@EnableGlobalMethodSecurity(prePostEnabled = true)对GlobalMethodSecurityConfiguration配置

想着捞一下PrePostAnnotationSecuriityMetadataSoure怎么进去spirng里面的
并且想用这个MetadtaSoure得到全部接口权限，实现简单的swagger代理

@EnableWebSecurity(debug = true)
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

}

看下EnableGlobalMethodSecurity定义

@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE})
@Documented
@Import({GlobalMethodSecuritySelector.class})
@EnableGlobalAuthentication
@Configuration
public @interface EnableGlobalMethodSecurity {
    boolean prePostEnabled() default false;

    boolean securedEnabled() default false;

    boolean jsr250Enabled() default false;

    boolean proxyTargetClass() default false;

    AdviceMode mode() default AdviceMode.PROXY;

    int order() default 2147483647;
}

根据@Import({GlobalMethodSecuritySelector.class})，再看看GlobalMethodSecuritySelector.class类，它的主要方法selectImports

final class GlobalMethodSecuritySelector implements ImportSelector {
    GlobalMethodSecuritySelector() {
    }

    public String[] selectImports(AnnotationMetadata importingClassMetadata) {
        Class<EnableGlobalMethodSecurity> annoType = EnableGlobalMethodSecurity.class;
        Map<String, Object> annotationAttributes = importingClassMetadata.getAnnotationAttributes(annoType.getName(), false);
        AnnotationAttributes attributes = AnnotationAttributes.fromMap(annotationAttributes);
        Assert.notNull(attributes, () -> {
            return String.format("@%s is not present on importing class '%s' as expected", annoType.getSimpleName(), importingClassMetadata.getClassName());
        });
        Class<?> importingClass = ClassUtils.resolveClassName(importingClassMetadata.getClassName(), ClassUtils.getDefaultClassLoader());
        boolean skipMethodSecurityConfiguration = GlobalMethodSecurityConfiguration.class.isAssignableFrom(importingClass);
        AdviceMode mode = (AdviceMode)attributes.getEnum("mode");
        boolean isProxy = AdviceMode.PROXY == mode;
        String autoProxyClassName = isProxy ? AutoProxyRegistrar.class.getName() : GlobalMethodSecurityAspectJAutoProxyRegistrar.class.getName();
        boolean jsr250Enabled = attributes.getBoolean("jsr250Enabled");
        List<String> classNames = new ArrayList(4);
        if (isProxy) {
            classNames.add(MethodSecurityMetadataSourceAdvisorRegistrar.class.getName());
        }

        classNames.add(autoProxyClassName);
        if (!skipMethodSecurityConfiguration) {
            classNames.add(GlobalMethodSecurityConfiguration.class.getName());
        }

        if (jsr250Enabled) {
            classNames.add(Jsr250MetadataSourceConfiguration.class.getName());
        }

        return (String[])classNames.toArray(new String[0]);
    }
}

boolean skipMethodSecurityConfiguration = GlobalMethodSecurityConfiguration.class.isAssignableFrom(importingClass);
与 if (!skipMethodSecurityConfiguration) {
classNames.add(GlobalMethodSecurityConfiguration.class.getName());
}
虽然 skipMethodSecurityConfiguration不是很懂，但是也大概知道了,添加注解@EnableWebSecurity就是开启了安全验证，就会对接口(方法)有拦截，自然跳过方法安全配置是不可能的
所以接着看看
GlobalMethodSecurityConfiguration.class

 @Bean
    public MethodSecurityMetadataSource methodSecurityMetadataSource() {
.....
}```

 后面可以学习学习现在有点晚了