security:
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\User
                # property: username
                property: email

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # API firewall with JWT authentication (stateless)
        api:
            pattern: ^/api
            stateless: true
            provider: app_user_provider
            jwt: ~

        main:
            lazy: true
            provider: app_user_provider

            # Form login configuration
            form_login:
                login_path: app_login
                check_path: app_login
                enable_csrf: true
                default_target_path: app_dashboard_redirect
                username_parameter: email
                password_parameter: password

            # Logout configuration
            logout:
                path: app_logout
                target: app_login

            # Remember me configuration (extends session beyond 7 days default)
            remember_me:
                secret: '%kernel.secret%'
                lifetime: '%env(int:REMEMBER_ME_LIFETIME)%' # 14 days - extends session when checkbox is checked
                path: /
                always_remember_me: false # User must explicitly check "Remember me"
                remember_me_parameter: _remember_me

            # Login throttling to prevent brute force attacks
            login_throttling:
                max_attempts: 5
                interval: '15 minutes'

            # Allow admin to impersonate users
            switch_user: { role: ROLE_ADMIN, parameter: _switch_user }

    # Role hierarchy
    role_hierarchy:
        ROLE_ADMIN: [ROLE_MANAGER, ROLE_EMPLOYER, ROLE_USER]
        ROLE_MANAGER: [ROLE_EMPLOYER, ROLE_USER]
        ROLE_EMPLOYER: [ROLE_USER]

    # Access control rules
    # Note: Only the *first* access control that matches will be used
    access_control:
        # API public routes (accessible without authentication)
        - { path: ^/api/login, roles: PUBLIC_ACCESS }
        - { path: ^/api/password, roles: PUBLIC_ACCESS }
        - { path: ^/api/doc, roles: PUBLIC_ACCESS }
        - { path: ^/api/version/check, roles: PUBLIC_ACCESS }

        # Mobile API public routes (accessible without authentication)
        - { path: ^/api/mobile/auth/login, roles: PUBLIC_ACCESS }
        - { path: ^/api/mobile/auth/2fa, roles: PUBLIC_ACCESS }
        - { path: ^/api/mobile/auth/refresh, roles: PUBLIC_ACCESS }
        - { path: ^/api/mobile/telemetry, roles: PUBLIC_ACCESS }
        - { path: ^/api/mobile/logs, roles: PUBLIC_ACCESS }
        - { path: ^/api/mobile/diagnostics, roles: PUBLIC_ACCESS }

        # API protected routes (require JWT token)
        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

        # Web public routes (accessible to everyone)
        - { path: ^/$, roles: PUBLIC_ACCESS }
        - { path: ^/login, roles: PUBLIC_ACCESS }
        - { path: ^/password-reset, roles: PUBLIC_ACCESS }
        - { path: ^/2fa, roles: PUBLIC_ACCESS }
        - { path: ^/security/validate-ip, roles: PUBLIC_ACCESS }
        - { path: ^/security/validate-country, roles: PUBLIC_ACCESS }

        # Companies management (accessible to ROLE_EMPLOYER and above, scoped by CompanyVoter)
        - { path: ^/companies, roles: ROLE_EMPLOYER }

        # Admin routes (all other admin routes require ROLE_ADMIN)
        - { path: ^/admin, roles: ROLE_ADMIN }

        # Manager routes
        - { path: ^/manager, roles: ROLE_MANAGER }

        # Employer routes
        - { path: ^/employer, roles: ROLE_EMPLOYER }

        # Profile and settings (authenticated users)
        - { path: ^/profile, roles: ROLE_USER }

when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon
