framework:
    rate_limiter:
        # define 2 rate limiters (one for username+IP, the other for IP)
        username_ip_login:
            policy: token_bucket
            limit: 5
            rate: { interval: '5 minutes' }

        ip_login:
            policy: sliding_window
            limit: 50
            interval: '15 minutes'

services:
    # our custom login rate limiter
    app.login_rate_limiter:
        class: Symfony\Component\Security\Http\RateLimiter\DefaultLoginRateLimiter
        arguments:
            # globalFactory is the limiter for IP
            $globalFactory: '@limiter.ip_login'
            # localFactory is the limiter for username+IP
            $localFactory: '@limiter.username_ip_login'

security:
    enable_authenticator_manager: true
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
        App\Entity\User:
            algorithm: auto

    #roles hierarchy
    role_hierarchy:
        #ROLE ELEVE
        ROLE_STUDENT:           ROLE_USER
        #ROLE FORMATEUR
        ROLE_INSTRUCTOR:        ROLE_USER
        #ROLE (SECRETAIRE,...ETC)
        ROLE_ADMINISTRATIVE:    ROLE_USER
        #ROLE GERANT
        ROLE_MANAGER:           [ROLE_ADMINISTRATIVE, ROLE_USER]
        #ROLE ADMINSTRATEUR
        ROLE_ADMIN:             [ROLE_MANAGER, ROLE_ADMINISTRATIVE, ROLE_INSTRUCTOR, ROLE_STUDENT, ROLE_USER]
        #ROLE SUPER ADMINSTRATEUR
        ROLE_SUPER_ADMIN:       [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
        debug: { memory: { users: {'devs_debug': { password: '%env(APP_DEBUG_PWD)%', roles: [ROLE_DEBUG] }}}} # Used for : ^/_profiler/ ; login: devs_debug
        # used to reload user from session & other features (e.g. switch_user)
        api_partner_provider:
            entity:
                class: App\Entity\User
                property: partnerApiKeys


    firewalls:
        debug:
            pattern: ^/_profiler/
            provider: debug
            http_basic: { realm: "Only for the best!" }
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        api_partner:
            custom_authenticators:
                - App\Security\Guard\ApiPartnerAuthenticator
            pattern: ^/api/partners/
            stateless: true
            provider: api_partner_provider

        main:
            lazy: true
            provider: app_user_provider
            form_login:
                login_path:  /login
                check_path:  /login
                enable_csrf: false
            switch_user: { role: CAN_SWITCH_USER, parameter: _i_am_this_user }
            logout:
                path: app_logout
            # use a custom rate limiter via its service ID
            login_throttling:
                limiter: app.login_rate_limiter
            remember_me:
                secret:   '%kernel.secret%' # required
                lifetime: 604800 # 1 week in seconds
                # by default, the feature is enabled by checking a
                # checkbox in the login form (see below), uncomment the
                # following line to always enable it.
                #always_remember_me: true
                
    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/connexion$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/inscription, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/, role: ROLE_ADMIN }
        - { path: ^/administratif/, role: ROLE_ADMINISTRATIVE }
        - { path: ^/gerant/, role: ROLE_MANAGER }
        - { path: ^/moniteur/, role: ROLE_INSTRUCTOR }
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        
        #- is authenticated fully        
        - { path: ^/api/partners/establishments, roles: IS_AUTHENTICATED_FULLY }
        #- { path: ^/eleve/, role: ROLE_STUDENT }
        #- { path: ^/_profiler/, role: ROLE_DEBUG }


when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon
