First, you need to add the right Bean Validation dependency to your project, as follows:

<dependencies>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.hamcrest</groupId>
            <artifactId>hamcrest-core</artifactId>
            <version>1.3</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>8.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.hibernate.validator</groupId>
            <artifactId>hibernate-validator</artifactId>
            <version>6.0.8.Final</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish</groupId>
            <artifactId>javax.el</artifactId>
            <version>3.0.1-b10</version>
        </dependency>
</dependencies>

public class User {

    @NotBlank
    private String name;

    @Email
    private String email;

    @NotEmpty
 private List<@PositiveOrZero Integer> profileId;

    public User(String name, String email, List<Integer> profileId) {
        this.name = name;
        this.email = email;
        this.profileId = profileId;
    }
}

public class UserTest {

    private static Validator validator;

    @BeforeClass
    public static void setUpClass() {
        validator = Validation.buildDefaultValidatorFactory()
        .getValidator();
    }

    @Test
    public void validUser() {
        User user = new User(
            "elder", 
            "[email protected]", 
            asList(1,2));

            Set<ConstraintViolation<User>> cv = validator
            .validate(user);
            assertTrue(cv.isEmpty());
    }

    @Test
    public void invalidName() {
        User user = new User(
            "", 
            "[email protected]", 
            asList(1,2));

            Set<ConstraintViolation<User>> cv = validator
            .validate(user);
            assertEquals(1, cv.size());
    }

    @Test
    public void invalidEmail() {
        User user = new User(
        "elder", 
        "elder-eldermoraes_com", 
        asList(1,2));

        Set<ConstraintViolation<User>> cv = validator
        .validate(user);
        assertEquals(1, cv.size());
    } 

    @Test
    public void invalidId() {
        User user = new User(
            "elder", 
            "[email protected]", 
            asList(-1,-2,1,2));

            Set<ConstraintViolation<User>> cv = validator
            .validate(user);
            assertEquals(2, cv.size());
    } 
}

Our User class uses three of the new constraints introduced by Bean Validation 2.0:

Then we create a test class (using JUnit) to test our validations. It first instantiates Validator:

@BeforeClass
public static void setUpClass() {
    validator = Validation.buildDefaultValidatorFactory().getValidator();
}

Validator is an API that validates beans according to the constraints defined for them.

Our first test method tests a valid user, which is a User object that has:

User user = new User(
   "elder", 
   "[email protected]", 
   asList(1,2));

And finally, the validation:

Set<ConstraintViolation<User>> cv = validator.validate(user);

The validate() method from Validator returns a set of constraint violations found, if any, or an empty set if there are no violations at all.

So, for a valid user it should return an empty set:

assertTrue(cv.isEmpty());

And the other methods work with variations around this model:

Note that the invalidId() method adds two negative numbers to the list:

asList(-1,-2,1,2));

So, we expect two constraint violations:

assertEquals(2, cv.size());

In other words, Validator checks not only the constraints violated, but how many times they are violated.

First, you need to add the right CDI 2.0 dependency to your project. To make things easier at this point, we are going to use CDI SE, the dependency that allows you to use CDI without a Java EE server:

<dependency>
    <groupId>org.jboss.weld.se</groupId>
    <artifactId>weld-se-shaded</artifactId>
    <version>3.0.0.Final</version>
</dependency>

This recipe will show you one of the main features introduced by CDI 2.0: Ordered Observers. Now, you can turn the observers job into something predictable:

public class MyEvent {

    private final String value;

    public MyEvent(String value){
        this.value = value;
    }

    public String getValue(){
        return value;
    }
}

public class OrderedObserver {

    public static void main(String[] args){
        try(SeContainer container =    
        SeContainerInitializer.newInstance().initialize()){
            container
                .getBeanManager()
                .fireEvent(new MyEvent("event: " + 
                System.currentTimeMillis()));
        }
    }

    public void thisEventBefore(
            @Observes @Priority(Interceptor.Priority
            .APPLICATION - 200) 
            MyEvent event){

