@@ -17,6 +17,7 @@
 import nextstep.security.matcher.AnyRequestMatcher;
 import nextstep.security.matcher.MvcRequestMatcher;
 import nextstep.security.matcher.RequestMatcherEntry;
+import nextstep.security.role.*;
 import nextstep.security.userdetails.UserDetails;
 import nextstep.security.userdetails.UserDetailsService;
 import org.springframework.context.annotation.Bean;
@@ -27,6 +28,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 @EnableAspectJAutoProxy
 @Configuration
@@ -50,20 +52,17 @@ public FilterChainProxy filterChainProxy(List<SecurityFilterChain> securityFilte
 
     @Bean
     public SecuredMethodInterceptor securedMethodInterceptor() {
-        AuthorityAuthorizationManager<Set<String>> authorityAuthorizationManager = new AuthorityAuthorizationManager<>();
+        AuthorityAuthorizationManager<Set<GrantedAuthority>> authorityAuthorizationManager = new AuthorityAuthorizationManager<>(roleHierarchy());
         return new SecuredMethodInterceptor(new SecuredAuthorizationManager(authorityAuthorizationManager));
     }
-//    @Bean
-//    public SecuredAspect securedAspect() {
-//        return new SecuredAspect();
-//    }
 
     @Bean
     public RequestMatcherDelegatingAuthorizationManager requestMatcherDelegatingAuthorizationManager() {
         List<RequestMatcherEntry<AuthorizationManager<HttpServletRequest>>> mappings = new ArrayList<>();
         mappings.add(new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members/me"), new AuthenticatedAuthorizationManager()));
-        mappings.add(new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members"), new AuthorityAuthorizationManager<>()));
-        mappings.add(new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/search", "/login"), new PermitAllAuthorizationManager()));
+        mappings.add(new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members"), new AuthorityAuthorizationManager<>(new NullRoleHierarchy())));
+        mappings.add(new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/search"), new PermitAllAuthorizationManager()));
+        mappings.add(new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/login"), new PermitAllAuthorizationManager()));
         mappings.add(new RequestMatcherEntry<>(new AnyRequestMatcher(), new DenyAllAuthorizationManager()));
         return new RequestMatcherDelegatingAuthorizationManager(mappings);
     }
@@ -98,10 +97,20 @@ public String getPassword() {
                 }
 
                 @Override
-                public Set<String> getAuthorities() {
-                    return member.getRoles();
+                public Set<GrantedAuthority> getAuthorities() {
+                    return member.getRoles()
+                            .stream()
+                            .map(SimpleGrantedAuthority::new)
+                            .collect(Collectors.toSet());
                 }
             };
         };
     }
+
+    @Bean
+    public RoleHierarchy roleHierarchy() {
+        return RoleHierarchyImpl.builder()
+                .role("ADMIN").addImplies("MEMBER")
+                .build();
+    }
 }

리뷰: 잘 추가해주셨네요 👍