Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/example/visacasemanagementsystem/comment/controller/CommentController.java`:
- Line 24: The createComment method should enforce Bean Validation on the
request DTO: add the `@Valid` annotation to the CreateCommentDTO parameter in the
createComment(`@RequestBody` CreateCommentDTO dto) signature so Spring triggers
validation of `@NotNull/`@NotBlank on CreateCommentDTO; also import
javax.validation.Valid (or jakarta.validation.Valid depending on project) to
resolve the annotation.

In
`@src/main/java/org/example/visacasemanagementsystem/comment/service/CommentService.java`:
- Around line 42-43: The code currently uses dto.authorId() to set comment
ownership (see User author assignment in CommentService), which allows clients
to impersonate others; instead resolve the author from the authenticated context
and ignore the client-supplied id: obtain the current user's id via the app's
auth utility (e.g., SecurityContextHolder/your AuthService method) inside the
CommentService create method, call
userRepository.findById(currentUserId()).orElseThrow(...) to load the User, and
remove/ignore dto.authorId() so ownership is always set from the authenticated
principal rather than client input.

In
`@src/main/java/org/example/visacasemanagementsystem/exception/GlobalExceptionHandler.java`:
- Around line 21-24: The method handleNotFoundException in
GlobalExceptionHandler is annotated to handle both EntityNotFoundException and
ResourceNotFoundException but its parameter is typed as EntityNotFoundException;
change the parameter type to a common supertype (e.g., RuntimeException or a
shared base like ApplicationException) so Spring can resolve either exception;
keep the `@ExceptionHandler`({EntityNotFoundException.class,
ResourceNotFoundException.class}) annotation and update the method signature and
any uses of the parameter inside handleNotFoundException to operate on the
chosen supertype.

---

Nitpick comments:
In
`@src/main/java/org/example/visacasemanagementsystem/comment/service/CommentService.java`:
- Around line 61-62: Change the `@Transactional` annotation on
CommentService.getCommentsByVisaId to a read-only transaction by adding readOnly
= true; locate the method getCommentsByVisaId in CommentService and replace or
update the existing `@Transactional` to `@Transactional`(readOnly = true) so
Hibernate can skip dirty checking and the intent is documented for this
query-only method.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In
`@src/main/java/org/example/visacasemanagementsystem/comment/service/CommentService.java`:
- Around line 65-72: The current implementation in CommentService does an
unconditional existsById check (visaRepository.existsById) before fetching
comments, causing two DB calls; instead call
commentRepository.findByVisaIdOrderByCreatedAtDesc(visaId) first, map the result
to DTOs, and if the returned list is empty then call
visaRepository.existsById(visaId) to decide whether to throw
ResourceNotFoundException("Visa case not found with id: " + visaId) or return an
empty list; update the method that currently calls
commentRepository.findByVisaIdOrderByCreatedAtDesc and visaRepository.existsById
accordingly.
- Around line 63-64: The getCommentsByVisaId method in CommentService is a
read-only fetch and should be annotated to reflect that; change the
`@Transactional` on getCommentsByVisaId to `@Transactional`(readOnly = true) so the
persistence context is optimized for reads and intent is clear (update the
annotation on the method named getCommentsByVisaId in class CommentService).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/example/visacasemanagementsystem/comment/service/CommentService.java`:
- Around line 38-40: The createComment method currently dereferences dto without
null-checking, causing an NPE for null payloads; update the
createComment(CreateCommentDTO dto) implementation to first validate dto is not
null (and return/throw a controlled Bad Request/IllegalArgumentException) before
accessing dto.text(), and keep the existing empty-text check; reference the
createComment method and CreateCommentDTO/dto variables when adding this null
guard so the method consistently produces a controlled error for null or blank
inputs.
- Around line 64-67: The method getCommentsByVisaId currently accepts any Long
visaId and can treat zero/negative inputs as valid, causing misleading
repository errors; add input validation at the start of getCommentsByVisaId to
reject null or non-positive visaId (<= 0) and throw a clear
IllegalArgumentException or BadRequest-style exception before calling
commentRepository.findByVisaIdOrderByCreatedAtDesc or visaRepository.existsById;
update any method signature or Javadoc as needed so callers know invalid ids are
rejected and include the symbol names (getCommentsByVisaId, visaId,
commentRepository.findByVisaIdOrderByCreatedAtDesc, visaRepository.existsById,
ResourceNotFoundException) when locating the change.