security:
  encoders:
    App\Entity\User:
      algorithm: bcrypt
    App\Entity\Guardian:
      algorithm: bcrypt

  # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
  providers:
    # used to reload user from session & other features (e.g. switch_user)
    app_user_provider:
      entity:
        class: App\Entity\User
        property: adminssion_number

    api_key_user_provider:
      entity:
        class: App\Entity\User
        property: apiKey

    app_guardian_provider:
      entity:
        class: App\Entity\Guardian
        property: name

    # used to reload user from session & other features (e.g. switch_user)

  role_hierarchy:
    ROLE_ADMIN: [ROLE_STUDENT_MANAGER,ROLE_STUDENT_ENROLMENT,ROLE_TEACHER_MANAGER,ROLE_GUARDIAN_MANAGER,ROLE_ATTENDANCE_MANAGER,ROLE_EXAMINATION_MANAGER,ROLE_EXAMINATION_CHECKER,ROLE_SETTING_MANAGER,ROLE_STAFF_MANAGER,ROLE_ACCOUNTANT,ROLE_INVENTOR,ROLE_GUARDIAN,ROLE_TEACHER,ROLE_STAFF,ROLE_ADMIN,ROLE_STUDENT,ROLE_LIBRARIAN]
    ROLE_DEVELOPER: [ROLE_ADMIN]

  firewalls:

    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false

    api:
      pattern: ^/api/
      provider: api_key_user_provider
      stateless: true
      guard:
        authenticators:
          - App\Security\ApiLoginAuthAuthenticator

    #    default:
    #      anonymous: ~
    #      provider: app_user_provider
    #      guard:
    #        authenticators:
    #          - App\Security\UserLoginAuthenticator

    main:
      anonymous: true
      provider: app_user_provider
      guard:
        ## multiple providers.
        authenticators:
          - App\Security\UserLoginAuthenticator
        ## entry provider - when a user try to access authorized page then system will redirect to this Providers
        entry_point: App\Security\UserLoginAuthenticator

      ## logout route name
      logout:
        path: security_logout
        target: user_login

      remember_me:
        secret:   '%kernel.secret%'
        lifetime: 604800 # 1 week in seconds
        path:     /

      ## login to different user email
      switch_user: true

      # activate different ways to authenticate
      # https://symfony.com/doc/current/security.html#firewalls-authentication

  # Easy way to control access for large sections of your site
  # Note: Only the *first* access control that matches will be used
  access_control:
    - { path: '^/', roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: '^/api', roles: ROLE_API_USER }
    - { path: '^/^', roles: ROLE_USER }

