security:
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        chain_provider:
            chain:
                providers: [app_user_provider, app_user_provider_customer, app_clients]
                
        app_user_provider:
            entity:
                class: App\Entity\Users
                property: username
                manager_name: default

        app_user_provider_customer:
            entity:
                class: App\User\Users
                property: username
                manager_name: customer

        app_clients:
            entity:
                class: App\Entity\Client
                property: email
                manager_name: default

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        admin:
            pattern: ^/admin
            remember_me:
                secret:   '%kernel.secret%' # required
                lifetime: 604800 # 1 week in seconds

            entry_point: App\Security\UserAuthenticator

            lazy: true
            provider: app_user_provider
            custom_authenticator: App\Security\UserAuthenticator

            form_login:
                login_path: app_login
                check_path: app_login_check
                default_target_path: admin

            logout:
                path: app_logout
                # where to redirect after logout
                target: /admin/login

        client:
            pattern: ^/
            remember_me:
                secret:   '%kernel.secret%' # required
                lifetime: 604800 # 1 week in seconds

            entry_point: App\Security\ClientAuthenticator

            lazy: true
            provider: app_clients
            custom_authenticator: App\Security\ClientAuthenticator

            form_login:
                login_path: app_connexion
                check_path: app_connexion_check
                default_target_path: app_client_detail

            logout:
                path: app_deconnexion
                target: /connexion

            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#the-firewall

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true
        user:
            pattern: ^/admin
            remember_me:
                secret:   '%kernel.secret%' # required
                lifetime: 604800 # 1 week in seconds

            entry_point: App\Security\UserAuthenticator

            lazy: true
            provider: app_user_provider_customer
            custom_authenticator: App\Security\UserAuthenticator

            form_login:
                login_path: app_login
                check_path: app_login_check
                default_target_path: admin

            logout:
                path: app_logout
                target: /admin/login

    role_hierarchy:
        ROLE_MID:   ROLE_MID_ACESS
        ROLE_ADMIN:  ['ROLE_ADMIN','ROLE_MID','ROLE_REF','ROLE_REDACT','ROLE_DEV','ROLE_SERV_CLIENT','ROLE_RH','ROLE_CLIENT']
        ROLE_DEV: ['ROLE_MID','ROLE_DEV']
        ROLE_REF: ['ROLE_MID','ROLE_REF']
        ROLE_REDACT: ['ROLE_MID','ROLE_REDACT']
        ROLE_SERV_CLIENT: ['ROLE_SERV_CLIENT']
        ROLE_RH: ['ROLE_RH','ROLE_MID']
        ROLE_CLIENT: ['ROLE_CLIENT']
        CLIENT_USER: ['CLIENT_USER']

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/client/profile, roles: ['CLIENT_USER','ROLE_USER'] }
        - { path: ^/adresses, roles: ROLE_USER }
        - { path: ^/checkout, roles: ROLE_USER }
        - { path: ^/panier, roles: ROLE_USER }
        - { path: ^/admin$, roles: ['ROLE_MID','ROLE_ADMIN','ROLE_DEV','ROLE_REF','ROLE_REDACT','ROLE_SERV_CLIENT','ROLE_RH','ROLE_CLIENT'] }

when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon
