Next major version 2 with PHP 8.1, Symfony 6, Tabler UI, 2FA ... (#2902)

2022-12-31 21:19:55 +01:00
parent 95e06746bd
commit 90a0fd8a22
2164 changed files with 83700 additions and 86426 deletions
--- a/config/bundles.php
+++ b/config/bundles.php
@@ -10,15 +10,14 @@ return [
    Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => ['dev' => true, 'test' => true],
    Symfony\Bundle\TwigBundle\TwigBundle::class => ['all' => true],
    Symfony\Bundle\SecurityBundle\SecurityBundle::class => ['all' => true],
-    Symfony\Bundle\MakerBundle\MakerBundle::class => ['dev' => true],
    Symfony\Bundle\DebugBundle\DebugBundle::class => ['dev' => true, 'test' => true],
    DAMA\DoctrineTestBundle\DAMADoctrineTestBundle::class => ['test' => true],
-    KevinPapst\AdminLTEBundle\AdminLTEBundle::class => ['all' => true],
    JMS\SerializerBundle\JMSSerializerBundle::class => ['all' => true],
    FOS\RestBundle\FOSRestBundle::class => ['all' => true],
    Nelmio\ApiDocBundle\NelmioApiDocBundle::class => ['all' => true],
    Nelmio\CorsBundle\NelmioCorsBundle::class => ['all' => true],
    Symfony\WebpackEncoreBundle\WebpackEncoreBundle::class => ['all' => true],
    Twig\Extra\TwigExtraBundle\TwigExtraBundle::class => ['all' => true],
-    HandcraftedInTheAlps\RestRoutingBundle\RestRoutingBundle::class => ['all' => true],
+    KevinPapst\TablerBundle\TablerBundle::class => ['all' => true],
+    Scheb\TwoFactorBundle\SchebTwoFactorBundle::class => ['all' => true],
 ];
--- a/config/locales.php
+++ b/config/locales.php
--- a/config/packages/admin_lte.yaml
+++ b/config/packages/admin_lte.yaml
@@ -1,32 +0,0 @@
-# Configuration file for the AdminLTE bundle
-#
-# For more information about the settings visit:
-# https://github.com/kevinpapst/AdminLTEBundle/blob/master/Resources/docs/configurations.md
-admin_lte:
-    options:
-        # default image for missing user avatar images
-        default_avatar: build/images/default_avatar.png
-        # the color skin
-        skin: skin-blue
-        # if activated, the boxed_layout will be deactivated
-        fixed_layout: true
-        # boxed layout (true) or full-screen (false)
-        boxed_layout: false
-        # initial collapsed state of the sidebar
-        collapsed_sidebar: false
-        # whether the logo collapses or not
-        mini_sidebar: true
-
-    theme:
-        widget:
-          use_footer: false
-          type: secondary
-          solid: false
-
-    routes:
-        adminlte_profile: user_profile
-        adminlte_welcome: homepage
-        adminlte_login: fos_user_security_login
-        adminlte_login_check: fos_user_security_check
-        adminlte_registration: fos_user_registration_register
-        adminlte_password_reset: fos_user_resetting_request
--- a/config/packages/cache.yaml
+++ b/config/packages/cache.yaml
@@ -0,0 +1,18 @@
+framework:
+    cache:
+        # Unique name of your app: used to compute stable namespaces for cache keys.
