security:
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    enable_authenticator_manager: true
    password_hashers:
#        FOS\UserBundle\Model\UserInterface: sha512
        App\Entity\User:
            algorithm: sha512
    role_hierarchy:
        ROLE_BACKEND: ROLE_DASHBOARD, ROLE_ATS_CONNECTT, ROLE_SELF, ROLE_DAF_JOB_MANAGE, ROLE_ANALYTICS, ROLE_SAAS, ROLE_FCMS_KELJOB, ROLE_FCMS_CADREMPLOI, ROLE_FCMS_INSIDERS, ROLE_FCMS_FIGAROEMPLOI, ROLE_PPA_PUBLISHERS, ROLE_ORGANIC_PUBLISHERS, ROLE_JOB_IA
        ROLE_ATS_CONNECTT: ROLE_DAF
        ROLE_JOB_IA: ROLE_DAF_JOB_MANAGE
        ROLE_IT: ROLE_BACKEND, ROLE_CUSTOM_REPORT, ROLE_DAF_SUBSCRIPTION, ROLE_BUSINESS_OVERVIEW, ROLE_PUBLISHER
        ROLE_SUPER_ADMIN: ROLE_BACKEND, ROLE_ADMIN_SELF, ROLE_IT, ROLE_BRIEF_ADVERTISER_MAPPING, ROLE_USER_MANAGEMENT, ROLE_GLOBAL_COUNTER, ROLE_MONITOR_NOTIF, ROLE_GLOBAL_PARAMETER
    providers:
        #        chain_provider:
        #            chain:
        #              providers: [fos_userbundle]
        #
        #        fos_userbundle:
        #            id: fos_user.user_provider.username

        dashboard_users:
            entity:
                class: App\Entity\User
                property: username

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
#            lazy: true
            pattern: ^/
#            user_checker: App\Security\UserChecker
            form_login:
                provider: dashboard_users
                enable_csrf: true
#                csrf_token_generator: security.csrf.token_manager
                login_path: app_login
                check_path: app_login
                default_target_path: overview
                use_referer: true
            logout:
                path: /logout
                target: app_login
#            anonymous: true
            #logout_on_user_change: true  # Deprecated since 4.1
            remember_me:
                secret: '%env(APP_SECRET)%'
                lifetime: 2592000
                path: /
            provider: dashboard_users
            entry_point: App\Security\AppCustomAuthenticator
            switch_user: { role: ROLE_BACKEND, parameter: _switch_user }
            custom_authenticator: App\Security\AppCustomAuthenticator

    access_denied_url: /
    access_control:
        - { path: ^/login, allow_if: "!is_granted('IS_AUTHENTICATED_FULLY')" }
        - { path: ^/register, role: PUBLIC_ACCESS }
        - { path: ^/register/recover-password, role: PUBLIC_ACCESS }
        - { path: ^/forgot, role: PUBLIC_ACCESS }
        - { path: ^/conditions-generales-wan2bee, role: PUBLIC_ACCESS }
        - { path: ^/send-email, role: PUBLIC_ACCESS }
        - { path: ^/check-email, role: PUBLIC_ACCESS }
        - { path: ^/ats/download-shared/, role: PUBLIC_ACCESS }
        - { path: ^/apply/\d+/scoring-preview, role: PUBLIC_ACCESS,
#            allow_if: '"%kernel.environment%" in ["dev"] or (not("%kernel.environment%" in ["dev"]) and request.headers.has("authorization-token"))'
        }

        # Restricted routes

        # - Access to Advertiser self convert
        - { path: ^/advertiser/\d+/selfconvert, roles: [ROLE_ADMIN_SELF] }
        # - Access to Advertiser section
        - { path: ^/advertiser/\d+/edit, roles: [ROLE_DAF_JOB_MANAGE, ROLE_SAAS] }
        # - Access to Campaign section
        - { path: /advertiser/\d+/campaign|^/ajax/advertiser/\d+/campaign/, roles: [ROLE_SELF, ROLE_ANALYTICS] }
        - { path: ^/campaign/\d+|^/ajax/campaign/\d+, roles: [ROLE_SELF, ROLE_ANALYTICS] }
        # - Access to OI section
        - { path: /advertiser/\d+/OI|^/ajax/advertiser/\d+/OI/, roles: [ROLE_SELF] }
        # - Access to CvLibrary section
        - { path: ^/advertiser/\d+/cvlibrary/form/new, roles: [ROLE_ATS_CONNECTT] }
        - { path: ^/advertiser/\d+/cvlibrary/dafsubscription, roles: [ROLE_DAF_SUBSCRIPTION] }
        - { path: /advertiser/\d+/cvlibrary/, roles: [ROLE_DAF, ROLE_SAAS] }
        - { path: /advertiser/\d+/cvlibrary/form/\d+/ats, roles: [ROLE_ATS_CONNECTT] }
        # - Access to Job section
        - { path: ^/ajax/advertiser/\d+/job/(feedconfig|feed|ftp/downloadfeed|upload/csv/file|update/xslt|get/airflow/task/state|/ajax/testXslt), roles: [ ROLE_BACKEND ] }
        - { path: ^/ajax/advertiser/\d+/job/scrappingconfig/get, roles: [ ROLE_BACKEND ] }
        - { path: ^/ajax/advertiser/\d+/job/scrappingsave, roles: [ ROLE_BACKEND ] }
        - { path: ^/ajax/advertiser/\d+/job/facebookcatalog, roles: [ ROLE_BACKEND ] }
        - { path: ^/ajax/advertiser/\d+/job/dupli, roles: [ ROLE_SELF, ROLE_ANALYTICS ] }
        - { path: ^/ajax/advertiser/\d+/job/scrappingconfig, roles: [ ROLE_BACKEND ] }

