update

src/main/java/com/yaoyuan/jiscuss/config/WebSecurityConfig.java

@@ -16,7 +16,7 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
+import org.springframework.security.web.access.expression.DefaultHttpSecurityExpressionHandler;
 import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
 
 /**
@@ -69,7 +69,7 @@ public class WebSecurityConfig {
      * <p>Security decisions:
      * <ul>
      *   <li>H2 console: only accessible when enabled (dev profile) and requires ROLE_ADMIN</li>
-     *   <li>Druid monitoring: requires ROLE_ADMIN (Druid also has its own login page)</li>
+        *   <li>Druid monitoring: requires ROLE_ADMIN through Spring Security</li>
      *   <li>Admin/Actuator paths: requires ROLE_ADMIN</li>
      *   <li>SpringDoc UI paths: public (API docs are for developers)</li>
      *   <li>All other authenticated requests: evaluated by {@code RbacPermission.hasPermission}</li>
@@ -89,7 +89,7 @@ public class WebSecurityConfig {
         }
 
         // Build the RBAC expression manager with ApplicationContext so @bean references work
-        DefaultWebSecurityExpressionHandler expressionHandler = new DefaultWebSecurityExpressionHandler();
+        DefaultHttpSecurityExpressionHandler expressionHandler = new DefaultHttpSecurityExpressionHandler();
         expressionHandler.setApplicationContext(applicationContext);
         WebExpressionAuthorizationManager rbacManager = new WebExpressionAuthorizationManager(
                 "@rbacPermission.hasPermission(request, authentication)");