+        prefix_seed: "kimai"
+
+        # Redis
+        #app: cache.adapter.redis
+        #default_redis_provider: redis://localhost
+
+        # APCu (not recommended with heavy random-write workloads as memory fragmentation can cause perf issues)
+        #app: cache.adapter.apcu
+
+        pools:
+            doctrine.result_cache_pool:
+                adapter: cache.app
+
+            doctrine.system_cache_pool:
+                adapter: cache.system
--- a/config/packages/dev/mailer.yaml
+++ b/config/packages/dev/mailer.yaml
@@ -1,3 +0,0 @@
-framework:
-    mailer:
-        dsn: 'null://null'
--- a/config/packages/dev/monolog.yaml
+++ b/config/packages/dev/monolog.yaml
@@ -1,19 +0,0 @@
-monolog:
-    handlers:
-        main:
-            type: stream
-            path: "%kernel.logs_dir%/%kernel.environment%.log"
-            level: debug
-            channels: ["!event"]
-        # uncomment to get logging in your browser
-        # you may have to allow bigger header sizes in your Web server configuration
-        #firephp:
-        #    type: firephp
-        #    level: info
-        #chromephp:
-        #    type: chromephp
-        #    level: info
-        console:
-            type:   console
-            process_psr_3_messages: false
-            channels: ["!event", "!doctrine", "!console"]
--- a/config/packages/dev/routing.yaml
+++ b/config/packages/dev/routing.yaml
@@ -1,3 +0,0 @@
-framework:
-    router:
-        strict_requirements: true
--- a/config/packages/dev/web_profiler.yaml
+++ b/config/packages/dev/web_profiler.yaml
@@ -1,6 +0,0 @@
-web_profiler:
-    toolbar: true
-    intercept_redirects: false
-
-framework:
-    profiler: { only_exceptions: false }
--- a/config/packages/dev/webpack_encore.yaml
+++ b/config/packages/dev/webpack_encore.yaml
@@ -1,2 +0,0 @@
-webpack_encore:
-    cache: false
--- a/config/packages/doctrine.yaml
+++ b/config/packages/doctrine.yaml
@@ -15,8 +15,9 @@ doctrine:
                #schema_filter: ~^(?!(bundle_migration_|kimai2_sessions))~
                url: '%env(DATABASE_URL)%'
                driver: 'pdo_mysql'
-                # this setting prevents automatic database detection and finds a lot of false-negatives on doctrine:migrations:diff
-                # for null columns with MariaDB. Each migration tries to convert EVERY nullable column.
+                # If this is wrong, automatic database detection might fail and find false-negatives when running
+                # doctrine:migrations:diff on null columns with MariaDB.
+                # This here is mainly a fallback for times, when users have not configured the database version in the URL
                server_version: '%env(string:DATABASE_VERSION)%'
                charset: utf8mb4
                default_table_options:
@@ -35,129 +36,31 @@ doctrine:
                auto_mapping: true
                mappings:
                    App:
-                        type: annotation
+                        type: attribute
                        dir: '%kernel.project_dir%/src/Entity'
                        prefix: 'App\Entity'
                        alias: Kimai
                dql:
                    datetime_functions:
-                        addtime: DoctrineExtensions\Query\Mysql\AddTime
-                        convert_tz: DoctrineExtensions\Query\Mysql\ConvertTz
-                        date: DoctrineExtensions\Query\Mysql\Date
-                        date_format: DoctrineExtensions\Query\Mysql\DateFormat
-                        dateadd: DoctrineExtensions\Query\Mysql\DateAdd
-                        datesub: DoctrineExtensions\Query\Mysql\DateSub
-                        datediff: DoctrineExtensions\Query\Mysql\DateDiff
-                        day: DoctrineExtensions\Query\Mysql\Day
-                        dayname: DoctrineExtensions\Query\Mysql\DayName
-                        dayofweek: DoctrineExtensions\Query\Mysql\DayOfWeek