        System.out.println("thisEventBefore: " + event.getValue());
    }

    public void thisEventAfter(
            @Observes @Priority(Interceptor.Priority
           .APPLICATION + 200) 
            MyEvent event){

        System.out.println("thisEventAfter: " + event.getValue());
    }  
}

Also, don't forget to add the beans.xml file into the META-INF folder:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee 
       http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
       bean-discovery-mode="all">
</beans>

INFO: WELD-ENV-002003: Weld SE container 
353db40d-e670-431d-b7be-4275b1813782 initialized
 thisEventBefore: event -> 1501818268764
 thisEventAfter: event -> 1501818268764

First, we are building a server to manage our event and observers:

public static void main(String[] args){
    try(SeContainer container =  
    SeContainerInitializer.newInstance().initialize()){
        container
            .getBeanManager()
            .fireEvent(new ExampleEvent("event: " 
            + System.currentTimeMillis()));
    }
}

This will give us all the resources needed to run the recipe as if it was a Java EE server.

Then we build an observer:

public void thisEventBefore(
        @Observes @Priority(Interceptor.Priority.APPLICATION - 200) 
        MyEvent event){

    System.out.println("thisEventBefore: " + event.getValue());
}

So, we have three important topics:

On the thisEventBefore method and thisEventAfter, we only changed the @Priority value and the server took care of running it in the right order.

The behavior would be exactly the same in a Java EE 8 server. You just wouldn't need SeContainerInitializer and would need to change the dependencies to the following:

<dependency>
    <groupId>javax</groupId>
    <artifactId>javaee-api</artifactId>
    <version>8.0</version>
    <scope>provided</scope>
</dependency>

Let's start by adding the right dependency to our project:

    <dependencies>
        <dependency>
            <groupId>org.glassfish.jersey.containers</groupId>
            <artifactId>jersey-container-grizzly2-http</artifactId>
            <version>2.26-b09</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.inject</groupId>
            <artifactId>jersey-hk2</artifactId>
            <version>2.26-b09</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.media</groupId>
            <artifactId>jersey-media-sse</artifactId>
            <version>2.26-b09</version>
        </dependency>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>8.0</version>
            <scope>provided</scope>
        </dependency>
    </dependencies>

You surely noticed that we are using Jersey here. Why? Because Jersey is the reference implementation for JAX-RS, which means that all JAX-RS specifications are first implemented through Jersey.

Moreover, with Jersey we can use Grizzly to start a small local server, which will be useful for this recipe, as we need just a few server features to show the SSE behavior.

Further on in this book, we will use a full GlassFish to build more JAX-RS recipes.

public class ServerMock {

    public static final URI CONTEXT = 
    URI.create("http://localhost:8080/");
    public static final String BASE_PATH = "ssevents";

    public static void main(String[] args) {
        try {
            final ResourceConfig resourceConfig = new 
            ResourceConfig(SseResource.class);

            final HttpServer server = 
            GrizzlyHttpServerFactory.createHttpServer(CONTEXT, 
            resourceConfig, false);
            server.start();

            System.out.println(String.format("Mock Server started
            at %s%s", CONTEXT, BASE_PATH));

            Thread.currentThread().join();
        } catch (IOException | InterruptedException ex) {
            System.out.println(ex.getMessage());
        }
    }
}

@Path(ServerMock.BASE_PATH)
public class SseResource {

    private static volatile SseEventSink SINK = null;

    @GET
    @Produces(MediaType.SERVER_SENT_EVENTS)
    public void getMessageQueue(@Context SseEventSink sink) {
        SseResource.SINK = sink;
    }

    @POST
    public void addMessage(final String message, @Context Sse sse) 
    throws IOException {
        if (SINK != null) {
            SINK.send(sse.newEventBuilder()
                .name("sse-message")
                .id(String.valueOf(System.currentTimeMillis()))
                .data(String.class, message)
                .comment("")
                .build());
        }
    }
}

public class ClientConsumer {

    public static final Client CLIENT = ClientBuilder.newClient();
    public static final WebTarget WEB_TARGET = 
    CLIENT.target(ServerMock.CONTEXT
    + BASE_PATH);

    public static void main(String[] args) {
        consume();
    }

    private static void consume() {

        try (final SseEventSource sseSource =
                     SseEventSource
                             .target(WEB_TARGET)
                             .build()) {

            sseSource.register(System.out::println);
            sseSource.open();

            for (int counter=0; counter < 5; counter++) {
                System.out.println(" ");
                for (int innerCounter=0; innerCounter < 5; 
                innerCounter++) {
                    WEB_TARGET.request().post(Entity.json("event "
                    + innerCounter));
                }
                Thread.sleep(1000);
            }

            CLIENT.close();
            System.out.println("\n All messages consumed");
        } catch (InterruptedException e) {
            System.out.println(e.getMessage());
        }
    }
}

To try it out, you have to first run the ServerMock class and then the ClientConsumer class. If everything worked well, you should see something like this:

InboundEvent{name='sse-message', id='1502228257736', comment='',    data=event 0}
 InboundEvent{name='sse-message', id='1502228257753', comment='',   data=event 1}
 InboundEvent{name='sse-message', id='1502228257758', comment='',   data=event 2}
 InboundEvent{name='sse-message', id='1502228257763', comment='',   data=event 3}
 InboundEvent{name='sse-message', id='1502228257768', comment='',   data=event 4}

These are the messages sent from the server to the client.

This recipe is made up of three parts:

So once ServerMock is instantiated, it registers the SseResource class:

final ResourceConfig resourceConfig = new ResourceConfig(SseResource.class);
final HttpServer server = GrizzlyHttpServerFactory.createHttpServer(CONTEXT, resourceConfig, false);
server.start();

Then two key methods from SseResource take place. The first one adds messages to the server queue:

addMessage(final String message, @Context Sse sse)

The second one consumes this queue and sends the messages to the clients:

@GET
@Produces(MediaType.SERVER_SENT_EVENTS)
public void getMessageQueue(@Context SseEventSink sink)

Note that this one has a media type SERVER_SENT_EVENTS, introduced in this version for this very purpose. And finally, we have our client. In this recipe, it is both posting and consuming messages. 

It consumes here:

sseSource.register(System.out::println);
sseSource.open();

It posts here:

ServerMock.WEB_TARGET.request().post(Entity.json("event " + innerCounter));

First, we need to add the dependencies needed:

        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>8.0</version>
            <scope>provided</scope>
        </dependency>

public class User implements Serializable {

    private String name;
    private String email;

    public User(String name, String email) {
        this.name = name;
        this.email = email; 
    }

    //DON'T FORGET THE GETTERS AND SETTERS
    //THIS RECIPE WON'T WORK WITHOUT THEM
}

@Named
@ViewScoped
public class UserBean implements Serializable {

    private User user;

public UserBean(){
        user = new User("Elder Moraes", "[email protected]");
    }

    public void userAction(){
        FacesContext.getCurrentInstance().addMessage(null, 
                new FacesMessage("Name|Password welformed"));
    }

    //DON'T FORGET THE GETTERS AND SETTERS
    //THIS RECIPE WON'T WORK WITHOUT THEM
}

@FacesConverter("userConverter")
public class UserConverter implements Converter<User> {

    @Override
    public String getAsString(FacesContext fc, UIComponent uic, 
    User user) {
        return user.getName() + "|" + user.getEmail();
    }

    @Override
    public User getAsObject(FacesContext fc, UIComponent uic, 
    String string) {
        return new User(string.substring(0, string.indexOf("|")), 
        string.substring(string.indexOf("|") + 1));
    }

}

@FacesValidator("userValidator")
public class UserValidator implements Validator<User> {

    @Override
    public void validate(FacesContext fc, UIComponent uic, 
    User user) 
    throws ValidatorException {
        if(!user.getEmail().contains("@")){
            throw new ValidatorException(new FacesMessage(null, 
                                         "Malformed e-mail"));
        }
    }
}

<h:body>
    <h:form>
        <h:panelGrid columns="3">
            <h:outputLabel value="Name|E-mail:" 
            for="userNameEmail"/>
            <h:inputText id="userNameEmail" 
            value="#{userBean.user}" 
            converter="userConverter" validator="userValidator"/> 
            <h:message for="userNameEmail"/>
        </h:panelGrid>
        <h:commandButton value="Validate" 
        action="#{userBean.userAction()}"/>
    </h:form> 
</h:body>

Don't forget to run it in a Java EE 8 server.

The UserBean class manages the communication between the UI and the server. Once you instantiate the user object, it is available for both of them.

That's why when you run it, the Name | E-mail is already filled (the user object is instantiated when the UserBean class is created by the server).

We associated the userAction() method from the UserBean class to the Validate button of the UI:

<h:commandButton value="Validate" action="#{userBean.userAction()}"/>

You can create other methods in UserBean and do the same to empower your application.

The whole core of our recipe is represented by just a single line in the UI:

<h:inputText id="userNameEmail" value="#{userBean.user}" converter="userConverter" validator="userValidator"/>

So, our two implemented interfaces used here are userConverter and userValidator.

Basically, the UserConverter class (with getAsString and getAsObject methods) converts an object to/from a string and vice versa, according to the logic defined by you.

We have just mentioned it in the preceding code snippet:

value="#{userBean.user}"

The server uses the userConverter object, calls the getAsString method, and prints the result using the preceding expression language.

Finally, the UserValidator class is automatically called when you submit the form, by calling its validate method, and applying the rules defined by you.

You could increase the validators by adding a Bean Validation on it and, for example, defining the email property from User with an @Email constraint.

Let's get our dependency:

<dependency>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>8.0</version>
            <scope>provided</scope>
        </dependency>
</dependency>

{
  "user": {
    "email": "[email protected]",
    "name": "Elder",
    "profile": [
      {
        "id": 1
      },
      {
        "id": 2
      },
      {
        "id": 3
      }
    ]
  }
}

public class JPointer {

    public static void main(String[] args) throws IOException{
        try (InputStream is = 
        JPointer.class.getClassLoader().getResourceAsStream("user.json");
                JsonReader jr = Json.createReader(is)) {

            JsonStructure js = jr.read();
            JsonPointer jp = Json.createPointer("/user/profile");
            JsonValue jv = jp.getValue(js);
            System.out.println("profile: " + jv);
        }
    }
}

The execution of this code prints the following:

profile: [{"id":1},{"id":2},{"id":3}]

The JSON Pointer is a standard defined by the Internet Engineering Task Force (IETF) under Request for Comments (RFC) 6901. The standard basically says that a JSON Pointer is a string that identifies a specific value in a JSON document.

Without a JSON Pointer, you would need to parse the whole message and iterate through it until you find the desired value; probably lots of ifs, elses, and things like that.

So, JSON Pointer helps you to decrease the written code dramatically by doing this kind of operation in a very elegant way.

Let's add our dependencies to the project:

    <dependencies>
        <dependency>
            <groupId>org.eclipse</groupId>
            <artifactId>yasson</artifactId>
            <version>1.0</version>
        </dependency> 
        <dependency>
            <groupId>org.glassfish</groupId>
            <artifactId>javax.json</artifactId>
            <version>1.1</version>
        </dependency> 
    </dependencies>

public class User {

    private String name;
    private String email;

    public User(){        
    }

    public User(String name, String email) {
        this.name = name;
        this.email = email;
    }

    @Override
    public String toString() {
        return "User{" + "name=" + name + ", email=" + email + '}';
    }

    //DON'T FORGET THE GETTERS AND SETTERS
    //THIS RECIPE WON'T WORK WITHOUT THEM

}

public class JsonBUser {

    public static void main(String[] args) throws Exception {
        User user = new User("Elder", "[email protected]");

Jsonb jb = JsonbBuilder.create();
        String jsonUser = jb.toJson(user);
        User u = jb.fromJson(jsonUser, User.class);

        jb.close();
        System.out.println("json: " + jsonUser);
        System.out.println("user: " + u);

    }
}

The result printed is:

json: {"email":"[email protected]","name":"Elder"}
 user: User{name=Elder, [email protected]}

The first line is the object transformed into a JSON string. The second is the same string converted into an object.

