http.authorizeHttpRequests(requestMatcherRegstry -> 
// /admin/** 需要有AMIND角色
	requestMatcherRegstry.requestMatchers("/admin/**").hasRole("ADMIN")
			// /log/** 只要有AMIND、USER角色之一
          .requestMatchers("/log/**").hasAnyRole("ADMIN", "USER")
			// 任意請(qǐng)求 只要登錄了即可訪問(wèn)
          .anyRequest().authenticated()
);

/**
 * 這個(gè)方法是HttpSecurity的方法。
 * 作用是配置AuthorizationFilter。
 * 其入?yún)uthorizeHttpRequestsCustomizer正是讓我們配置AuthorizationFilter的關(guān)鍵。
 * Customizer：就是定制。原理比較容易理解，就是我把你需要配置的東西丟給你，你往里面賦值。
 * AuthorizeHttpRequestsConfigurer<HttpSecurity>：這個(gè)是Configurer的實(shí)現(xiàn)，負(fù)責(zé)引入過(guò)濾器的。這里明顯就是引入AuthorizationFilter
 * AuthorizationManagerRequestMatcherRegistry：這個(gè)就是我們最終配置的東西。而這個(gè)配置的正是我們上面的RequestMatcherDelegatingAuthorizationManager。說(shuō)白了就是往里面添加哪些路徑對(duì)應(yīng)哪些AuthorizationManager。只不過(guò)，為了方便使用，也幫我們都封裝好了。不妨繼續(xù)往后看看。
 */
public HttpSecurity authorizeHttpRequests(
			Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry> authorizeHttpRequestsCustomizer)
			throws Exception {
		ApplicationContext context = getContext();
		// 這里干了三個(gè)事情：
		// 1. 如果當(dāng)前HttpSecurity不存在AuthorizeHttpRequestsConfigurer，則創(chuàng)建一個(gè)，并注冊(cè)到當(dāng)前的HttpSecurity對(duì)象中。
		// 2. 從AuthorizeHttpRequestsConfigurer拿到他的注冊(cè)器也就是AuthorizationManagerRequestMatcherRegistry
		// 3. 調(diào)用傳入的參數(shù)的customize。如此，我們傳入的lambda表達(dá)式就被調(diào)用了。
		authorizeHttpRequestsCustomizer
			.customize(getOrApply(new AuthorizeHttpRequestsConfigurer<>(context)).getRegistry());
		return HttpSecurity.this;
	}

public final class AuthorizationManagerRequestMatcherRegistry
		extends AbstractRequestMatcherRegistry<AuthorizedUrl> {
	/**
	 * 這是父類(lèi)的方法
	 * C代表的是AuthorizedUrl
	 */
	public C requestMatchers(String... patterns) {
		// 調(diào)用的重載方法第一個(gè)參數(shù)為HttpMethod，也就是說(shuō)，我們還可以指定HTTP請(qǐng)求的方法，例如：POST、GET等
		return requestMatchers(null, patterns);
	}
	@Override
	protected AuthorizedUrl chainRequestMatchers(List<RequestMatcher> requestMatchers) {
		this.unmappedMatchers = requestMatchers;
		return new AuthorizedUrl(requestMatchers);
	}
}
public class AuthorizedUrl {
	private final List<? extends RequestMatcher> matchers;
	public AuthorizationManagerRequestMatcherRegistry permitAll() {
		return access(permitAllAuthorizationManager);
	}
	public AuthorizationManagerRequestMatcherRegistry hasRole(String role) {
		return access(withRoleHierarchy(AuthorityAuthorizationManager.hasRole(role)));
	}
	public AuthorizationManagerRequestMatcherRegistry hasAnyAuthority(String... authorities) {
		return access(withRoleHierarchy(AuthorityAuthorizationManager.hasAnyAuthority(authorities)));
	}
	public AuthorizationManagerRequestMatcherRegistry authenticated() {
		return access(AuthenticatedAuthorizationManager.authenticated());
	}
	public AuthorizationManagerRequestMatcherRegistry access(
		AuthorizationManager<RequestAuthorizationContext> manager) {
		Assert.notNull(manager, "manager cannot be null");
		return AuthorizeHttpRequestsConfigurer.this.addMapping(this.matchers, manager);
	}
}
public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractHttpConfigurer<AuthorizeHttpRequestsConfigurer<H>, H> {
	private AuthorizationManagerRequestMatcherRegistry addMapping(List<? extends RequestMatcher> matchers,
		AuthorizationManager<RequestAuthorizationContext> manager) {
		for (RequestMatcher matcher : matchers) {
			this.registry.addMapping(matcher, manager);
		}
		return this.registry;
	}
}

requestMatcherRegstry -> requestMatcherRegstry.requestMatchers("/admin/**").hasRole("ADMIN")

public class AuthorizationFilter extends GenericFilterBean {
	@Override
	public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain)
			throws ServletException, IOException {
		// 類(lèi)型轉(zhuǎn)換
		HttpServletRequest request = (HttpServletRequest) servletRequest;
		HttpServletResponse response = (HttpServletResponse) servletResponse;
		// 是否需要執(zhí)行鑒權(quán)
		if (this.observeOncePerRequest && isApplied(request)) {
			chain.doFilter(request, response);
			return;
		}
		// /error和異步請(qǐng)求不處理
		if (skipDispatch(request)) {
			chain.doFilter(request, response);
			return;
		}
		// 是否已經(jīng)執(zhí)行過(guò)鑒權(quán)邏輯了
		String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
		request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
		try {
			// 從SecurityContextHolder中獲取憑證，并通過(guò)AuthorizationManager做出決策
			AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, request);
			// 發(fā)布鑒權(quán)事件
			this.eventPublisher.publishAuthorizationEvent(this::getAuthentication, request, decision);
			if (decision != null && !decision.isGranted()) {
				// 拒絕訪問(wèn)異常
				throw new AccessDeniedException("Access Denied");
			}
			// 正常執(zhí)行后續(xù)業(yè)務(wù)邏輯
			chain.doFilter(request, response);
		}
		finally {
			// 處理完業(yè)務(wù)邏輯后，為當(dāng)前請(qǐng)求清理標(biāo)識(shí)			
			request.removeAttribute(alreadyFilteredAttributeName);
		}
	}
}

public final class RequestMatcherDelegatingAuthorizationManager implements AuthorizationManager<HttpServletRequest> {
@Override
	public AuthorizationDecision check(Supplier<Authentication> authentication, HttpServletRequest request) {
		// 遍歷每一個(gè)已經(jīng)登錄好的路徑，找到對(duì)應(yīng)的AuthorizationManager<RequestAuthorizationContext>>
		for (RequestMatcherEntry<AuthorizationManager<RequestAuthorizationContext>> mapping : this.mappings) {
			RequestMatcher matcher = mapping.getRequestMatcher();
			// 匹配當(dāng)前請(qǐng)求
			MatchResult matchResult = matcher.matcher(request);
			if (matchResult.isMatch()) {
				// 找到匹配的AuthorizationManager就直接調(diào)用check方法并返回鑒權(quán)結(jié)果
				AuthorizationManager<RequestAuthorizationContext> manager = mapping.getEntry();
				return manager.check(authentication,
						new RequestAuthorizationContext(request, matchResult.getVariables()));
			}
		}
		// 沒(méi)有匹配的AuthorizationManager則返回拒絕當(dāng)前請(qǐng)求
		return DENY;
	}
}