactionResult processTransaction(TransactionRequest request) {
    validate(request);
    Account account = findAccount(request.getAccountId());
    BigDecimal fee = calculateFee(request);
    TransactionResult result = executeTransfer(account, request, fee);
    sendNotification(result);
    return result;
}

// ❌ Bad：什麼都做
public class BankingHelper {
    public void createAccount() { }
    public void transferMoney() { }
    public void sendSMS() { }
    public void generatePDF() { }
    public void calculateTax() { }
    public void syncExternalSystem() { }
    // ... 2000+ 行
}

// ✅ Good：按職責拆分
public class AccountService { /* 帳戶相關 */ }
public class TransferService { /* 轉帳相關 */ }
public class NotificationService { /* 通知相關 */ }
public class ReportService { /* 報表相關 */ }
public class TaxCalculationService { /* 稅務計算 */ }

// ❌ Bad
public void transfer(String fromAccount, String toAccount, double amount, String currency) {
    // fromAccount 格式是什麼？amount 可以是負數嗎？currency 有哪些？
}

// ✅ Good：使用 Value Object
public void transfer(AccountNumber from, AccountNumber to, Money amount) {
    // 型別安全，自帶校驗
}

public record AccountNumber(String value) {
    public AccountNumber {
        if (!value.matches("\\d{3}-\\d{2}-\\d{7}")) {
            throw new InvalidAccountNumberException(value);
        }
    }
}

public record Money(BigDecimal amount, Currency currency) {
    public Money {
        if (amount.compareTo(BigDecimal.ZERO) < 0) {
            throw new NegativeAmountException(amount);
        }
    }
}

// ❌ Bad：大量存取 account 的內部資料
public class TransactionValidator {
    public boolean isValid(Account account, BigDecimal amount) {
        return account.getBalance().subtract(account.getHoldAmount())
            .subtract(account.getPendingAmount())
            .compareTo(amount) >= 0
            && account.getStatus().equals("ACTIVE")
            && !account.isFrozen();
    }
}

// ✅ Good：邏輯放到資料所在的類別
public class Account {
    public boolean canWithdraw(BigDecimal amount) {
        BigDecimal available = balance.subtract(holdAmount).subtract(pendingAmount);
        return available.compareTo(amount) >= 0
            && "ACTIVE".equals(status)
            && !frozen;
    }
}

// ❌ Bad：多個 Controller 都有相同的日期驗證
// AccountController.java
if (startDate.isAfter(endDate)) {
    throw new BadRequestException("起始日不得大於結束日");
}

// TransactionController.java
if (startDate.isAfter(endDate)) {
    throw new BadRequestException("起始日不得大於結束日");
}

// ✅ Good：提取為共用方法或工具類
public class DateValidator {
    public static void validateRange(LocalDate startDate, LocalDate endDate) {
        if (startDate.isAfter(endDate)) {
            throw new BadRequestException("起始日不得大於結束日");
        }
    }
}

// ❌ Bad：startDate, endDate 總是一起出現
public List<Transaction> search(LocalDate startDate, LocalDate endDate, String accountId) { }
public BigDecimal summarize(LocalDate startDate, LocalDate endDate, String accountId) { }
public Report generate(LocalDate startDate, LocalDate endDate, String accountId) { }

// ✅ Good：封裝為物件
public record TransactionQuery(DateRange dateRange, AccountNumber accountId) { }
public record DateRange(LocalDate from, LocalDate to) { }

public List<Transaction> search(TransactionQuery query) { }
public BigDecimal summarize(TransactionQuery query) { }
public Report generate(TransactionQuery query) { }

// ❌ Bad
public void process() {
    return;
    System.out.println("永遠不會執行"); // Dead Code
}

// 或是被註解掉的舊程式碼
// public void oldMethod() { ... }  // TODO: 確認後刪除（已存在 3 年）

// ❌ Bad
// 檢查使用者是否有權限且帳戶是有效的且金額大於零
if (u.getR() == 1 && a.getS().equals("A") && amt > 0) { }

// ✅ Good：程式碼自己說話
if (user.hasTransferPermission() && account.isActive() && amount.isPositive()) { }

// ❌ Bad
if (account.getBalance().compareTo(new BigDecimal("50000")) > 0) {
    applyDiscount(0.15);
}

// ✅ Good
private static final BigDecimal VIP_THRESHOLD = new BigDecimal("50000");
private static final BigDecimal VIP_DISCOUNT_RATE = new BigDecimal("0.15");

if (account.getBalance().compareTo(VIP_THRESHOLD) > 0) {
    applyDiscount(VIP_DISCOUNT_RATE);
}

