Spring Security 인증

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())  // REST API
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .sessionManagement(session ->
                session.sessionCreationPolicy(STATELESS)
            );
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

// 비밀번호 저장
@Service
public class AuthService {
    private final PasswordEncoder encoder;

    public void register(String password) {
        String hashed = encoder.encode(password);
        // DB에 hashed 저장
    }

    public boolean verify(String raw, String hashed) {
        return encoder.matches(raw, hashed);
    }
}