// 傳統(tǒng)寫法：隨著業(yè)務(wù)增長，這個方法會變成幾百行的“面條代碼”
http.authorizeHttpRequests()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .requestMatchers("/order/**").hasRole("USER")
    .requestMatchers("/pay/**").permitAll()
    // ... 無休止的追加 ...

// 1. 注入所有實現(xiàn)了 Customizer 接口的 Bean
@Resource
private List<AuthorizeRequestsCustomizer> authorizeRequestsCustomizers;
@Bean
protected SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
        // ... 其他配置 ...
        .authorizeHttpRequests(c -> {
            // 2. 核心邏輯：遍歷所有注入的 Customizer，讓它們自己定義規(guī)則
            authorizeRequestsCustomizers.forEach(customizer -> customizer.customize(c));
            // 3. 兜底規(guī)則（最后執(zhí)行）
            c.anyRequest().authenticated();
        });
    return httpSecurity.build();
}

public abstract class AuthorizeRequestsCustomizer
        implements Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry>, Ordered {
    @Resource
    private WebProperties webProperties;
    // 提供通用方法的封裝，避免各模塊硬編碼前綴
    protected String buildAdminApi(String url) {
        return webProperties.getAdminApi().getPrefix() + url;
    }
    protected String buildAppApi(String url) {
        return webProperties.getAppApi().getPrefix() + url;
    }
    // 默認優(yōu)先級，業(yè)務(wù)模塊可以通過重寫此方法調(diào)整自己在過濾器鏈中的位置
    @Override
    public int getOrder() {
        return 0;
    }
}

@Configuration
public class InfraSecurityConfiguration {
    @Bean("infraAuthorizeRequestsCustomizer")
    public AuthorizeRequestsCustomizer infraAuthorizeRequestsCustomizer() {
        return new AuthorizeRequestsCustomizer() {
            @Override
            public void customize(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
                // 定義該模塊獨有的權(quán)限規(guī)則
                registry.requestMatchers(buildAdminApi("/infra/file/**")).permitAll() // 文件下載免登錄
                        .requestMatchers("/swagger-ui/**").permitAll() // Swagger 免登錄
                        .requestMatchers("/druid/**").hasRole("ADMIN"); // 數(shù)據(jù)庫監(jiān)控需管理員
            }
            // 可選：如果需要在其他規(guī)則之前生效，可以調(diào)高優(yōu)先級
            @Override
            public int getOrder() {
                return -10;
            }
        };
    }
}