-                        dayofyear: DoctrineExtensions\Query\Mysql\DayOfYear
-                        div: DoctrineExtensions\Query\Mysql\Div
-                        from_unixtime: DoctrineExtensions\Query\Mysql\FromUnixtime
-                        hour: DoctrineExtensions\Query\Mysql\Hour
-                        last_day: DoctrineExtensions\Query\Mysql\LastDay
-                        makedate: DoctrineExtensions\Query\Mysql\MakeDate
-                        minute: DoctrineExtensions\Query\Mysql\Minute
-                        now: DoctrineExtensions\Query\Mysql\Now
-                        month: DoctrineExtensions\Query\Mysql\Month
-                        monthname: DoctrineExtensions\Query\Mysql\MonthName
-                        period_diff: DoctrineExtensions\Query\Mysql\PeriodDiff
-                        second: DoctrineExtensions\Query\Mysql\Second
-                        sectotime: DoctrineExtensions\Query\Mysql\SecToTime
-                        strtodate: DoctrineExtensions\Query\Mysql\StrToDate
-                        time: DoctrineExtensions\Query\Mysql\Time
-                        timediff: DoctrineExtensions\Query\Mysql\TimeDiff
-                        timestampadd: DoctrineExtensions\Query\Mysql\TimestampAdd
-                        timestampdiff: DoctrineExtensions\Query\Mysql\TimestampDiff
-                        timetosec: DoctrineExtensions\Query\Mysql\TimeToSec
-                        truncate: DoctrineExtensions\Query\Mysql\Truncate
-                        week: DoctrineExtensions\Query\Mysql\Week
-                        weekday: DoctrineExtensions\Query\Mysql\WeekDay
-                        year: DoctrineExtensions\Query\Mysql\Year
-                        yearmonth: DoctrineExtensions\Query\Mysql\YearMonth
-                        yearweek: DoctrineExtensions\Query\Mysql\YearWeek
-                        unix_timestamp: DoctrineExtensions\Query\Mysql\UnixTimestamp
-                        utc_timestamp: DoctrineExtensions\Query\Mysql\UtcTimestamp
-                        extract: DoctrineExtensions\Query\Mysql\Extract
+                        date: App\Doctrine\Extensions\Date
+                        day: App\Doctrine\Extensions\Day
+                        month: App\Doctrine\Extensions\Month
+                        year: App\Doctrine\Extensions\Year

-                    numeric_functions:
-                        acos: DoctrineExtensions\Query\Mysql\Acos
-                        asin: DoctrineExtensions\Query\Mysql\Asin
-                        atan2: DoctrineExtensions\Query\Mysql\Atan2
-                        atan: DoctrineExtensions\Query\Mysql\Atan
-                        bit_count: DoctrineExtensions\Query\Mysql\BitCount
-                        bit_xor: DoctrineExtensions\Query\Mysql\BitXor
-                        ceil: DoctrineExtensions\Query\Mysql\Ceil
-                        cos: DoctrineExtensions\Query\Mysql\Cos
-                        cot: DoctrineExtensions\Query\Mysql\Cot
-                        degrees: DoctrineExtensions\Query\Mysql\Degrees
-                        exp: DoctrineExtensions\Query\Mysql\Exp
-                        floor: DoctrineExtensions\Query\Mysql\Floor
-                        json_contains: DoctrineExtensions\Query\Mysql\JsonContains
-                        json_depth: DoctrineExtensions\Query\Mysql\JsonDepth
-                        json_length: DoctrineExtensions\Query\Mysql\JsonLength
-                        log: DoctrineExtensions\Query\Mysql\Log
-                        log10: DoctrineExtensions\Query\Mysql\Log10
-                        log2: DoctrineExtensions\Query\Mysql\Log2
-                        pi: DoctrineExtensions\Query\Mysql\Pi
-                        power: DoctrineExtensions\Query\Mysql\Power
-                        quarter: DoctrineExtensions\Query\Mysql\Quarter
-                        radians: DoctrineExtensions\Query\Mysql\Radians
-                        rand: DoctrineExtensions\Query\Mysql\Rand
-                        round: DoctrineExtensions\Query\Mysql\Round
-                        stddev: DoctrineExtensions\Query\Mysql\StdDev
-                        sin: DoctrineExtensions\Query\Mysql\Sin
-                        std: DoctrineExtensions\Query\Mysql\Std
-                        tan: DoctrineExtensions\Query\Mysql\Tan
-                        variance: DoctrineExtensions\Query\Mysql\Variance
+when@test:
+    doctrine:
+        dbal:
+            logging: false

-                    string_functions:
-                        aes_decrypt: DoctrineExtensions\Query\Mysql\AesDecrypt
-                        aes_encrypt: DoctrineExtensions\Query\Mysql\AesEncrypt
-                        any_value: DoctrineExtensions\Query\Mysql\AnyValue
-                        ascii: DoctrineExtensions\Query\Mysql\Ascii
-                        binary: DoctrineExtensions\Query\Mysql\Binary
-                        cast: DoctrineExtensions\Query\Mysql\Cast
-                        char_length: DoctrineExtensions\Query\Mysql\CharLength
-                        collate: DoctrineExtensions\Query\Mysql\Collate
-                        concat_ws: DoctrineExtensions\Query\Mysql\ConcatWs
-                        countif: DoctrineExtensions\Query\Mysql\CountIf
-                        crc32: DoctrineExtensions\Query\Mysql\Crc32
-                        degrees: DoctrineExtensions\Query\Mysql\Degrees
-                        field: DoctrineExtensions\Query\Mysql\Field
-                        find_in_set: DoctrineExtensions\Query\Mysql\FindInSet
-                        format: DoctrineExtensions\Query\Mysql\Format
-                        from_base64: DoctrineExtensions\Query\Mysql\FromBase64
-                        greatest: DoctrineExtensions\Query\Mysql\Greatest
-                        group_concat: DoctrineExtensions\Query\Mysql\GroupConcat
-                        hex: DoctrineExtensions\Query\Mysql\Hex
-                        ifelse: DoctrineExtensions\Query\Mysql\IfElse
-                        ifnull: DoctrineExtensions\Query\Mysql\IfNull
-                        inet_aton: DoctrineExtensions\Query\Mysql\InetAton
-                        inet_ntoa: DoctrineExtensions\Query\Mysql\InetNtoa
-                        inet6_aton: DoctrineExtensions\Query\Mysql\Inet6Aton
-                        inet6_ntoa: DoctrineExtensions\Query\Mysql\Inet6Ntoa
-                        instr: DoctrineExtensions\Query\Mysql\Instr
-                        is_ipv4: DoctrineExtensions\Query\Mysql\IsIpv4
-                        is_ipv4_compat: DoctrineExtensions\Query\Mysql\IsIpv4Compat
-                        is_ipv4_mapped: DoctrineExtensions\Query\Mysql\IsIpv4Mapped
-                        is_ipv6: DoctrineExtensions\Query\Mysql\IsIpv6
-                        lag: DoctrineExtensions\Query\Mysql\Lag
-                        lead: DoctrineExtensions\Query\Mysql\Lead
-                        least: DoctrineExtensions\Query\Mysql\Least
-                        lpad: DoctrineExtensions\Query\Mysql\Lpad
-                        match: DoctrineExtensions\Query\Mysql\MatchAgainst
-                        md5: DoctrineExtensions\Query\Mysql\Md5
-                        nullif: DoctrineExtensions\Query\Mysql\NullIf
-                        over: DoctrineExtensions\Query\Mysql\Over
-                        radians: DoctrineExtensions\Query\Mysql\Radians
-                        regexp: DoctrineExtensions\Query\Mysql\Regexp
-                        replace: DoctrineExtensions\Query\Mysql\Replace
-                        rpad: DoctrineExtensions\Query\Mysql\Rpad
-                        sha1: DoctrineExtensions\Query\Mysql\Sha1
-                        sha2: DoctrineExtensions\Query\Mysql\Sha2
-                        soundex: DoctrineExtensions\Query\Mysql\Soundex
-                        str_to_date: DoctrineExtensions\Query\Mysql\StrToDate
-                        substring_index: DoctrineExtensions\Query\Mysql\SubstringIndex
-                        unhex: DoctrineExtensions\Query\Mysql\Unhex
-                        uuid_short: DoctrineExtensions\Query\Mysql\UuidShort
+when@prod:
+    doctrine:
+        orm:
+            metadata_cache_driver:
+                type: pool
+                pool: doctrine.system_cache_pool
+            query_cache_driver:
+                type: pool
+                pool: doctrine.system_cache_pool
+            result_cache_driver:
+                type: pool
+                pool: doctrine.result_cache_pool
--- a/config/packages/doctrine_migrations.yaml
+++ b/config/packages/doctrine_migrations.yaml
@@ -1,9 +1,7 @@
 doctrine_migrations:
+    transactional: false
    storage:
        table_storage:
            table_name: 'migration_versions'
    migrations_paths:
-        # namespace is arbitrary but should be different from App\Migrations
-        # as migrations classes should NOT be autoloaded
-        'DoctrineMigrations': '%kernel.project_dir%/src/Migrations'
-    transactional: false
+        'DoctrineMigrations': '%kernel.project_dir%/migrations'
--- a/config/packages/fos_rest.yaml
+++ b/config/packages/fos_rest.yaml
@@ -29,7 +29,7 @@ fos_rest:
    body_listener:
        enabled: true
        decoders:
-            json: fos_rest.decoder.json
+            json: fos_rest.decoder.jsontoform
        array_normalizer:
            service: fos_rest.normalizer.camel_keys
            forms: true
@@ -39,12 +39,3 @@ fos_rest:
            - { path: ^/api, prefer_extension: true, fallback_format: json, priorities: [ json ] }
    zone:
        - { path: ^/api/* }
-
-handcraftedinthealps_rest_routing:
-    routing_loader:
-        default_format: 'json'
-        prefix_methods: true
-        include_format: false
-        formats:
-            json: true
-            xml: false
--- a/config/packages/framework.yaml
+++ b/config/packages/framework.yaml
@@ -1,37 +1,34 @@
 framework:
    secret: '%env(APP_SECRET)%'
    default_locale: en
-    csrf_protection: ~
-    #http_method_override: true
+    csrf_protection: true
+    http_method_override: false

    # Enables session support. Note that the session will ONLY be started if you read or write from it.
    # Remove or comment this section to explicitly disable session support.
-    #session:
-    #    handler_id:  session.handler.native_file
-    #    save_path:   "%kernel.project_dir%/var/sessions/%kernel.environment%"
-
    session:
        handler_id: App\Security\SessionHandler
        cookie_secure: auto
-        cookie_httponly: true
        cookie_samesite: lax
+        cookie_httponly: true
+        storage_factory_id: session.storage.factory.native

    #esi: ~
    #fragments: ~
    php_errors:
        log: true

-    cache:
-        # The app cache caches to the filesystem by default. Other options include:
+    mailer:
+        # prevent that emails are sent out in dev systems
+        dsn: 'null://null'

-        # Redis
-        #app: cache.adapter.redis
-        #default_redis_provider: redis://localhost
+when@prod:
+    framework:
+        mailer:
+            dsn: '%env(MAILER_URL)%'

-        # APCu (not recommended with heavy random-write workloads as memory fragmentation can cause perf issues)
-        #app: cache.adapter.apcu
-
-    #available with Symfony 4.1
-    #validation:
-        # possible values: 'loose', 'strict', 'html5'
-        #email_validation_mode: 'html5'
+when@test:
+    framework:
+        test: true
+        session:
+            storage_factory_id: session.storage.factory.mock_file
--- a/config/packages/jms_serializer.yaml
+++ b/config/packages/jms_serializer.yaml
@@ -13,8 +13,8 @@ jms_serializer:
        warmup:
            paths:
                included:
-                    - "%kernel.root_dir%/Entity/"
-                    - "%kernel.root_dir%/API/Model/"
+                    - "%kernel.project_dir%/src/Entity/"
