Autenticación vs. Autorización: los dos ejes que todo backend confunde

// The heart of role-based authorization
private fun cognitoGroupsConverter(): JwtAuthenticationConverter {
    val converter = JwtAuthenticationConverter()
    converter.setJwtGrantedAuthoritiesConverter { jwt ->
        val groups = jwt.getClaimAsStringList("cognito:groups") ?: emptyList()
        groups.map { SimpleGrantedAuthority("ROLE_$it") } // ADMIN -> ROLE_ADMIN
    }
    return converter
}

auth.requestMatchers(POST,   "/notes").hasRole("USER")       // any signed-in user writes notes
auth.requestMatchers(DELETE, "/notes/**").hasRole("USER")    // ...ownership is checked later, in the service
auth.requestMatchers(DELETE, "/users/**").hasRole("ADMIN")   // only a moderator removes accounts

fun deleteNote(noteId: Long, username: String) {
    val note = noteRepository.findById(noteId)
        .orElseThrow { NoteNotFoundException(noteId) }

    // The "ownership" 403: right role, but this row is NOT yours
    if (note.username != username) {
        throw NotYourNoteException("Note $noteId belongs to ${note.username}")
    }
    noteRepository.delete(note)
}

@DeleteMapping("/notes/{id}")
fun delete(@PathVariable id: Long, @AuthenticationPrincipal jwt: Jwt) =
    noteService.deleteNote(id, jwt.getClaimAsString("username"))