security:
    password_hashers:
        App\Domain\User\Model\User:
            algorithm: auto
    providers:
        user_provider:
            entity:
                class: App\Domain\User\Model\User
                property: email

    role_hierarchy:
        ROLE_USER: [ROLE_PREVIEW]
        ROLE_REFERENT: [ROLE_USER, ROLE_ALLOWED_TO_SWITCH]
        ROLE_ADMIN: [ROLE_REFERENT]

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        docs:
            pattern: ^/api/docs
            anonymous: ~
        api_login:
            pattern: ^/api/login
            stateless: true
            json_login:
                check_path: api_login
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
        api:
            pattern:   ^/api
            stateless: true
            provider: user_provider
            guard:
                authenticators:
                    - lexik_jwt_authentication.jwt_token_authenticator
        main:
            pattern: ^/
            form_login:
                login_path: /connexion
                check_path: /connexion
            logout:
                path: /deconnexion
                target: /
                invalidate_session: false
            remember_me:
                secret: '%env(APP_SECRET)%'
                lifetime: 604800 # 1 week in seconds
            anonymous: ~
            provider: user_provider
            user_checker: App\Domain\User\Symfony\Security\Checker\UserChecker
            switch_user: true

    access_control:
        # Authentication routes
        - { path: ^/connexion, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/deconnexion, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/mot-de-passe-oublie, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/reinitialisation-de-mot-de-passe, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/public, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/oauth, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        # Referent routes
        - { path: ^/collectivites/liste, roles: ROLE_REFERENT }
        - { path: ^/collectivites/visualiser/.+$, roles: ROLE_REFERENT }
        - { path: ^/collectivites/datatables, roles: ROLE_REFERENT }
        - { path: ^/structures/liste, roles: ROLE_REFERENT }
        - { path: ^/structures/visualiser/.+$, roles: ROLE_REFERENT }
        - { path: ^/structures/datatables, roles: ROLE_REFERENT }
        - { path: ^/utilisateurs/liste, roles: ROLE_REFERENT }
        - { path: ^/utilisateurs/datatables, roles: ROLE_REFERENT }
        - { path: ^profil/mon-compte/services/.+/.+$, roles: ROLE_REFERENT}

        # Admin routes
        - { path: ^/collectivites, roles: ROLE_ADMIN }
        - { path: ^/utilisateurs, roles: ROLE_ADMIN }
        - { path: ^/journalisation, roles: ROLE_ADMIN }
        - { path: ^/traitements/configuration, roles: ROLE_ADMIN }
        - { path: ^/modele-analyse, roles: ROLE_ADMIN }
        - { path: ^/mesure-protection, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/creer$, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/telecharger, roles: ROLE_PREVIEW }
        - { path: ^/espace-documentaire/modifier/.+$, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/supprimer/.+$, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/categorie, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/categorie/creer$, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/categorie/modifier/.+$, roles: ROLE_ADMIN }
        - { path: ^/espace-documentaire/categorie/supprimer/.+$, roles: ROLE_ADMIN }
        - { path: ^/referentiel/.+$, roles: ROLE_ADMIN }
        - { path: ^/duplication/.+$, roles: ROLE_ADMIN }
        # Manager routes
        - { path: ^/.+/creer$, roles: ROLE_USER }
        - { path: ^/.+/creer/.+$, roles: ROLE_USER }
        - { path: ^/.+/modifier/.+$, roles: ROLE_USER }
        - { path: ^/.+/supprimer/.+$, roles: ROLE_USER }
        - { path: ^/.+/supprimer/.+/confirmation$, roles: ROLE_USER }
        - { path: ^/.+/archiver/.+$, roles: ROLE_USER }
        - { path: ^/.+/archiver/.+/confirmation$, roles: ROLE_USER }
        - { path: ^/analyse-impact/validation/.+$, roles: ROLE_USER }
        # API routes
        - { path: ^/api/docs, roles: IS_AUTHENTICATED_ANONYMOUSLY } # Allows accessing API documentations and Swagger UI
        - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/, roles: [ IS_AUTHENTICATED_FULLY ] } #IS_AUTHENTICATED_FULLY

        # Others
        - { path: ^/, roles: IS_AUTHENTICATED_REMEMBERED }
