Spring Security

@Service
public class DocumentService {

    @PreAuthorize("hasRole('EDITOR') and #ownerId == authentication.name")
    public void update(String ownerId, DocumentPatch patch) { /* ... */ }

    @PostAuthorize("returnObject.ownerId == authentication.name or hasRole('ADMIN')")
    public Document findById(String id) { /* ... */ }

    @PreAuthorize("@documentPermissions.canDelete(#id, authentication)")
    public void delete(String id) { /* ... */ }
}

@PostFilter("filterObject.ownerId == authentication.name or hasRole('ADMIN')")
public List<Document> findAll() { /* ... */ }

@PreFilter("filterObject.status != 'LOCKED'")
public void saveAll(List<Document> documents) { /* ... */ }

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN')")
public @interface IsAdmin {
}

@GetMapping("/api/me")
public MeResponse me(@AuthenticationPrincipal UserDetails user, Authentication authentication) {
    return new MeResponse(user.getUsername(), authentication.getAuthorities());
}

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

Mono<String> currentUsername = ReactiveSecurityContextHolder.getContext()
        .map(SecurityContext::getAuthentication)
        .map(Authentication::getName);

@Configuration
@EnableWebFluxSecurity
public class ReactiveSecurityConfig {

    @Bean
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        return http
            .authorizeExchange(ex -> ex
                .pathMatchers("/public/**").permitAll()
                .anyExchange().authenticated())
            .httpBasic(withDefaults())
            .build();
    }
}

@Configuration
@EnableWebSecurity
public class CredentialSecurityConfig {

    @Bean
    PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Bean
    UserDetailsService userDetailsService(UserRepository users) {
        return username -> users.findByUsername(username)
                .map(AppUserDetails::new)
                .orElseThrow(() -> new UsernameNotFoundException(username));
    }

    @Bean
    AuthenticationManager authenticationManager(UserDetailsService userDetailsService,
                                                PasswordEncoder passwordEncoder) {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider(userDetailsService);
        provider.setPasswordEncoder(passwordEncoder);
        return new ProviderManager(provider);
    }
}

create table users (
    username varchar(50)  not null primary key,
    password varchar(500) not null,
    enabled  boolean      not null
);
create table authorities (
    username  varchar(50) not null,
    authority varchar(50) not null,
    constraint fk_authorities_users foreign key (username) references users (username)
);
create unique index ix_auth_username on authorities (username, authority);

-- optional group support
create table groups (
    id       bigint generated by default as identity primary key,
    group_name varchar(50) not null
);
create table group_authorities (
    group_id  bigint      not null,
    authority varchar(50) not null,
    constraint fk_group_authorities_group foreign key (group_id) references groups (id)
);
create table group_members (
    id       bigint generated by default as identity primary key,
    username varchar(50) not null,
    group_id bigint      not null,
    constraint fk_group_members_group foreign key (group_id) references groups (id)
);

@Bean
UserDetailsService jdbcUsers(DataSource dataSource) {
    JdbcUserDetailsManager manager = new JdbcUserDetailsManager(dataSource);
    manager.setEnableGroups(true);
    return manager;
}

@Entity
@Table(name = "app_user")
public class AppUser {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    @Column(unique = true, nullable = false)
    private String username;
    @Column(nullable = false)
    private String password;         // already {bcrypt}-encoded
    private boolean enabled = true;
    @ElementCollection(fetch = FetchType.EAGER)
    @CollectionTable(name = "app_user_authority", joinColumns = @JoinColumn(name = "user_id"))
    @Column(name = "authority")
    private Set<String> authorities = new HashSet<>();
    // getters / setters
}

public interface UserRepository extends JpaRepository<AppUser, Long> {
    Optional<AppUser> findByUsername(String username);
}

public class AppUserDetails implements UserDetails {
    private final AppUser user;
    public AppUserDetails(AppUser user) { this.user = user; }
    @Override public Collection<? extends GrantedAuthority> getAuthorities() {
        return user.getAuthorities().stream().map(SimpleGrantedAuthority::new).toList();
    }
    @Override public String getPassword() { return user.getPassword(); }
    @Override public String getUsername() { return user.getUsername(); }
    @Override public boolean isEnabled() { return user.isEnabled(); }
    @Override public boolean isAccountNonExpired() { return true; }
    @Override public boolean isAccountNonLocked() { return true; }
    @Override public boolean isCredentialsNonExpired() { return true; }
}

spring:
  sql:
    init:
      mode: embedded          # run schema.sql/data.sql for embedded DBs; use a migration tool otherwise
  datasource:
    url: jdbc:postgresql://localhost:5432/app
    username: app
    password: app

@Bean
SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/api/**")
        .csrf(csrf -> csrf.disable())
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .securityContext(c -> c.securityContextRepository(new NullSecurityContextRepository()))
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/auth/login").permitAll()
            .anyRequest().authenticated())
        .oauth2ResourceServer(o -> o.jwt(withDefaults()));   // verify our own token -- see below
    return http.build();
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final AuthenticationManager authenticationManager;
    private final TokenService tokenService;   // your JWT signer (e.g. Nimbus / JwtEncoder)

    public AuthController(AuthenticationManager authenticationManager, TokenService tokenService) {
        this.authenticationManager = authenticationManager;
        this.tokenService = tokenService;
    }

    @PostMapping("/login")
    public TokenResponse login(@RequestBody @Valid LoginRequest request) {
        Authentication authentication = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(request.username(), request.password()));
        return new TokenResponse(tokenService.issue(authentication));
    }
}

@Bean
ReactiveAuthenticationManager reactiveAuthenticationManager(
        ReactiveUserDetailsService uds, PasswordEncoder encoder) {
    UserDetailsRepositoryReactiveAuthenticationManager manager =
            new UserDetailsRepositoryReactiveAuthenticationManager(uds);
    manager.setPasswordEncoder(encoder);
    return manager;
}

@Bean
JwtAuthenticationConverter jwtAuthenticationConverter() {
    JwtGrantedAuthoritiesConverter scopes = new JwtGrantedAuthoritiesConverter();   // SCOPE_ prefix

    JwtGrantedAuthoritiesConverter roles = new JwtGrantedAuthoritiesConverter();
    roles.setAuthoritiesClaimName("roles");
    roles.setAuthorityPrefix("ROLE_");

    Converter<Jwt, Collection<GrantedAuthority>> combined = jwt -> {
        Collection<GrantedAuthority> all = new ArrayList<>(scopes.convert(jwt));
        all.addAll(roles.convert(jwt));
        return all;
    };

    JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
    converter.setJwtGrantedAuthoritiesConverter(combined);
    return converter;
}

@Bean
JwtDecoder jwtDecoder(OAuth2ResourceServerProperties properties) {
    NimbusJwtDecoder decoder = NimbusJwtDecoder
            .withIssuerLocation(properties.getJwt().getIssuerUri())
            .build();
    OAuth2TokenValidator<Jwt> withDefaults =
            JwtValidators.createDefaultWithIssuer(properties.getJwt().getIssuerUri());
    OAuth2TokenValidator<Jwt> audience =
            new JwtClaimValidator<List<String>>("aud", aud -> aud.contains("https://api.example.com"));
    decoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(withDefaults, audience));
    return decoder;
}