        - { path: /advertiser/\d+/job/create|/advertiser/\d+/job/modify|/advertiser/\d+/job/delete, roles: ROLE_DAF_JOB_MANAGE }
        - { path: /advertiser/\d+/job/jobgroup, roles: [ROLE_SELF, ROLE_ANALYTICS, ROLE_ATS_CONNECTT] }
        - { path: /advertiser/\d+/job, roles: [ROLE_DAF, ROLE_SELF, ROLE_DAF_JOB_MANAGE, ROLE_ANALYTICS] }
        # - Access to Analytics section
        - { path: /advertiser/\d+/analytics, roles: [ROLE_ANALYTICS] }
        # - Access to Agency calls
        - { path: ^/agency|^/ajax/agency, roles: [ROLE_BACKEND] }
        # - Access to Admin custom report section
        - { path: ^/admin/custom_report, roles: [ROLE_CUSTOM_REPORT] }
        # - Access to Admin brief mapping section
        - { path: ^/admin/brief/mapping|^/ajax/admin/brief/mapping, roles: [ ROLE_BRIEF_ADVERTISER_MAPPING ] }
        # - Access to Admin business overview section
        - { path: ^/admin/business_overview, roles: [ ROLE_BUSINESS_OVERVIEW ] }
        # - Access to Admin sections
        - { path: ^/mission_control/, roles: [ROLE_BACKEND] }
        # - Access to Admin sections
        - { path: ^/admin, roles: [ROLE_BACKEND] }
        # - Access to ajax Tasks
        - { path: ^/ajax/task, roles: [ROLE_BACKEND] }

        - { path: ^/ajax/advertiser/(country|region|city|region/cities)/get, roles: [ROLE_SELF, ROLE_ANALYTICS] }
        # Access logui route
        - { path: /histo, roles: [ROLE_USER] }
        # Default route
        - { path: ^/overview, roles: [ROLE_DASHBOARD, ROLE_DAF, ROLE_SELF, ROLE_SAAS, ROLE_ANALYTICS, ROLE_DAF_JOB_MANAGE, ROLE_USER] }

#        - { path: ^/AdsOverview|^/StatisticsReport|^/ConversionsReport|^/ContextsReport, roles: ROLE_DASHBOARD }
#        - { path: ^/portal, allow_if: "is_granted('ROLE_DAF') and is_granted('ROLE_SELF')" }
#        - { path: /ats/advertiser/edit|/ats/advertiser/\d+/offers|^/ajax/ats/offers, roles: ROLE_DAF_JOB_MANAGE }
#        - { path: /ats/overview, roles: [ROLE_DAF, ROLE_ANALYTICS, ROLE_DAF_JOB_MANAGE] }
#        - { path: ^/self/advertiser/\d+/analytics|^/ajax/self/advertiser/\d+/analytics, roles: ROLE_ANALYTICS }
#        - { path: /ats/advertiser/\d+/form/\d+/settings, roles: ROLE_DAF }
#        - { path: /ats/advertiser/\d+/form/\d+/|/ajax/ats/advertiser/.*/statistics$|/ajax/ats/applies/instance|/ajax/daf/apply/(doc|pdf|one)$|/ajax/daf/qualif/applies|/ajax/ats/jobs?/applies|^/self/test/pdf/|/ajax/daf/check/new, roles: [ROLE_DAF, ROLE_SAAS] }
#        - { path: ^/self/daf|^/ajax/daf|^/ats|^/ajax/ats|^/ajax/delete, roles: ROLE_DAF }
#        - { path: ^/self/overview|^/self/advertiser|^/ajax/self/advertisers|^/self/test, roles: [ROLE_SELF, ROLE_ANALYTICS] }
#        - { path: ^/ajax/self/campaigns|^/ajax/self/|^/self/jobgroup|^/ajax/self/jobgroup|^/ajax/self/advertiser/jobgroup|^/self/campaign/advertiser, roles: [ROLE_ANALYTICS, ROLE_SELF] }
#        - { path: ^/self|^/ajax/self, roles: ROLE_SELF }
#        - { path: ^/, roles: [ROLE_DASHBOARD, ROLE_DAF, ROLE_SELF, ROLE_SAAS, ROLE_ANALYTICS, ROLE_DAF_JOB_MANAGE, ROLE_USER] }
