如何使用Spring Security实现用户-角色-资源的权限控制

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    // 开启授权保护
    http.authorizeHttpRequests(authorize -> authorize
            // 所有 /user/** 路径下的请求需要 ADMIN 角色
            .requestMatchers("/user/**").hasRole("ADMIN")
            // 对所有请求开启授权保护
            .anyRequest()
            // 已认证的请求自动被授权
            .authenticated());
    // 其他配置省略...
}

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    LambdaQueryWrapper<User> lambdaQueryWrapper = new LambdaQueryWrapper<>();
    lambdaQueryWrapper.eq(User::getUsername, username);
    User user = userMapper.selectOne(lambdaQueryWrapper);
    if (user == null) {
        throw new UsernameNotFoundException(username);
    } else {
        return org.springframework.security.core.userdetails.User.withUsername(user.getUsername())
                .password(user.getPassword())
                .disabled(!user.getEnabled())
            	// 设置用户的凭据是否过期，false 表示凭据未过期
                .credentialsExpired(false)
            	// 设置账户是否被锁定，false 表示账户未锁定
                .accountLocked(false)
                // 为用户分配 ADMIN 角色
                .roles("ADMIN")
                .build();
    }
}

public class MyAccessDeniedHandler implements AccessDeniedHandler {
    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
        // 创建结果对象
        HashMap<String, Object> result = new HashMap<>();
        result.put("code", -1);
        result.put("message", "没有访问该资源的权限");
        // 转换成JSON字符串
        String json = JSON.toJSONString(result);
        // 返回响应
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().println(json);
    }
}

http.exceptionHandling(exception -> {
    // 请求未认证的处理
    exception.authenticationEntryPoint(new MyAuthenticationEntryPoint());
    // 请求未授权的处理
    exception.accessDeniedHandler(new MyAccessDeniedHandler());
});