Why should request and response use separate DTOs, and where should entity↔DTO conversion live

package com.bank.dto;

import jakarta.validation.constraints.*;
import java.time.Instant;

// Request DTO: client-settable fields only, with validation.
public record CreateAccountRequest(
        @NotBlank String holderName,
        @Email String email,
        @NotBlank @Size(min = 8) String password,
        @NotNull java.math.BigDecimal initialDeposit) {}
// No id, no balance, no role, no createdAt.

// Response DTO: safe output fields only.
public record AccountResponse(
        String id,
        String holderName,
        String email,
        java.math.BigDecimal balance,
        Instant createdAt) {}
// No password.

// Vulnerable: shared DTO with balance and role on the request.
public record AccountDto(
        String id,           // Client should not set this
        String holderName,
        String email,
        String password,     // Should not appear on response
        java.math.BigDecimal balance, // Client should not set this!
        String role) {}      // Client should not set this!

// Attack: POST /api/v1/accounts
// {"holderName": "Rajesh", "email": "r@nbi.in", "password": "...",
//  "balance": 10000000, "role": "ADMIN"}
// → Account created with 10 million balance and admin role!

// Fixed: request DTO has no balance or role field.
public record CreateAccountRequest(
        @NotBlank String holderName,
        @Email String email,
        @NotBlank String password,
        @NotNull java.math.BigDecimal initialDeposit) {}
// Attack impossible: balance and role fields do not exist to bind.

// Wrong: shared DTO leaks password on GET response.
// GET /api/v1/accounts/SAV2001
// {"id": "SAV2001", "holderName": "Rajesh", "password": "$2a$10$..."}
// ← Password hash visible to anyone with read access!

// Correct: response DTO has no password field.
// GET /api/v1/accounts/SAV2001
// {"id": "SAV2001", "holderName": "Rajesh", "email": "r@nbi.in", "balance": 500000}

// Request: validation annotations on every input field.
public record CreateAccountRequest(
        @NotBlank String holderName,
        @Email String email,
        @NotBlank @Size(min = 8, max = 64) String password,
        @NotNull @DecimalMin("500") java.math.BigDecimal initialDeposit) {}

// Response: no validation needed – server produced this data.
public record AccountResponse(
        String id,
        String holderName,
        String email,
        java.math.BigDecimal balance,
        java.time.Instant createdAt) {}

package com.bank.service;

import org.springframework.stereotype.Service;
import java.math.BigDecimal;

@Service
public class AccountService {

    public AccountResponse create(CreateAccountRequest req) {
        Account entity = new Account(
                generateId(),
                req.holderName(),
                req.email(),
                hashPassword(req.password()),
                req.initialDeposit());
        accountRepo.save(entity);
        return toResponse(entity); // Mapping here, in the service.
    }

    private AccountResponse toResponse(Account a) {
        return new AccountResponse(
                a.getId(),
                a.getHolderName(),
                a.getEmail(),
                a.getBalance(),
                a.getCreatedAt());
    }
}

// Wrong: mapping in the controller – duplicated, not reusable.
@PostMapping("/accounts")
public ResponseEntity<AccountResponse> create(@Valid @RequestBody CreateAccountRequest req) {
    Account entity = new Account(/* ... */);
    accountRepo.save(entity);
    AccountResponse resp = new AccountResponse(entity.getId(), /* ... */); // Mapping here!
    return ResponseEntity.created(URI.create("/api/v1/accounts/" + resp.id())).body(resp);
}

// Correct: controller is thin, service does everything.
@PostMapping("/accounts")
public ResponseEntity<AccountResponse> create(@Valid @RequestBody CreateAccountRequest req) {
    AccountResponse resp = accountService.create(req);
    return ResponseEntity.created(URI.create("/api/v1/accounts/" + resp.id())).body(resp);
}

package com.bank.mapper;

import org.mapstruct.Mapper;

@Mapper(componentModel = "spring")
public interface AccountMapper {
    AccountResponse toResponse(Account entity);
    Account toEntity(CreateAccountRequest request);
}

// Service uses the mapper:
@Service
public class AccountService {
    private final AccountMapper mapper;
    // ...
    public AccountResponse create(CreateAccountRequest req) {
        Account entity = mapper.toEntity(req);
        entity.setId(generateId());
        entity.setPassword(hashPassword(req.password()));
        accountRepo.save(entity);
        return mapper.toResponse(entity);
    }
}

// Wrong: controller returns the entity directly – leaks everything.
@GetMapping("/accounts/{id}")
public Account getAccount(@PathVariable String id) {
    return accountRepo.findById(id).orElseThrow(); // Entity exposed!
}
// Password hash, internal fields, all visible.

// Correct: controller returns a response DTO.
@GetMapping("/accounts/{id}")
public AccountResponse getAccount(@PathVariable String id) {
    return accountService.findById(id); // Returns safe DTO.
}