// ❌ Bad：只有一種實作卻建了抽象層
public interface DataProcessor { }
public abstract class AbstractDataProcessor implements DataProcessor { }
public class ConcreteDataProcessor extends AbstractDataProcessor { }
// 四年了仍然只有一種實作

// ❌ Bad
public BigDecimal calculateFee(String accountType, BigDecimal amount) {
    switch (accountType) {
        case "SAVINGS": return amount.multiply(new BigDecimal("0.001"));
        case "CHECKING": return amount.multiply(new BigDecimal("0.002"));
        case "VIP": return BigDecimal.ZERO;
        default: throw new IllegalArgumentException("Unknown type");
    }
}

// ✅ Good：使用多型
public interface FeeStrategy {
    BigDecimal calculate(BigDecimal amount);
}

public class SavingsFeeStrategy implements FeeStrategy {
    @Override
    public BigDecimal calculate(BigDecimal amount) {
        return amount.multiply(new BigDecimal("0.001"));
    }
}

// 使用 Map 或 Spring @Qualifier 注入

// ❌ Bad：幾乎所有方法都只是 delegate
public class AccountManager {
    private final AccountService service;
    
    public Account find(String id) { return service.find(id); }
    public void save(Account a) { service.save(a); }
    public void delete(String id) { service.delete(id); }
    // 沒有任何自己的邏輯
}

# sonar-project.properties（Java Spring Boot 專案）
sonar.projectKey=banking-core-system
sonar.projectName=Banking Core System
sonar.projectVersion=1.0

# 原始碼路徑
sonar.sources=src/main/java
sonar.tests=src/test/java
sonar.java.binaries=target/classes

# 排除規則（不掃描自動產生的程式碼）
sonar.exclusions=**/generated/**,**/dto/**/*Mapper.java

# 覆蓋率報告
sonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml

# 編碼
sonar.sourceEncoding=UTF-8

<!-- pom.xml -->
<build>
    <plugins>
        <!-- JaCoCo 覆蓋率 -->
        <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>0.8.12</version>
            <executions>
                <execution>
                    <goals>
                        <goal>prepare-agent</goal>
                    </goals>
                </execution>
                <execution>
                    <id>report</id>
                    <phase>test</phase>
                    <goals>
                        <goal>report</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>

# 執行掃描
mvn clean verify sonar:sonar \
  -Dsonar.host.url=https://sonarqube.company.com \
  -Dsonar.token=${SONAR_TOKEN}

// eslint.config.js（Vue 3 + TypeScript 專案）
import eslint from '@eslint/js';
import tseslint from 'typescript-eslint';
import pluginVue from 'eslint-plugin-vue';
import pluginSecurity from 'eslint-plugin-security';

export default tseslint.config(
  eslint.configs.recommended,
  ...tseslint.configs.recommended,
  ...pluginVue.configs['flat/recommended'],
  {
    files: ['**/*.{ts,vue}'],
    plugins: {
      security: pluginSecurity,
    },
    rules: {
      // 命名規範
      '@typescript-eslint/naming-convention': [
        'error',
        { selector: 'interface', format: ['PascalCase'] },
        { selector: 'class', format: ['PascalCase'] },
        { selector: 'variable', format: ['camelCase', 'UPPER_CASE'] },
      ],
      // 複雜度限制
      'complexity': ['error', { max: 10 }],
      'max-lines-per-function': ['warn', { max: 50 }],
      'max-depth': ['error', { max: 3 }],
      // 安全性
      'no-eval': 'error',
      'no-implied-eval': 'error',
    },
  },
);

<!-- pom.xml：PMD Plugin（使用 PMD 7.x 引擎） -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-pmd-plugin</artifactId>
    <version>3.24.0</version>
    <configuration>
        <rulesets>
            <ruleset>category/java/bestpractices.xml</ruleset>
            <ruleset>category/java/errorprone.xml</ruleset>
            <ruleset>category/java/security.xml</ruleset>
            <ruleset>category/java/performance.xml</ruleset>
        </rulesets>
        <failOnViolation>true</failOnViolation>
        <printFailingErrors>true</printFailingErrors>
    </configuration>
</plugin>

<!-- pom.xml：Checkstyle Plugin -->
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-checkstyle-plugin</artifactId>
    <version>3.4.0</version>
    <configuration>
        <configLocation>checkstyle.xml</configLocation>
        <failsOnError>true</failsOnError>
        <consoleOutput>true</consoleOutput>
    </configuration>
</plugin>

