@@ -5,19 +5,28 @@
 import nextstep.security.authentication.AuthenticationException;
 import nextstep.security.authentication.BasicAuthenticationFilter;
 import nextstep.security.authentication.UsernamePasswordAuthenticationFilter;
-import nextstep.security.authorization.CheckAuthenticationFilter;
-import nextstep.security.authorization.SecuredAspect;
-import nextstep.security.authorization.SecuredMethodInterceptor;
+import nextstep.security.authorization.AuthenticatedAuthorizationManager;
+import nextstep.security.authorization.AuthorityAuthorizationManager;
+import nextstep.security.authorization.AuthorizationFilter;
+import nextstep.security.authorization.AuthorizationManagerBeforeMethodInterceptor;
+import nextstep.security.authorization.AuthenticatedAuthorizationStrategy;
+import nextstep.security.authorization.PermitAllAuthorizationManager;
+import nextstep.security.authorization.RequestMatcherDelegatingAuthorizationManager;
+import nextstep.security.authorization.SecuredAuthorizationManager;
 import nextstep.security.config.DefaultSecurityFilterChain;
 import nextstep.security.config.DelegatingFilterProxy;
 import nextstep.security.config.FilterChainProxy;
 import nextstep.security.config.SecurityFilterChain;
 import nextstep.security.context.SecurityContextHolderFilter;
 import nextstep.security.userdetails.UserDetails;
 import nextstep.security.userdetails.UserDetailsService;
+import nextstep.security.util.AnyRequestMatcher;
+import nextstep.security.util.MvcRequestMatcher;
+import nextstep.security.util.RequestMatcherEntry;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.EnableAspectJAutoProxy;
+import org.springframework.http.HttpMethod;
 
 import java.util.List;
 import java.util.Set;
@@ -42,27 +51,32 @@ public FilterChainProxy filterChainProxy(List<SecurityFilterChain> securityFilte
         return new FilterChainProxy(securityFilterChains);
     }
 
-    @Bean
-    public SecuredMethodInterceptor securedMethodInterceptor() {
-        return new SecuredMethodInterceptor();
-    }
-//    @Bean
-//    public SecuredAspect securedAspect() {
-//        return new SecuredAspect();
-//    }
-
     @Bean
     public SecurityFilterChain securityFilterChain() {
         return new DefaultSecurityFilterChain(
                 List.of(
                         new SecurityContextHolderFilter(),
                         new UsernamePasswordAuthenticationFilter(userDetailsService()),
                         new BasicAuthenticationFilter(userDetailsService()),
-                        new CheckAuthenticationFilter()
+                        new AuthorizationFilter(new RequestMatcherDelegatingAuthorizationManager(List.of(
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members/me"), new AuthenticatedAuthorizationManager<>(new AuthenticatedAuthorizationStrategy())),
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members"), new AuthorityAuthorizationManager<>(Set.of("ADMIN"))),
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/search"), new PermitAllAuthorizationManager<>()),
+                                new RequestMatcherEntry<>(new AnyRequestMatcher(), new PermitAllAuthorizationManager())
+                        )))
                 )
         );
     }
 
+    @Bean
+    public AuthorizationManagerBeforeMethodInterceptor authorizationManagerBeforeMethodInterceptor() {
+        return new AuthorizationManagerBeforeMethodInterceptor(securedAuthorizationManager());
+    }
+
+    private SecuredAuthorizationManager securedAuthorizationManager() {
+        return new SecuredAuthorizationManager(new AuthorityAuthorizationManager<>(Set.of("ADMIN")));
+    }
+
     @Bean
     public UserDetailsService userDetailsService() {
         return username -> {

리뷰: 현재는 `@Secured` 를 사용할 경우 ADMIN 권한 밖에 체크가 불가능 하겠네요 🤔 
Spring Security 에서는 `AuthoritiesAuthorizationManager` 를 사용하여 `@Secured("ROLE_ADMIN")`와 같은 권한을 체크하고 있는데 이부분에 대해 한번 학습해보고 개선해보면 좋을 것 같아요 😄