组合configure() + hasAuthority()和PreAuthorize

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/admin/**").hasAuthority("ROLE_ADMIN")
            .antMatchers("/user/**").access("hasAuthority('ROLE_USER') or hasAuthority('ROLE_ADMIN')")
            .anyRequest().authenticated()
            .and()
            .formLogin();
    }
    
    @PreAuthorize("hasAuthority('ROLE_ADMIN')")
    @GetMapping("/admin/dashboard")
    public String adminDashboard() {
        // Admin dashboard logic
    }
    
    @PreAuthorize("hasAuthority('ROLE_USER')")
    @GetMapping("/user/profile")
    public String userProfile() {
        // User profile logic
    }
}