---
security:
    role_hierarchy:
        class: Aes\Security\CustomRoleHierarchy

    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
            algorithm: md5
            hash_algorithm: md5
            encode_as_base64: false
            iterations: 1
        Aes\Document\UserDocument:
            algorithm: md5
            hash_algorithm: md5
            iterations: 1
            encode_as_base64: false
        Aes\Entity\Legacy\VdmUsers:
            algorithm: md5
            hash_algorithm: md5
            iterations: 1
            encode_as_base64: false
    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        chain_provider:
            chain:
                providers: [ users_in_memory, username_mongodb_provider]
        users_in_memory: { memory: null }
        legacy_user_provider:
            entity:
                class: Aes\Entity\Legacy\VdmUsers

        username_mongodb_provider:
            id: Aes\Security\Provider\UserDocumentProvider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        login:
            pattern: ^/api/(login|signin|sso/token)
            stateless: false
            context: Token
            provider: 'chain_provider'
            user_checker: Aes\Security\UserChecker
            entry_point: Aes\Security\Authenticator\JWTAuthenticator
            custom_authenticators:
                - Aes\Security\Authenticator\JsonLoginAuthenticator
        api:
            pattern: ^/api/
            stateless: false
            provider: 'chain_provider'
            user_checker: Aes\Security\UserChecker
            context: Token
            entry_point: Aes\Security\Authenticator\JWTAuthenticator
            jwt: ~
            logout:
                path: /api/logout
                target: '%env(REALM_SSO_LOGOUT_URL)%'
                invalidate_session: true
                delete_cookies:
                    a: { path: null, domain: null }
                    b: { path: null, domain: null }
        main:
            lazy: true
            provider: users_in_memory

            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#the-firewall

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/api/version,    roles: PUBLIC_ACCESS,           requires_channel: https }
        - { path: ^/api/login,      roles: PUBLIC_ACCESS,           requires_channel: https }
        - { path: ^/api/sso,        roles: PUBLIC_ACCESS,           requires_channel: https }
        - { path: ^/api/callback,   roles: PUBLIC_ACCESS,           requires_channel: https }
        - { path: ^/api/,           roles: IS_AUTHENTICATED_FULLY,  requires_channel: https }

when@test:
    security:
        password_hashers:
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: md5
                hash_algorithm: md5
                encode_as_base64: false
                iterations: 1
            Aes\Document\UserDocument:
                algorithm: md5
                hash_algorithm: md5
                iterations: 1
                encode_as_base64: false
            Aes\Entity\Legacy\VdmUsers:
                algorithm: md5
                hash_algorithm: md5
                iterations: 1
                encode_as_base64: false