It uses the getters and setters defined in the User class to transform both ways and that's why they are so important.

Let's add the dependencies that we need:

<dependency>
    <groupId>javax</groupId>
    <artifactId>javaee-api</artifactId>
    <version>8.0</version>
    <scope>provided</scope>
</dependency>

@WebServlet(name = "ServerPush", urlPatterns = {"/ServerPush"})
public class ServerPush extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest request, 
    HttpServletResponse 
    response) throws ServletException, IOException {

        PushBuilder pb = request.newPushBuilder();
        if (pb != null) {
            pb.path("images/javaee-logo.png")
              .addHeader("content-type", "image/png")
              .push();
        }

        try (PrintWriter writer = response.getWriter();) {
            StringBuilder html = new StringBuilder();
            html.append("<html>");
            html.append("<center>");
            html.append("<img src='images/javaee-logo.png'><br>");
            html.append("<h2>Image pushed by ServerPush</h2>");
            html.append("</center>");
            html.append("</html>");
            writer.write(html.toString());
        }
    }
}

https://localhost:8080/ch01-servlet/ServerPush

We use the PushBuilder object to send an image to the client before it is requested by the img src tag. In other words, the browser doesn't need to do another request (what it usually does with img src) to have an image available for rendering.

It might seem as if it doesn't make too much difference for a single image, but it would with dozens, hundreds, or thousands of images. Less traffic for your client and from your server. Better performance for all!

If you are using JSF, you can get the benefits from Server Push for free! You don't even need to rewrite a single line of your code, as JSF relies on the Server Push specification.

Just make sure that you run it under the HTTPS protocol, as HTTP/2.0 only works under it.

We start by adding our dependencies to the project:

        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.tomee</groupId>
            <artifactId>openejb-core</artifactId>
            <version>7.0.4</version>
        </dependency>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>8.0</version>
            <scope>provided</scope>
        </dependency>

@Entity 
public class User implements Serializable{

    @Id
    private Long id;
    private String name;
    private String email;

    public User(){        
    }

    public User(Long id, String name, String email) {
        this.id = id;
        this.name = name;
        this.email = email;
    }

    //DON'T FORGET THE GETTERS AND SETTERS
    //THIS RECIPE WON'T WORK WITHOUT THEM
}

public class Roles {
    public static final String ADMIN = "ADMIN";
    public static final String OPERATOR = "OPERATOR";
}

@Stateful
public class UserBean {

    @PersistenceContext(unitName = "ch01-security-pu", 
    type = PersistenceContextType.EXTENDED)
    private EntityManager em;

    @RolesAllowed({Roles.ADMIN, Roles.OPERATOR})
    public void add(User user){
        em.persist(user);
    }

    @RolesAllowed({Roles.ADMIN})
    public void remove(User user){
        em.remove(user);
    }

    @RolesAllowed({Roles.ADMIN})
    public void update(User user){
        em.merge(user);
    }

    @PermitAll
    public List<User> get(){
        Query q = em.createQuery("SELECT u FROM User as u ");
        return q.getResultList();
    }

public class RoleExecutor {

    public interface Executable {
        void execute() throws Exception;
    }

    @Stateless
    @RunAs(Roles.ADMIN)
public static class AdminExecutor {
        public void run(Executable executable) throws Exception {
            executable.execute();
        }
    }

    @Stateless
    @RunAs(Roles.OPERATOR)
    public static class OperatorExecutor {
        public void run(Executable executable) throws Exception {
            executable.execute();
        }
    }
}

 Our code uses three test methods: asAdmin(), asOperator(), and asAnonymous().

