Suggestion: some reflection based method of supplying HttpSecurity

Feature Request

So I have this,

public interface UserRepository extends PagingAndSortingRepository<User, Long> {
}

protected void configure( final HttpSecurity http ) throws Exception {
    http.authorizeRequests()
            .mvcMatchers( HttpMethod.OPTIONS ).permitAll()
            .mvcMatchers( HttpMethod.GET, "/health" ).permitAll()
            .mvcMatchers( HttpMethod.POST, "/users" ).permitAll()
            .mvcMatchers( "/profile/**" ).permitAll()

and it works fine... well actually I broke it when I set this, which is sort of the crux of my problem, I changed a path and it broke my security.

@Configuration
class RestConfig extends RepositoryRestConfigurerAdapter {

@Override
public void configureRepositoryRestConfiguration( final RepositoryRestConfiguration config ) {
    config.setBasePath( "/v0" );

but I think it would be cool if we could define security like this

 .interfaceMatchers( HttpMethod.POST, UserRepository.class )

or if I had an mvc controller

@Controller
@RequestMapping( "files" )
class FilesController {
    @RequestMapping( method = RequestMethod.GET, value = "/{filename:.+}" )
    public ResponseEntity<?> getFile( @PathVariable final String filename ) throws IOException, MimeTypeException {
        Path path = root.resolve( filename );
        return this.getFile( path );

maybe

 .controllerMatchers( HttpMethod.GET, FilesController.class, "/{filename:.+}" )

or another alternative we could have the following annotation based (maybe this is the best way?)

  .authorizeRequests()
       .annotationBased() // scan classpath
       ...
       .denyAll()                // deny by default, anything not configured by a annotation is not allowed or maybe allow authenticated or other such by default here...
       ... cors()...etc


public interface UserRepository extends PagingAndSortingRepository<User, Long> {

     @HttpSecurity( method = HttpMethod.POST, permitAll = true )
     @Override
     ... save(...);
}

and controller example

@Controller
@RequestMapping( "files" )
class FilesController {

   @HttpSecurity( authenticated = true )
    @RequestMapping( method = RequestMethod.GET, value = "/{filename:.+}" )
    public ResponseEntity<?> getFile( @PathVariable final String filename ) throws IOException, MimeTypeException {
        Path path = root.resolve( filename );
        return this.getFile( path );

or maybe there's a better idea/api for ensure that if I update some parent route all of the security doesn't need to be reaudited. also prepending /v0/ .mvcMatchers( HttpMethod.POST, "/v0/users" ).permitAll() seems like it might get a bit tedious.

Start by reviewing the existing HttpSecurity mvcMatchers API alongside the RepositoryRestConfigurerAdapter base-path configuration and the controller and repository mappings shown here. The issue does not identify files or tests; done would require a decided, tested API for tying security rules to controllers or repositories so route changes do not require manually duplicated paths.