security:
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        App\Entity\User:
            algorithm: bcrypt
            cost: 13

    # https://symfony.com/doc/current/security/user_providers.html
    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
        # OAuth provider (HWI)
        app_oauth_provider:
            id: App\Security\OAuthUserProvider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        admin:
            pattern: ^/admin(.*)
            context: user
            provider: app_user_provider
            form_login:
                login_path: sonata_user_admin_security_login
                check_path: sonata_user_admin_security_check
                default_target_path: sonata_admin_dashboard
                failure_path: sonata_user_admin_security_login
            logout:
                path: sonata_user_admin_security_logout
                target: sonata_user_admin_security_login
            remember_me:
                secret: '%env(APP_SECRET)%'
                lifetime: 2592000

        main:
            pattern: .*
            provider: app_user_provider
            entry_point: form_login
            # HWI OAuth
            oauth:
                failure_path: /oauth-failure
                login_path: /login
                check_path: /login/check-oauth
                default_target_path: /welcome
                resource_owners:
                    facebook: '/login/check-facebook'
                    google: '/login/check-google'
                oauth_user_provider:
                    service: App\Security\OAuthUserProvider
            form_login:
                login_path: /login
                check_path: /login
                username_parameter: user_compte_login[email]
                password_parameter: user_compte_login[plainPassword]
                use_referer: true
                remember_me: true
                failure_path: /login-user.html
            logout:
                path: /logout
                target: /
            remember_me:
                secret: '%env(APP_SECRET)%'
                lifetime: 2592000
                path: /

    role_hierarchy:
        ROLE_ADMIN:       [ROLE_USER, ROLE_SONATA_ADMIN]
        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    access_control:
        # Login / registration pages accessible anonymously
        - { path: ^/login$,        roles: PUBLIC_ACCESS }
        - { path: ^/register,      roles: PUBLIC_ACCESS }
        - { path: ^/resetting,     roles: PUBLIC_ACCESS }
        - { path: ^/connect,       roles: PUBLIC_ACCESS }

        # Admin area
        - { path: ^/admin/login$,       roles: PUBLIC_ACCESS }
        - { path: ^/admin/logout$,      roles: PUBLIC_ACCESS }
        - { path: ^/admin/login_check$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/resetting,    roles: PUBLIC_ACCESS }
        - { path: ^/admin/,             roles: [ROLE_ADMIN, ROLE_SONATA_ADMIN] }

        # Buyer / Seller profile areas
        - { path: ^/acheteur_vendeur/, roles: [ROLE_ACHETEUR, ROLE_VENDEUR] }
        - { path: ^/vendeur/,   roles: ROLE_VENDEUR }
        - { path: ^/profil-a/,  roles: ROLE_ACHETEUR }
        - { path: ^/profil-v/,  roles: ROLE_VENDEUR }
        - { path: ^/profil-av/, roles: [ROLE_ACHETEUR, ROLE_VENDEUR] }

        # Rest of the site
        - { path: ^/, roles: PUBLIC_ACCESS }

# NOTE: HTTPS is NOT enforced here (requires_channel removed).
# On the production server, HTTPS must be forced at the Apache level
# via public/.htaccess — see the RewriteRule block in that file.
