Spring Security基于角色的授权功能失效问题求助

各位好，我正在一个Spring Boot演示项目里集成Spring Security，已经按照下面的代码配置了基于URL的角色授权，但现在遇到了两个棘手的问题：

• 拥有MANAGER和ADMIN角色的用户，居然没法访问GET类型的员工API；
• 用ADMIN角色的用户尝试访问DELETE API时，直接返回403 Forbidden错误。

我翻来覆去检查了好几遍配置，还是没找到问题所在，麻烦大家帮忙看看我的代码哪里出问题了！

@Configuration
public class DemoSecurityConfig {

    @Bean
    public InMemoryUserDetailsManager userDetailsManager() {

        UserDetails john = User.builder()
                .username("john")
                .password("{noop}test123")
                .roles("EMPLOYEE")
                .build();

        UserDetails mary = User.builder()
                .username("mary")
                .password("{noop}test123")
                .roles("EMPLOYEE, MANAGER")
                .build();

        UserDetails susan = User.builder()
                .username("susan")
                .password("{noop}test123")
                .roles("EMPLOYEE, MANAGER, ADMIN")
                .build();

        return new InMemoryUserDetailsManager(john, mary, susan);
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

        http.authorizeHttpRequests(configurer ->
                configurer
                        .requestMatchers(HttpMethod.GET, "/api/employees/").hasRole("EMPLOYEE")
                        .requestMatchers(HttpMethod.GET, "/api/employees/**").hasRole("EMPLOYEE")
                        .requestMatchers(HttpMethod.POST, "/api/employees").hasRole("MANAGER")
                        .requestMatchers(HttpMethod.PUT, "/api/employees/**").hasRole("MANAGER")
                        .requestMatchers(HttpMethod.DELETE, "/api/employees/**").hasRole("ADMIN")
        );

        http.httpBasic(Customizer.withDefaults());
        http.csrf(csrf -> csrf.disable());

        return http.build();
    }
}

谢谢大家的帮忙！

备注：内容来源于stack exchange，提问作者Abhishek Satyavolu