Update SecurityConfig to refine request authorization rules

src/main/java/org/example/untitled/HomeController.java

@@ -1,7 +1,9 @@
 package org.example.untitled;
 
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseStatus;
 
 @Controller
 public class HomeController {
@@ -15,4 +17,10 @@ public String landingPage(){
     public String home(){
         return "index";
     }
+
+    @GetMapping("/access-denied")
+    @ResponseStatus(HttpStatus.FORBIDDEN)
+    public String accessDenied() {
+        return "access_denied";
+    }
 }

src/main/java/org/example/untitled/config/SecurityConfig.java

@@ -14,35 +14,44 @@
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 
 @Configuration
 @EnableWebSecurity
 @EnableMethodSecurity
 public class SecurityConfig {
 
     private final UserDetailsService userDetailsService;
+    private final CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;
 
-    public SecurityConfig(UserDetailsService userDetailsService) {
+    public SecurityConfig(UserDetailsService userDetailsService,
+                          CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler) {
         this.userDetailsService = userDetailsService;
+        this.customAuthenticationSuccessHandler = customAuthenticationSuccessHandler;
     }
 
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
         http.authorizeHttpRequests(
-                        auth ->
-                                auth.requestMatchers("/auth/**", "/", "/home", "/images/**", "/style.css", "/upload/**", "/login", "/register")
-                                        .permitAll()
-                                        .anyRequest()
-                                        .authenticated())
+                        auth -> auth
+                                .requestMatchers("/auth/**", "/", "/home", "/images/**", "/style.css",
+                                        "/upload/**", "/login", "/register", "/favicon.ico", "/access-denied")
+                                .permitAll()
+                                .requestMatchers("/admin/**").hasRole("ADMIN")
+                                .requestMatchers("/handler/**").hasAnyRole("HANDLER", "SUPERVISOR", "ADMIN")
+                                .requestMatchers("/user/**").hasRole("USER")
+                                .anyRequest()
+                                .authenticated())
                 .authenticationProvider(authenticationProvider())
                 .formLogin(form -> form
                         .loginPage("/login")
-                        .successHandler(customAuthenticationSuccessHandler())
+                        .successHandler(customAuthenticationSuccessHandler)
                         .permitAll())
                 .logout(logout -> logout
                         .logoutSuccessUrl("/login")
-                        .permitAll());
+                        .permitAll())
+                .exceptionHandling(ex -> ex
+                        .accessDeniedPage("/access-denied"));
+
 
         return http.build();
     }
@@ -63,11 +72,6 @@ public AuthenticationManager authenticationManager(AuthenticationConfiguration c
         }
     }
 
-    @Bean
-    public AuthenticationSuccessHandler customAuthenticationSuccessHandler() {
-        return new CustomAuthenticationSuccessHandler();
-    }
-
     @Bean
     public PasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder();

src/main/java/org/example/untitled/security/CustomAuthenticationSuccessHandler.java

@@ -8,10 +8,12 @@
 import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.security.web.savedrequest.SavedRequest;
+import org.springframework.stereotype.Component;
 
 import java.io.IOException;
 import java.util.Optional;
 
+@Component
 public class CustomAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
 
     private final HttpSessionRequestCache requestCache = new HttpSessionRequestCache();
@@ -40,4 +42,4 @@ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletRespo
         clearAuthenticationAttributes(request);
         getRedirectStrategy().sendRedirect(request, response, targetUrl);
     }
-}
+}

src/main/resources/templates/access_denied.html

@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html xmlns:th="https://www.thymeleaf.org" lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Access Denied</title>
+    <link rel="stylesheet" th:href="@{/style.css}">
+</head>
+<body>
+<div class="page-wrapper">
+    <main>
+        <h1>Access Denied</h1>
+        <p>You do not have permission to view this page.</p>
+        <nav style="margin-top: 20px; display: flex; gap: 10px;">
+            <a th:href="@{/}" class="btn btn-secondary">Go to home</a>
+        </nav>
+    </main>
+</div>
+</body>
+</html>