<!-- checkstyle.xml：企業級規則範例 -->
<?xml version="1.0"?>
<!DOCTYPE module PUBLIC
    "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN"
    "https://checkstyle.org/dtds/configuration_1_3.dtd">
<module name="Checker">
    <module name="TreeWalker">
        <!-- 命名規範 -->
        <module name="TypeName">
            <property name="format" value="^[A-Z][a-zA-Z0-9]+$"/>
        </module>
        <module name="MethodName">
            <property name="format" value="^[a-z][a-zA-Z0-9]+$"/>
        </module>
        <!-- 複雜度 -->
        <module name="CyclomaticComplexity">
            <property name="max" value="10"/>
        </module>
        <!-- 方法長度 -->
        <module name="MethodLength">
            <property name="max" value="30"/>
        </module>
        <!-- 類別長度 -->
        <module name="FileLength">
            <property name="max" value="500"/>
        </module>
        <!-- JavaDoc -->
        <module name="MissingJavadocMethod">
            <property name="scope" value="public"/>
        </module>
    </module>
</module>

<!-- pom.xml：SpotBugs Plugin -->
<plugin>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-maven-plugin</artifactId>
    <version>4.9.3.0</version>
    <configuration>
        <effort>Max</effort>
        <threshold>Medium</threshold>
        <failOnError>true</failOnError>
        <plugins>
            <!-- 安全性擴充：fb-contrib + find-sec-bugs -->
            <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <version>1.13.0</version>
            </plugin>
        </plugins>
    </configuration>
</plugin>

## 變更說明
<!-- 簡述此 PR 的目的 -->

## 變更類型
- [ ] 新功能（Feature）
- [ ] Bug 修復（Bugfix）
- [ ] 重構（Refactoring）
- [ ] 效能優化
- [ ] 安全性修復

## 關聯 Issue
<!-- Fixes #123 -->

## 測試
<!-- 說明測試方式 -->
- [ ] 新增單元測試
- [ ] 通過所有現有測試
- [ ] 手動測試（說明步驟）

## 安全性自檢
- [ ] 無敏感資料洩漏
- [ ] 無 SQL Injection 風險
- [ ] 權限控制正確

## Checklist
- [ ] 程式碼符合團隊規範
- [ ] JavaDoc 已更新
- [ ] SonarQube 掃描通過

# .github/workflows/quality-gate.yml
name: Quality Gate

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main, develop]

jobs:
  quality-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # SonarQube 需要完整歷史

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Cache Maven packages
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}

      # Step 1: 編譯
      - name: Build
        run: mvn clean compile -DskipTests

      # Step 2: 單元測試 + 覆蓋率
      - name: Unit Tests with Coverage
        run: mvn test jacoco:report

      # Step 3: Checkstyle
      - name: Checkstyle
        run: mvn checkstyle:check

      # Step 4: SpotBugs
      - name: SpotBugs
        run: mvn spotbugs:check

      # Step 5: PMD
      - name: PMD
        run: mvn pmd:check

      # Step 6: SonarQube 掃描
      - name: SonarQube Scan
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          mvn sonar:sonar \
            -Dsonar.host.url=${{ secrets.SONAR_URL }} \
            -Dsonar.token=${{ secrets.SONAR_TOKEN }}

      # Step 7: Quality Gate 檢查
      - name: SonarQube Quality Gate
        uses: sonarsource/sonarqube-quality-gate-action@master
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      # Step 8: OWASP Dependency Check
      - name: OWASP Dependency Check
        run: mvn org.owasp:dependency-check-maven:check

@ExtendWith(MockitoExtension.class)
class AccountServiceTest {

    @Mock
    private AccountRepository accountRepository;
    
    @InjectMocks
    private AccountService accountService;

    // ✅ Good：命名清楚表達測試意圖
    @Test
    @DisplayName("當帳戶餘額不足時，轉帳應拋出 InsufficientFundsException")
    void transfer_whenInsufficientBalance_shouldThrowException() {
        // Given
        Account fromAccount = Account.builder()
            .id("ACC-001")
            .balance(new BigDecimal("100"))
            .build();
        when(accountRepository.findById("ACC-001")).thenReturn(Optional.of(fromAccount));
        
        // When & Then
        assertThrows(InsufficientFundsException.class, () -> {
            accountService.transfer("ACC-001", "ACC-002", new BigDecimal("500"));
        });
    }

    @Test
    @DisplayName("當金額為零時，應拋出 InvalidAmountException")
    void transfer_whenAmountIsZero_shouldThrowInvalidAmountException() {
        // Given
        BigDecimal zeroAmount = BigDecimal.ZERO;
        
        // When & Then
        assertThrows(InvalidAmountException.class, () -> {
            accountService.transfer("ACC-001", "ACC-002", zeroAmount);
        });
    }

