المصادقة وقواعد الطلب والوصول للكائن

package training.catalog;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration(proxyBeanMethods = false)
class ApiSecurity {
    @Bean
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(rules -> rules
            .requestMatchers("/actuator/health").permitAll()
            .requestMatchers(HttpMethod.GET, "/products/**").hasAuthority("catalog:read")
            .anyRequest().denyAll())
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }
}

موفر الهوية سياقي ولم يعطل CSRF عاماً؛ ولم ينفذ المرشح أوالمصادقة.

public class Main {
static boolean canRead(String trustedTenant,java.util.Set<String> authorities,String resourceTenant) {
 return trustedTenant!=null && trustedTenant.equals(resourceTenant) && authorities.contains("catalog:read");
}
 public static void main(String[] args) throws Exception {
var read=java.util.Set.of("catalog:read");
System.out.println(canRead("north",read,"north"));
System.out.println(canRead("north",read,"south"));
System.out.println(canRead("north",java.util.Set.of(),"north"));
 }
}

true
false
false

ينجح north لمورده وسلطته فقط، دون تنفيذ تكامل Security.