@EnableMethodSecurity enables authorization checks on secured method invocations, helping prevent unauthorized users from invoking protected tools or accessing restricted data. section 10.2
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
// ...
}
Add @EnableMethodSecurity to the security configuration class alongside @Configuration and @EnableWebSecurity. section 10.2
After enabling it, place @PreAuthorize on methods that require authorization. Its SpEL expression must evaluate to true; otherwise Spring Security throws AccessDeniedException before invoking the method. section 10.2
Restricting a tool
Annotate a getGameComplexity tool or Function.apply() method with @PreAuthorize("hasRole('PREMIUM_USER')") to restrict invocation to users with the PREMIUM_USER role. section 10.2