    @Test
    @DisplayName("正常轉帳應成功扣款並入帳")
    void transfer_withValidRequest_shouldDebitAndCredit() {
        // Given
        Account from = Account.builder().id("ACC-001").balance(new BigDecimal("1000")).build();
        Account to = Account.builder().id("ACC-002").balance(new BigDecimal("500")).build();
        
        when(accountRepository.findById("ACC-001")).thenReturn(Optional.of(from));
        when(accountRepository.findById("ACC-002")).thenReturn(Optional.of(to));
        
        // When
        accountService.transfer("ACC-001", "ACC-002", new BigDecimal("300"));
        
        // Then
        assertThat(from.getBalance()).isEqualByComparingTo(new BigDecimal("700"));
        assertThat(to.getBalance()).isEqualByComparingTo(new BigDecimal("800"));
        verify(accountRepository, times(2)).save(any(Account.class));
    }
}

// ❌ Bad：測試命名不清
@Test
void test1() { }

// ❌ Bad：沒有 Assert
@Test
void testTransfer() {
    accountService.transfer("A", "B", BigDecimal.TEN);
    // 沒有任何驗證...
}

// ❌ Bad：測試太大，同時驗證多件事
@Test
void testEverything() {
    // 測試建立 + 查詢 + 更新 + 刪除... 200 行
}

@SpringBootTest
@ActiveProfile("test")
@Transactional // 測試後自動 Rollback
class AccountIntegrationTest {

    @Autowired
    private AccountService accountService;
    
    @Autowired
    private AccountRepository accountRepository;

    @Test
    @DisplayName("完整轉帳流程：從建立帳戶到轉帳成功")
    void fullTransferFlow() {
        // Given：建立兩個帳戶
        Account sender = accountRepository.save(
            Account.builder().balance(new BigDecimal("10000")).build()
        );
        Account receiver = accountRepository.save(
            Account.builder().balance(new BigDecimal("5000")).build()
        );
        
        // When：執行轉帳
        TransferResult result = accountService.transfer(
            sender.getId(), receiver.getId(), new BigDecimal("3000")
        );
        
        // Then：驗證結果
        assertThat(result.isSuccess()).isTrue();
        
        Account updatedSender = accountRepository.findById(sender.getId()).orElseThrow();
        Account updatedReceiver = accountRepository.findById(receiver.getId()).orElseThrow();
        
        assertThat(updatedSender.getBalance()).isEqualByComparingTo(new BigDecimal("7000"));
        assertThat(updatedReceiver.getBalance()).isEqualByComparingTo(new BigDecimal("8000"));
    }
}

@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@ActiveProfile("test")
class AccountApiIntegrationTest {

    @Autowired
    private TestRestTemplate restTemplate;

    @Test
    @DisplayName("POST /api/transfers 應成功回傳 200")
    void createTransfer_withValidRequest_shouldReturn200() {
        // Given
        TransferRequest request = new TransferRequest("ACC-001", "ACC-002", new BigDecimal("100"));
        
        // When
        ResponseEntity<TransferResult> response = restTemplate.postForEntity(
            "/api/transfers", request, TransferResult.class
        );
        
        // Then
        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
        assertThat(response.getBody().isSuccess()).isTrue();
    }
}

// ✅ Coverage = 100%，但測試品質很差
@Test
void testGetBalance() {
    Account account = new Account();
    account.setBalance(new BigDecimal("100"));
    account.getBalance(); // 呼叫了但沒有驗證！
    // 覆蓋率 100%，但什麼都沒測到
}

// Before（60 行的方法）
public void processPayroll(List<Employee> employees) {
    for (Employee emp : employees) {
        // 計算基本薪資（15行）
        BigDecimal baseSalary = emp.getGrade().getBaseSalary();
        // ... 複雜計算
        
        // 計算加班費（10行）
        BigDecimal overtime = calculateOvertimeHours(emp) 
            .multiply(emp.getHourlyRate())
            .multiply(new BigDecimal("1.5"));
        
        // 計算扣除額（15行）
        BigDecimal deductions = calculateTax(baseSalary.add(overtime))
            .add(calculateInsurance(emp))
            .add(calculatePension(emp));
        
        // 發放薪資（10行）
        BigDecimal netSalary = baseSalary.add(overtime).subtract(deductions);
        payrollRepository.save(new PayrollRecord(emp, netSalary));
        notificationService.sendPayslip(emp, netSalary);
    }
}

