security:
  # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
  password_hashers:
    App\Entity\User:
      # the new hasher, along with its options
      algorithm: sha512
      encode_as_base64: true
      iterations: 10
    Symfony\Component\Security\Core\User\InMemoryUser:
      algorithm: bcrypt
  providers:
    user_provider:
      id: App\Security\UserProvider
    api_client_provider:
      id: App\Security\ApiClientProvider
    in_memory:
      memory:
        users:
          apidoc:
            {
              password: "$2a$12$SdXrIZ/VbxU0vkDzvSodb.Cb1V.gFOhbgYhstnEGi1TAgMAWd5aBa",
              roles: "ROLE_USER",
            }
          # password: 'apidoc_password'
  firewalls:
    client_doc:
      pattern: ^/api/client/doc
      security: false
    api_client:
      pattern: ^/api/client
      stateless: true
      provider: api_client_provider
      custom_authenticators:
        - App\Security\ApiKeyAuthenticator
      entry_point: App\Security\ApiKeyAuthenticator
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    login:
      pattern: ^/api/login
      stateless: true
      json_login:
        provider: user_provider
        check_path: /api/login_check
        success_handler: app.listener.authentication_success_response
        failure_handler: lexik_jwt_authentication.handler.authentication_failure
      # activate different ways to authenticate
      # https://symfony.com/doc/current/security.html#the-firewall

      # https://symfony.com/doc/current/security/impersonating_user.html
      # switch_user: true
    register:
      pattern: ^/register
      stateless: true
      security: false

    doc:
      pattern: ^/api/doc$
      http_basic:
        realm: "Secured Trackingpremium API Documentation"
        provider: in_memory
    api:
      pattern: ^/api
      stateless: true
      provider: user_provider
      jwt:
        authenticator: app.custom_authenticator
      entry_point: jwt
      refresh_jwt:
        check_path: gesdinet_jwt_refresh_token
        success_handler: app.listener.authentication_success_response
      access_denied_handler: App\Security\AccessDeniedHandler

  # Easy way to control access for large sections of your site
  # Note: Only the *first* access control that matches will be used
  access_control:
    # - { path: ^/admin, roles: ROLE_ADMIN }
    # - { path: ^/profile, roles: ROLE_USER }
    # - { path: ^/api/token/refresh, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/api/doc, roles: ROLE_USER }
    - { path: ^/api/client/doc, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - {
        path: ^/api/(login|token/refresh|doc),
        roles: IS_AUTHENTICATED_ANONYMOUSLY,
      }
    - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/api/client, roles: IS_AUTHENTICATED_FULLY }
    - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
    - { path: ^/public/, roles: IS_AUTHENTICATED_ANONYMOUSLY }
  role_hierarchy:
    ROLE_ADMIN: [ROLE_USER]

when@test:
  security:
    password_hashers:
      # By default, password hashers are resource intensive and take time. This is
      # important to generate secure password hashes. In tests however, secure hashes
      # are not important, waste resources and increase test times. The following
      # reduces the work factor to the lowest possible values.
      Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
        algorithm: auto
        cost: 4 # Lowest possible value for bcrypt
        time_cost: 3 # Lowest possible value for argon
        memory_cost: 10 # Lowest possible value for argon

parameters:
  templates: "%kernel.project_dir%/templates"