    //Lot of setup code before this point

    @Test
    public void asAdmin() throws Exception {
        adminExecutor.run(() -> {
            userBean.add(new User(1L, "user1", "[email protected]"));
            userBean.add(new User(2L, "user2", "[email protected]"));
            userBean.add(new User(3L, "user3", "[email protected]"));
            userBean.add(new User(4L, "user4", "[email protected]"));

            List<User> list = userBean.get();

            list.forEach((user) -> {
                userBean.remove(user);
            });

            Assert.assertEquals("userBean.get()", 0, 
            userBean.get().size());
        });
    }

    @Test
    public void asOperator() throws Exception {

        operatorExecutor.run(() -> {
            userBean.add(new User(1L, "user1", "[email protected]"));
            userBean.add(new User(2L, "user2", "[email protected]"));
            userBean.add(new User(3L, "user3", "[email protected]"));
            userBean.add(new User(4L, "user4", "[email protected]"));

            List<User> list = userBean.get();

            list.forEach((user) -> {
                try {
                    userBean.remove(user);
                    Assert.fail("Operator was able to remove user " + 
                    user.getName());
                } catch (EJBAccessException e) {
                }
            });
            Assert.assertEquals("userBean.get()", 4, 
            userBean.get().size());
        });
    }

    @Test
    public void asAnonymous() {

        try {
            userBean.add(new User(1L, "elder", 
            "[email protected]"));
            Assert.fail("Anonymous user should not add users");
        } catch (EJBAccessException e) {
        }

        try {
            userBean.remove(new User(1L, "elder", 
            "[email protected]"));
            Assert.fail("Anonymous user should not remove users");
        } catch (EJBAccessException e) {
        }

        try {
 userBean.get();
        } catch (EJBAccessException e) {
            Assert.fail("Everyone can list users");
        }
    }

The whole point in this recipe is to do with the @RolesAllowed, @RunsAs, and @PermitAll annotations. They define what operations each role can do and what happens when a user tries an operation using the wrong role.

What we did here is called programmatic security; that is, we defined the security rules and roles through our code (the program). There's another approach called declarative security, where you declare the rules and roles through application and server configurations.

One good step up for this recipe is if you evolve the roles management to a source outside the application, such as a database or a service.

Add the proper dependencies to your project:

        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>8.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.mvc</groupId>
            <artifactId>javax.mvc-api</artifactId>
            <version>1.0-pr</version>
        </dependency>

@ApplicationPath("webresources")
public class AppConfig extends Application{
}

public class User {

    private String name;
    private String email;

    public User(String name, String email) {
        this.name = name;
        this.email = email;
    }

    //DON'T FORGET THE GETTERS AND SETTERS
    //THIS RECIPE WON'T WORK WITHOUT THEM
}

@Stateless
public class UserBean {

    public User getUser(){
        return new User("Elder", "[email protected]");
    }
}

@Controller
@Path("userController")
public class UserController {

    @Inject
    Models models;

    @Inject
    UserBean userBean;

    @GET
    public String user(){
        models.put("user", userBean.getUser());
        return "/user.jsp";
    }
}

<head>
    <meta http-equiv="Content-Type" content="text/html; 
    charset=UTF-8">
    <title>User MVC</title>
</head>
<body>
    <h1>${user.name}/${user.email}</h1>
</body>

Run it on a Java EE 8 server and access this URL:

http://localhost:8080/ch01-mvc/webresources/userController

The main actor in this whole scenario is the Models class injected into the Controller:

@Inject
Models models;

It's a class from MVC 1.0 API that owns the responsibility, in this recipe, of letting the User object be available for the View layer. It's injected (using CDI) and uses another injected bean, userBean, to do it:

models.put("user", userBean.getUser());

So, the View can easily access the values from the User object using expression language:

<h1>${user.name}/${user.email}</h1>