security:
    encoders:
        App\Entity\User: bcrypt

    # https://symfony.com/doc/current/book/security.html#where-do-users-come-from-user-providers
    providers:
        database_users:
            entity:
                class: App\Entity\User

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        secured_area:
            # this firewall applies to all URLs
            pattern: ^/

            # make sure only allowed users have access to their time-tracking
            user_checker: App\Security\UserChecker

            # but the firewall does not require login on every page
            # denying access is done in access_control or in your controllers
            anonymous: ~

            remember_me:
                secret:   '%kernel.secret%'
                lifetime: 604800
                path:     /

            # This allows the user to login by submitting a username and password
            # Reference: http://symfony.com/doc/current/cookbook/security/form_login_setup.html
            form_login:
                # The route name that the login form submits to
                check_path: security_login
                # The name of the route where the login form lives
                # When the user tries to access a protected page, they are redirected here
                login_path: security_login
                # Secure the login form against CSRF
                # Reference: http://symfony.com/doc/current/cookbook/security/csrf_in_login_form.html
                csrf_token_generator: security.csrf.token_manager

            logout:
                # The route name the user can go to in order to logout
                path: security_logout
                # The name of the route to redirect to after logging out
                target: homepage

    role_hierarchy:
        ROLE_USER:        ROLE_CUSTOMER
        ROLE_TEAMLEAD:    ROLE_USER
        ROLE_ADMIN:       ROLE_TEAMLEAD
        ROLE_SUPER_ADMIN: ROLE_ADMIN

    access_control:
        # this is a catch-all for the admin area
        # additional security lives in the controllers
        - { path: '^/(%app_locales%)$', role: IS_AUTHENTICATED_FULLY }
        - { path: '^/(%app_locales%)/login', role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: '^/(%app_locales%)/admin', roles: ROLE_ADMIN }