import static org.springframework.security.web.util.matcher.ServletRequestMatcherBuilders.servletPath;

@Bean 
SecurityFilterChain webSecurity(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests((authorize) -> authorize
            .requestMatchers(servletPath("/graphql").anyRequest()).hasRole("GRAPHQL")
            .requestMatchers(servletPath("/mvc").pattern("/these/**", "/endpoints/**")).hasRole("USER")
            .requestMatchers(servletPath("/mvc").pattern("/admin/**")).hasRole("ADMIN")
        // ....

    return http.build();
}

@Bean 
RequestMatcherBuilder mvcOnly() {
    return ServletRequestMatcherBuilders.servletPath("/mvc");
}

@Bean 
SecurityFilterChain webSecurity(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests((authorize) -> authorize
            .requestMatchers(antPattern("/graphql/**")).hasRole("GRAPHQL")
            .requestMatchers("/these/**", "/endpoints/**").hasRole("USER")
            .requestMatchers("/admin/**").hasRole("ADMIN")
        // ....

    return http.build();
}