// After：清晰的高層抽象
public void processPayroll(List<Employee> employees) {
    for (Employee emp : employees) {
        BigDecimal baseSalary = calculateBaseSalary(emp);
        BigDecimal overtime = calculateOvertime(emp);
        BigDecimal deductions = calculateDeductions(emp, baseSalary, overtime);
        BigDecimal netSalary = baseSalary.add(overtime).subtract(deductions);
        
        saveAndNotify(emp, netSalary);
    }
}

// Before
public BigDecimal calculateInterest(Account account) {
    switch (account.getType()) {
        case SAVINGS:
            return account.getBalance().multiply(new BigDecimal("0.02"));
        case CHECKING:
            return account.getBalance().multiply(new BigDecimal("0.005"));
        case FIXED_DEPOSIT:
            return account.getBalance()
                .multiply(new BigDecimal("0.04"))
                .multiply(BigDecimal.valueOf(account.getTermInYears()));
        default:
            return BigDecimal.ZERO;
    }
}

// After：使用策略模式
public interface InterestCalculator {
    BigDecimal calculate(Account account);
}

@Component("SAVINGS")
public class SavingsInterestCalculator implements InterestCalculator {
    private static final BigDecimal RATE = new BigDecimal("0.02");
    
    @Override
    public BigDecimal calculate(Account account) {
        return account.getBalance().multiply(RATE);
    }
}

@Service
public class InterestService {
    private final Map<String, InterestCalculator> calculators;
    
    public InterestService(Map<String, InterestCalculator> calculators) {
        this.calculators = calculators;
    }
    
    public BigDecimal calculateInterest(Account account) {
        return calculators.getOrDefault(account.getType().name(), a -> BigDecimal.ZERO)
            .calculate(account);
    }
}

// Before：過多參數
public List<Transaction> search(String accountId, LocalDate from, LocalDate to,
        String type, BigDecimal minAmount, BigDecimal maxAmount, int page, int size) { }

// After
public record TransactionSearchCriteria(
    String accountId,
    DateRange dateRange,
    String type,
    AmountRange amountRange,
    Pageable pageable
) { }

public List<Transaction> search(TransactionSearchCriteria criteria) { }

// Before
if (retryCount > 3) { Thread.sleep(5000); }

// After
private static final int MAX_RETRY_COUNT = 3;
private static final long RETRY_DELAY_MS = 5000L;

if (retryCount > MAX_RETRY_COUNT) { Thread.sleep(RETRY_DELAY_MS); }

// 核心業務規則使用 Property-Based Testing
@Property
void transferShouldPreserveTotalBalance(
        @ForAll @BigRange(min = "0", max = "999999999") BigDecimal initialFromBalance,
        @ForAll @BigRange(min = "0", max = "999999999") BigDecimal initialToBalance,
        @ForAll @BigRange(min = "1", max = "999999999") BigDecimal transferAmount) {
    
    // 假設：轉出帳戶餘額足夠
    Assume.that(initialFromBalance.compareTo(transferAmount) >= 0);
    
    Account from = Account.withBalance(initialFromBalance);
    Account to = Account.withBalance(initialToBalance);
    BigDecimal totalBefore = from.getBalance().add(to.getBalance());
    
    // 執行轉帳
    from.debit(transferAmount);
    to.credit(transferAmount);
    
    BigDecimal totalAfter = from.getBalance().add(to.getBalance());
    
    // 斷言：總金額不變（守恆定律）
    assertThat(totalAfter).isEqualByComparingTo(totalBefore);
}

// Consumer 端（呼叫方）
@Pact(consumer = "transaction-service", provider = "account-service")
public V4Pact getAccountBalance(PactDslWithProvider builder) {
    return builder
        .given("Account ACC-001 exists with balance 10000")
        .uponReceiving("a request to get account balance")
            .path("/api/accounts/ACC-001/balance")
            .method("GET")
        .willRespondWith()
            .status(200)
            .body(newJsonBody(body -> {
                body.stringType("accountId", "ACC-001");
                body.decimalType("balance", 10000.00);
            }).build())
        .toPact(V4Pact.class);
}

@Test
@PactTestFor(pactMethod = "getAccountBalance")
void testGetAccountBalance(MockServer mockServer) {
    AccountClient client = new AccountClient(mockServer.getUrl());
    AccountBalance balance = client.getBalance("ACC-001");
    
    assertThat(balance.getAccountId()).isEqualTo("ACC-001");
    assertThat(balance.getBalance()).isEqualByComparingTo(new BigDecimal("10000"));
}

<!-- pom.xml -->
<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>11.0.1</version>
    <configuration>
        <failBuildOnCVSS>7</failBuildOnCVSS>
        <suppressionFiles>
            <suppressionFile>owasp-suppressions.xml</suppressionFile>
        </suppressionFiles>
    </configuration>
</plugin>