security:
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        App\Entity\User: 'auto'
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
    
    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        app_user_provider:
            id: App\Security\LoginIdentifierUserProvider
    
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        
        # Geocoding proxy must be public (no JWT)
        api_geocode:
            pattern: ^/api/geocode
            stateless: true
            security: false

        api_transports:
            pattern: ^/api/transports
            stateless: true
            security: false

        # API endpoints
        api_login:
            pattern: ^/api/login
            stateless: true
            provider: app_user_provider
            user_checker: App\Security\UserChecker
            json_login:
                check_path: /api/login_check
                username_path: email
                password_path: password
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: App\Security\FrenchLoginAuthenticationFailureHandler
        
        api_register:
            pattern: ^/api/register
            stateless: true
            security: false
        
        api_verify_email:
            pattern: ^/api/verify-email
            stateless: true
            security: false
        
        api_resend_verification:
            pattern: ^/api/resend-verification
            stateless: true
            security: false

        api_forgot_password:
            pattern: ^/api/forgot-password
            stateless: true
            security: false

        api_provider_forgot_password_options:
            pattern: ^/api/provider-forgot-password/options
            stateless: true
            security: false

        api_reset_password:
            pattern: ^/api/reset-password
            stateless: true
            security: false

        api_password_check:
            pattern: ^/api/password/check
            stateless: true
            security: false
        
        api_oauth:
            pattern: ^/api/oauth
            stateless: false
            security: false
        
        # Firewalls spécifiques (doivent être avant le firewall général ^/api)
        api_providers:
            pattern: ^/api/providers
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_provider:
            pattern: ^/api/provider(?!s)
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_categories:
            pattern: ^/api/categories
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_found_objects:
            pattern: ^/api/found-objects
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_upload:
            pattern: ^/api/upload
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_icons:
            pattern: ^/api/icons
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_users:
            pattern: ^/api/users
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator

        api_announcements_auth:
            pattern: ^/api/announcements
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        api_provider_templates:
            pattern: ^/api/provider-templates
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator

        api_public:
            pattern: ^/api/public
            stateless: true
            security: false

        # Pages Open Graph pour partage Facebook (hors JWT)
        share_pages:
            pattern: ^/share/
            stateless: true
            security: false

        # Mode maintenance : route publique en lecture, écriture protégée par token applicatif dans le contrôleur.
        api_maintenance_mode:
            pattern: ^/api/maintenance-mode
            stateless: true
            security: false

        
        # Firewall général pour tous les autres endpoints API
        api:
            pattern: ^/api
            stateless: true
            custom_authenticators:
                - App\Security\TokenAuthenticator
        
        main:
            lazy: true
            provider: app_user_provider
            form_login:
                login_path: /admin/login
                check_path: /admin/login_check
                default_target_path: /admin
                always_use_default_target_path: true
            logout:
                path: /admin/logout
                target: /admin/login

        admin:
            pattern: ^/admin
            lazy: true
            provider: app_user_provider
            form_login:
                login_path: admin_login
                check_path: admin_login_check
                username_parameter: _username
                password_parameter: _password
                default_target_path: admin
                always_use_default_target_path: true
            logout:
                path: admin_logout
                target: admin_login

    # Easy way to control access for large sections of your site
    access_control:
        # Preflight CORS : doit rester public avant les règles ^/api/* exigeant un rôle
        - { path: ^/api, roles: PUBLIC_ACCESS, methods: [OPTIONS] }
        - { path: ^/api/geocode, roles: PUBLIC_ACCESS }
        - { path: ^/api/transports, roles: PUBLIC_ACCESS }
        - { path: ^/api/login, roles: PUBLIC_ACCESS }
        - { path: ^/api/register, roles: PUBLIC_ACCESS }
        - { path: ^/api/verify-email, roles: PUBLIC_ACCESS }
        - { path: ^/api/resend-verification, roles: PUBLIC_ACCESS }
        - { path: ^/api/forgot-password, roles: PUBLIC_ACCESS }
        - { path: ^/api/provider-forgot-password/options, roles: PUBLIC_ACCESS }
        - { path: ^/api/reset-password, roles: PUBLIC_ACCESS }
        - { path: ^/api/password/check, roles: PUBLIC_ACCESS }
        - { path: ^/api/oauth, roles: PUBLIC_ACCESS }
        - { path: ^/api/public, roles: PUBLIC_ACCESS }
        - { path: ^/share/, roles: PUBLIC_ACCESS }
        - { path: ^/api/google-reviews-config, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/google-reviews-config, roles: ROLE_SUPER_ADMIN, methods: [PUT] }
        - { path: ^/api/home-announcement-theme, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/home-announcement-theme, roles: ROLE_SUPER_ADMIN, methods: [PUT] }
        - { path: ^/api/frontend-ui-config, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/frontend-ui-config, roles: ROLE_SUPER_ADMIN, methods: [PUT] }
        - { path: ^/api/home-splash-screen, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/home-splash-screen, roles: ROLE_SUPER_ADMIN, methods: [PUT, POST] }
        - { path: ^/api/home-ticker-announcements, roles: ROLE_SUPER_ADMIN }
        # Mode maintenance (kill switch) : protégé par token applicatif dans le contrôleur.
        - { path: ^/api/maintenance-mode, roles: PUBLIC_ACCESS }
        - { path: ^/api/admin/stripe, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/monitoring, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/delivery, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/delivery-pricing, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/messaging-settings, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/matchings, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/announcements, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/dashboard, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/city-transport-apis, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/maintenance, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/maintenance-mode, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/logs, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/phpinfo, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/public/url-redirects, roles: PUBLIC_ACCESS }
        - { path: ^/api/admin/url-redirects, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/admin/email-tests, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api/categories, roles: PUBLIC_ACCESS }
        - { path: ^/api/delivery/stripe/webhook, roles: PUBLIC_ACCESS }
        - { path: ^/api/delivery/pricing, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/delivery/carrier-logo, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/announcements, roles: PUBLIC_ACCESS }
        - { path: ^/api/messages, roles: ROLE_USER }
        - { path: ^/api/matches, roles: ROLE_USER }
        - { path: ^/api/user-matches, roles: ROLE_USER }
        - { path: ^/api/providers/provider/info, roles: [ROLE_PROVIDER, ROLE_LOCATION_ADMIN, ROLE_SUPER_ADMIN] }
        # Fiche / mise à jour d’un prestataire précis : contrôle d’appartenance dans le contrôleur (pas seulement l’admin).
        - { path: '^/api/providers/\d+/logo$', roles: [ROLE_PROVIDER, ROLE_LOCATION_ADMIN, ROLE_SUPER_ADMIN] }
        - { path: '^/api/providers/\d+/private-page-logo-layout$', roles: ROLE_SUPER_ADMIN }
        - { path: '^/api/providers/\d+$', roles: [ROLE_PROVIDER, ROLE_LOCATION_ADMIN, ROLE_SUPER_ADMIN] }
        - { path: ^/api/providers, roles: ROLE_SUPER_ADMIN }
        - { path: ^/api, roles: ROLE_USER }
        - { path: ^/admin/login, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login_check, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_ADMIN }

when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon
