Reactive equivalents for security expression handling and url-based access control

Summary

In the new thymeleaf-extras-springsecurity5 I'm trying to make all the functionality already existing for Servlet-based applications available also for WebFlux ones.

But I'm unable to find in the reactive side of Spring Security any equivalents for the functionality providen by SecurityExpressionHandler<FilterInvocation> or WebInvocationPrivilegeEvaluator in Servlet-based web applications. These allow Thymeleaf to evaluate Spring Security expressions such as hasRole(x), and also perform url-based access control (privilege evaluator).

Also, digging into Spring Security's code, I cannot find any infrastructure for quickly developing reactive equivalents to these. For example, not only there seems to be no reactive object to be used as an expression evaluation root, but actually there is no reactive invocation class --let's say a hypothetic WebFilterInvocation-- that would encapsulate the equivalent ServerWebExchange in order to support matching operations…

Am I looking in the wrong place (the spring-security-web module)? Was this left out on purpose? If not, maybe with some detail on what would be needed I might be able to help, at least with the not-so-low-level infrastructure...

Version

Spring Security 5.1.0.BUILD-SNAPSHOT

Start by reading the spring-security-web module and the existing SecurityExpressionHandler and WebInvocationPrivilegeEvaluator APIs, then compare them with the reactive ServerWebExchange APIs. Determine what reactive equivalents are required for expression evaluation and URL-based access control, and define completion as documented reactive infrastructure supporting both capabilities.