security:
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    enable_authenticator_manager: true
    encoders:
        Symfony\Component\Security\Core\User\User: plaintext

    providers:
        users:
            entity:
                # the class of the entity that represents users
                class: 'App\Entity\Rights'
                # the property to query by - e.g. username, email, etc
                property: 'name'
        customers:
            entity:
                # the class of the entity that represents users
                class: 'App\Entity\Credentials'
                # the property to query by - e.g. username, email, etc
                property: 'email'
        all_users:
            chain:
                providers: ['customers', 'users']

    firewalls:
        main:
            pattern: ^/files
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: true

        user_login:
            pattern: ^/user/login
            provider: "all_users"
            stateless: true
            json_login:
                username_path: name
                password_path: pwd
                check_path: /user/login
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
            guard:
                authenticators:
                    - App\Security\UserAuthenticator
        customer_login:
            pattern: ^/customer/login
            provider: "customers"
            stateless: true
            json_login:
                username_path: email
                password_path: passwordHash
                check_path: /customer/login
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
            guard:
                authenticators:
                    - App\Security\CustomerAuthenticator
        refresh:
            pattern: /api/token/refresh
            provider: "all_users"
            refresh_jwt:
                check_path: /api/token/refresh
        api:
            pattern:  ^/
            stateless: true
            jwt: ~
            provider: all_users
      
            # activate different ways to authenticate

            # http_basic: true
            # https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate

            # form_login: true
            # https://symfony.com/doc/current/security/form_login_setup.html

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/carsharing/user/open, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/(login|token/refresh), roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/user/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/voucher/valid, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/document, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/drivecheck, roles: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST]}
        - { path: ^/ratetypes, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/mandant, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/damagepicture, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/config, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/support, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/log, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/customer/registration/fee, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/customer/reset_password, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/customer/reset_pin, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/customer, roles: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST, GET]}
        - { path: ^/login/cardreader, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/params, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/salutations, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/customer/email/check, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/pictogram/*, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/group/picture/*, roles: IS_AUTHENTICATED_ANONYMOUSLY}
        - { path: ^/api/doc, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/_profiler, roles: IS_AUTHENTICATED_ANONYMOUSLY, ips:  [ 127.0.0.1,'90.153.5.135', '192.168.0.0/16' ] }
        - { path: ^/_profiler, roles: ROLE_NO_ACCESS }
        - { path: ^/, roles: IS_AUTHENTICATED_FULLY  }

