@@ -5,19 +5,28 @@
 import nextstep.security.authentication.AuthenticationException;
 import nextstep.security.authentication.BasicAuthenticationFilter;
 import nextstep.security.authentication.UsernamePasswordAuthenticationFilter;
-import nextstep.security.authorization.CheckAuthenticationFilter;
-import nextstep.security.authorization.SecuredAspect;
-import nextstep.security.authorization.SecuredMethodInterceptor;
+import nextstep.security.authorization.AuthenticatedAuthorizationManager;
+import nextstep.security.authorization.AuthorityAuthorizationManager;
+import nextstep.security.authorization.AuthorizationFilter;
+import nextstep.security.authorization.AuthorizationManagerBeforeMethodInterceptor;
+import nextstep.security.authorization.AuthenticatedAuthorizationStrategy;
+import nextstep.security.authorization.PermitAllAuthorizationManager;
+import nextstep.security.authorization.RequestMatcherDelegatingAuthorizationManager;
+import nextstep.security.authorization.SecuredAuthorizationManager;
 import nextstep.security.config.DefaultSecurityFilterChain;
 import nextstep.security.config.DelegatingFilterProxy;
 import nextstep.security.config.FilterChainProxy;
 import nextstep.security.config.SecurityFilterChain;
 import nextstep.security.context.SecurityContextHolderFilter;
 import nextstep.security.userdetails.UserDetails;
 import nextstep.security.userdetails.UserDetailsService;
+import nextstep.security.util.AnyRequestMatcher;
+import nextstep.security.util.MvcRequestMatcher;
+import nextstep.security.util.RequestMatcherEntry;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.EnableAspectJAutoProxy;
+import org.springframework.http.HttpMethod;
 
 import java.util.List;
 import java.util.Set;
@@ -42,27 +51,32 @@ public FilterChainProxy filterChainProxy(List<SecurityFilterChain> securityFilte
         return new FilterChainProxy(securityFilterChains);
     }
 
-    @Bean
-    public SecuredMethodInterceptor securedMethodInterceptor() {
-        return new SecuredMethodInterceptor();
-    }
-//    @Bean
-//    public SecuredAspect securedAspect() {
-//        return new SecuredAspect();
-//    }
-
     @Bean
     public SecurityFilterChain securityFilterChain() {
         return new DefaultSecurityFilterChain(
                 List.of(
                         new SecurityContextHolderFilter(),
                         new UsernamePasswordAuthenticationFilter(userDetailsService()),
                         new BasicAuthenticationFilter(userDetailsService()),
-                        new CheckAuthenticationFilter()
+                        new AuthorizationFilter(new RequestMatcherDelegatingAuthorizationManager(List.of(
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members/me"), new AuthenticatedAuthorizationManager<>(new AuthenticatedAuthorizationStrategy())),
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/members"), new AuthorityAuthorizationManager<>(Set.of("ADMIN"))),
+                                new RequestMatcherEntry<>(new MvcRequestMatcher(HttpMethod.GET, "/search"), new PermitAllAuthorizationManager<>()),
+                                new RequestMatcherEntry<>(new AnyRequestMatcher(), new PermitAllAuthorizationManager())
+                        )))
                 )
         );
     }
 
+    @Bean
+    public AuthorizationManagerBeforeMethodInterceptor authorizationManagerBeforeMethodInterceptor() {
+        return new AuthorizationManagerBeforeMethodInterceptor(securedAuthorizationManager());
+    }
+
+    private SecuredAuthorizationManager securedAuthorizationManager() {
+        return new SecuredAuthorizationManager(new AuthorityAuthorizationManager<>(Set.of("ADMIN")));
+    }
+
     @Bean
     public UserDetailsService userDetailsService() {
         return username -> {

리뷰: 질문 주신 부분에 대한 저의 의견 여기에 남기겠습니다.

> Q. RequestMatcherRegistry의 역할이 필요한 RequestMatcher을 모두 등록한 뒤 HTTP 요청이 들어왔을 때 적절한 RequestMatcher를 찾아서 반환하는 것으로 이해했는데 올바르게 이해한걸까요?


A.RequestMatcherRegistry는 보안 규칙을 등록하는 역할을 합니다.
요청이 들어오면 Spring Security의 AuthorizationFilter가 RequestMatcherDelegatingAuthorizationManager를 통해
적절한 RequestMatcher를 찾아 인가(Authorization)를 수행합니다.

즉, RequestMatcherRegistry는 보안 설정을 구성하는 단계에서 사용되며,
실제 요청이 들어왔을 때 요청과 매칭되는 RequestMatcher를 찾아 적용하는 것은 RequestMatcherDelegatingAuthorizationManager이고,
이를 실행하여 최종적으로 인가를 결정하는 것은 AuthorizationFilter의 역할일 것 같네요 😄