Код-ревью: конфигурация безопасности

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain chain(HttpSecurity http) throws Exception {
        return http
            .csrf(c -> c.disable())
            .cors(c -> c.configurationSource(req -> {
                CorsConfiguration cfg = new CorsConfiguration();
                cfg.addAllowedOriginPattern("*");
                cfg.setAllowCredentials(true);
                cfg.addAllowedMethod("*");
                return cfg;
            }))
            .authorizeHttpRequests(a -> a
                .requestMatchers("/api/**").authenticated()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/actuator/**").permitAll()
                .anyRequest().permitAll())
            .formLogin(Customizer.withDefaults())
            .build();
    }

    @Bean
    PasswordEncoder encoder() {
        return NoOpPasswordEncoder.getInstance();
    }
}