Ktor + Kotlin

class EncryptionService {

    fun encrypt(plaintext: ByteArray, key: SecretKey): ByteArray {
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        val iv = ByteArray(12).also { SecureRandom().nextBytes(it) }
        cipher.init(Cipher.ENCRYPT_MODE, key, GCMParameterSpec(128, iv))
        val ciphertext = cipher.doFinal(plaintext)
        // prepend IV for transport: [12 bytes IV | ciphertext]
        return iv + ciphertext
    }

    fun decrypt(payload: ByteArray, key: SecretKey): ByteArray {
        val iv = payload.copyOfRange(0, 12)
        val ciphertext = payload.copyOfRange(12, payload.size)
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        cipher.init(Cipher.DECRYPT_MODE, key, GCMParameterSpec(128, iv))
        return cipher.doFinal(ciphertext)
    }
}

val EncryptionPlugin = createRouteScopedPlugin("EncryptionPlugin") {
    onCall { call ->
        val sessionKey = call.getSessionKey() // resolved from header
        if (sessionKey != null) {
            val rawBody = call.receiveChannel().toByteArray()
            val decrypted = encryptionService.decrypt(rawBody, sessionKey)
            call.setEncryptedBody(decrypted) // replaces receive channel
        }
    }
    onCallRespond { call, body ->
        val sessionKey = call.getSessionKey()
        if (sessionKey != null && body is ByteArray) {
            transformBody { encryptionService.encrypt(body, sessionKey) }
        }
    }
}

interface CacheRepository {
    suspend fun get(key: String): String?
    suspend fun set(key: String, value: String, ttlSeconds: Long = 3600)
    suspend fun delete(key: String)
    suspend fun exists(key: String): Boolean
}

// Usage in repository impl — cache-aside
override suspend fun findById(id: Long): User? {
    val key = "user:$id"
    cache.get(key)?.let { return json.decodeFromString(it) }

    return dbQuery {
        UserTable.selectAll().where { UserTable.id eq id }
            .map { it.toUser() }.singleOrNull()
    }?.also { user ->
        cache.set(key, json.encodeToString(user), ttlSeconds = 3600)
    }
}

class ConnectionManager {
    private val sessions = ConcurrentHashMap<String, DefaultWebSocketSession>()

    suspend fun connect(userId: String, session: DefaultWebSocketSession) {
        sessions[userId] = session
    }

    fun disconnect(userId: String) { sessions.remove(userId) }

    suspend fun sendTo(userId: String, message: WsMessage) {
        sessions[userId]?.send(Frame.Text(json.encodeToString(message)))
    }

    suspend fun broadcast(message: WsMessage) {
        val frame = Frame.Text(json.encodeToString(message))
        sessions.values.forEach { session ->
            try { session.send(frame) }
            catch (_: Exception) { /* session closed, ignored */ }
        }
    }
}

// Sealed event types — exhaustive when()
@Serializable
@JsonClassDiscriminator("type")
sealed class WsMessage {
    @Serializable @SerialName("notification")
    data class Notification(val title: String, val body: String) : WsMessage()
    @Serializable @SerialName("data_update")
    data class DataUpdate(val entity: String, val id: String) : WsMessage()
    @Serializable @SerialName("ping")
    object Ping : WsMessage()
}

fun Application.configureRateLimit() {
    install(RateLimit) {

        register(RateLimitName("auth")) {
            rateLimiter(limit = 5, refillPeriod = 1.minutes)
            requestKey { call -> call.request.origin.remoteHost }
        }

        register(RateLimitName("api")) {
            rateLimiter(limit = 100, refillPeriod = 1.minutes)
            requestKey { call ->
                call.principal<JWTPrincipal>()?.subject
                    ?: call.request.origin.remoteHost
            }
        }

        register(RateLimitName("public")) {
            rateLimiter(limit = 300, refillPeriod = 1.minutes)
            requestKey { call -> call.request.origin.remoteHost }
        }
    }
}

// Usage in routes
rateLimit(RateLimitName("auth")) {
    post("/login") { authController.login(call) }
    post("/register") { authController.register(call) }
}

sealed class AppError(override val message: String) : Exception(message) {
    data class NotFound(val resource: String) : AppError("$resource not found")
    data class Unauthorized(val reason: String = "Unauthorized") : AppError(reason)
    data class Forbidden(val reason: String = "Forbidden") : AppError(reason)
    data class Conflict(val resource: String) : AppError("$resource already exists")
    data class Validation(val fields: Map<String, String>) : AppError("Validation failed")
    data class Internal(val cause: Throwable) : AppError("Internal server error")
}

// StatusPages plugin — single location
exception<AppError> { call, error ->
    val status = when (error) {
        is AppError.NotFound     -> HttpStatusCode.NotFound
        is AppError.Unauthorized  -> HttpStatusCode.Unauthorized
        is AppError.Forbidden    -> HttpStatusCode.Forbidden
        is AppError.Conflict     -> HttpStatusCode.Conflict
        is AppError.Validation   -> HttpStatusCode.UnprocessableEntity
        is AppError.Internal    -> HttpStatusCode.InternalServerError
    }
    call.respond(status, ApiResponse.Error(error.message))
}