Implementing Spring Security

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-test</artifactId>
  <scope>test</scope>
</dependency>

@Configuration
@EnableWebSecurity
public class SecurityConfig {
  @Bean
  SecurityFilterChain api(HttpSecurity http) throws Exception {
    return http
      .csrf(csrf -> csrf.disable())
      .cors(Customizer.withDefaults())
      .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
      .authorizeHttpRequests(a -> a
        .requestMatchers("/public/**", "/actuator/health").permitAll()
        .requestMatchers("/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated())
      .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
      .build();
  }
}

@Bean
UserDetailsService users(PasswordEncoder enc) {
  return new InMemoryUserDetailsManager(
    User.withUsername("admin").password(enc.encode("secret")).roles("ADMIN").build(),
    User.withUsername("user").password(enc.encode("pwd")).roles("USER").build()
  );
}

@Bean
UserDetailsService jdbcUsers(DataSource ds) {
  return new JdbcUserDetailsManager(ds);
}

@Service
public class DbUserDetailsService implements UserDetailsService {
  private final UserRepository repo;
  public DbUserDetailsService(UserRepository repo) { this.repo = repo; }
  @Override public UserDetails loadUserByUsername(String username) {
    return repo.findByEmail(username)
      .map(u -> User.withUsername(u.getEmail())
                    .password(u.getPasswordHash())
                    .roles(u.getRoles().toArray(String[]::new))
                    .build())
      .orElseThrow(() -> new UsernameNotFoundException(username));
  }
}

@Bean PasswordEncoder encoder() {
  return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}

@Configuration
@EnableMethodSecurity
public class MethodSecConfig {}

@Service
public class OrderService {
  @PreAuthorize("hasRole('ADMIN') or #ownerId == authentication.name")
  public Order get(String ownerId, Long id) { /* … */ }

  @PostAuthorize("returnObject.owner == authentication.name")
  public Document load(Long id) { /* … */ }
}

@Bean
CorsConfigurationSource corsSource() {
  CorsConfiguration cfg = new CorsConfiguration();
  cfg.setAllowedOrigins(List.of("https://app.example.com"));
  cfg.setAllowedMethods(List.of("GET","POST","PUT","DELETE"));
  cfg.setAllowedHeaders(List.of("*"));
  cfg.setAllowCredentials(true);
  UrlBasedCorsConfigurationSource src = new UrlBasedCorsConfigurationSource();
  src.registerCorsConfiguration("/**", cfg);
  return src;
}

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();
boolean isAdmin = auth.getAuthorities().stream()
  .anyMatch(a -> "ROLE_ADMIN".equals(a.getAuthority()));