Why is this an issue?

Since: PMD 1.8

Avoid throwing NullPointerExceptions manually. These are confusing because most people will assume that the virtual machine threw it. To avoid a method being called with a null parameter, you may consider using an IllegalArgumentException instead, making it clearly seen as a programmer-initiated exception. However, there are better ways to handle this:

Effective Java, 3rd Edition, Item 72: Favor the use of standard exceptions > >Arguably, every erroneous method invocation boils down to an illegal argument or state, but other exceptions are standardly used for certain kinds of illegal arguments and states. If a caller passes null in some parameter for which null values are prohibited, convention dictates that NullPointerException be thrown rather than IllegalArgumentException.

To implement that, you are encouraged to use java.util.Objects.requireNonNull() (introduced in Java 1.7). This method is designed primarily for doing parameter validation in methods and constructors with multiple parameters.

https://app.codacy.com/gh/Attacktive/msa-order/issues/current?categories=ErrorProne

The business logics are in the adapter layer which should be in the domain.

Can I ever make it with the Hibernate ddl-auto without polluting the @Entity? 🤔

...focusing on concurrency issues.

❯ curl 'http://localhost:8081/orders' -v -H 'Content-Type: application/json' -d '{ "productId": 4 }'
* Host localhost:8081 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8081...
* Connected to localhost (::1) port 8081
> POST /orders HTTP/1.1
> Host: localhost:8081
> User-Agent: curl/8.8.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 18
> 
* upload completely sent off: 18 bytes
< HTTP/1.1 500 
< Vary: Origin
< Vary: Access-Control-Request-Method
< Vary: Access-Control-Request-Headers
< Content-Type: application/json
< Transfer-Encoding: chunked
< Date: Wed, 05 Jun 2024 04:30:30 GMT
< Connection: close
< 
* Closing connection
{"message":"404 Not Found from GET http://localhost:8080/products/4","httpStatus":500}

I believe it should return 404 not 500.