Spring Security基于Customizer 的分布式权限配置最佳实践指南

// 传统写法：随着业务增长，这个方法会变成几百行的“面条代码”
http.authorizeHttpRequests()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .requestMatchers("/order/**").hasRole("USER")
    .requestMatchers("/pay/**").permitAll()
    // ... 无休止的追加 ...

// 1. 注入所有实现了 Customizer 接口的 Bean
@Resource
private List<AuthorizeRequestsCustomizer> authorizeRequestsCustomizers;
@Bean
protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
        // ... 其他配置 ...
        .authorizeHttpRequests(c -> {
            // 2. 核心逻辑：遍历所有注入的 Customizer，让它们自己定义规则
            authorizeRequestsCustomizers.forEach(customizer -> customizer.customize(c));
            // 3. 兜底规则（最后执行）
            c.anyRequest().authenticated();
        });
    return httpSecurity.build();
}

public abstract class AuthorizeRequestsCustomizer
        implements Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry>, Ordered {
    @Resource
    private WebProperties webProperties;
    // 提供通用方法的封装，避免各模块硬编码前缀
    protected String buildAdminApi(String url) {
        return webProperties.getAdminApi().getPrefix() + url;
    }
    protected String buildAppApi(String url) {
        return webProperties.getAppApi().getPrefix() + url;
    }
    // 默认优先级，业务模块可以通过重写此方法调整自己在过滤器链中的位置
    @Override
    public int getOrder() {
        return 0;
    }
}

@Configuration
public class InfraSecurityConfiguration {
    @Bean("infraAuthorizeRequestsCustomizer")
    public AuthorizeRequestsCustomizer infraAuthorizeRequestsCustomizer() {
        return new AuthorizeRequestsCustomizer() {
            @Override
            public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
                // 定义该模块独有的权限规则
                registry.requestMatchers(buildAdminApi("/infra/file/**")).permitAll() // 文件下载免登录
                        .requestMatchers("/swagger-ui/**").permitAll() // Swagger 免登录
                        .requestMatchers("/druid/**").hasRole("ADMIN"); // 数据库监控需管理员
            }
            // 可选：如果需要在其他规则之前生效，可以调高优先级
            @Override
            public int getOrder() {
                return -10;
            }
        };
    }
}