عرض عملي: تأمين Shop API نقطة نهاية بنقطة نهاية

خطوة بخطوة

1. Add the Spring Security starter and see every endpoint become locked (401).
2. Write the chain: catalog GET public, cart and orders authenticated, catalog writes admin only.
3. Add DbUserDetailsService and seed one customer and one admin.
4. Planned mistake: put .anyRequest().permitAll() while debugging and forget it. Fix: replace with authenticated() and add a test that fails if an endpoint is open.
5. Add the 401 and 403 handlers with Problem Details.
6. Call each endpoint with curl as anonymous, customer, and admin.