+                    - "%kernel.project_dir%/src/API/Model/"
                excluded: []
    property_naming:
        id: 'jms_serializer.identical_property_naming_strategy'
--- a/config/packages/kimai.yaml
+++ b/config/packages/kimai.yaml
@@ -81,14 +81,14 @@ kimai:
            ACTIVITIES_ALL_TEAMLEAD: ['view_teamlead_activity','edit_teamlead_activity','budget_teamlead_activity','time_teamlead_activity','permissions_teamlead_activity']
            ACTIVITIES_ALL_TEAM: ['view_team_activity','edit_team_activity','budget_team_activity','time_team_activity']
            ACTIVITIES_TEAMLEAD: ['view_teamlead_activity','create_activity','edit_teamlead_activity','budget_teamlead_activity','time_teamlead_activity']
-            PROJECTS: ['view_project','create_project','edit_project','budget_project','time_project','delete_project','permissions_project','comments_project','comments_create_project','details_project']
-            PROJECTS_ALL_TEAMLEAD: ['view_teamlead_project','edit_teamlead_project','budget_teamlead_project','time_teamlead_project','permissions_teamlead_project','comments_teamlead_project','comments_create_teamlead_project','details_teamlead_project']
-            PROJECTS_ALL_TEAM: ['view_team_project','edit_team_project','budget_team_project','time_team_project','comments_team_project','comments_create_team_project','details_team_project']
-            PROJECTS_TEAMLEAD: ['view_teamlead_project','budget_teamlead_project','time_teamlead_project','comments_teamlead_project','comments_create_teamlead_project','details_teamlead_project']
-            CUSTOMERS: ['view_customer','create_customer','edit_customer','budget_customer','time_customer','delete_customer','permissions_customer','comments_customer','comments_create_customer','details_customer']
-            CUSTOMERS_ALL_TEAMLEAD: ['view_teamlead_customer','edit_teamlead_customer','budget_teamlead_customer','time_teamlead_customer','permissions_teamlead_customer','comments_teamlead_customer','comments_create_teamlead_customer','details_teamlead_customer']
-            CUSTOMERS_ALL_TEAM: ['view_team_customer','edit_team_customer','budget_team_customer','time_team_customer','comments_team_customer','comments_create_team_customer','details_team_customer']
-            CUSTOMERS_TEAMLEAD: ['view_teamlead_customer','budget_teamlead_customer','time_teamlead_customer','comments_teamlead_customer','comments_create_teamlead_customer','details_teamlead_customer']
+            PROJECTS: ['view_project','create_project','edit_project','budget_project','time_project','delete_project','permissions_project','comments_project','details_project']
+            PROJECTS_ALL_TEAMLEAD: ['view_teamlead_project','edit_teamlead_project','budget_teamlead_project','time_teamlead_project','permissions_teamlead_project','comments_teamlead_project','details_teamlead_project']
+            PROJECTS_ALL_TEAM: ['view_team_project','edit_team_project','budget_team_project','time_team_project','comments_team_project','details_team_project']
+            PROJECTS_TEAMLEAD: ['view_teamlead_project','budget_teamlead_project','time_teamlead_project','comments_teamlead_project','details_teamlead_project']
+            CUSTOMERS: ['view_customer','create_customer','edit_customer','budget_customer','time_customer','delete_customer','permissions_customer','comments_customer','details_customer']
+            CUSTOMERS_ALL_TEAMLEAD: ['view_teamlead_customer','edit_teamlead_customer','budget_teamlead_customer','time_teamlead_customer','permissions_teamlead_customer','comments_teamlead_customer','details_teamlead_customer']
+            CUSTOMERS_ALL_TEAM: ['view_team_customer','edit_team_customer','budget_team_customer','time_team_customer','comments_team_customer','details_team_customer']
+            CUSTOMERS_TEAMLEAD: ['view_teamlead_customer','budget_teamlead_customer','time_teamlead_customer','comments_teamlead_customer','details_teamlead_customer']
            INVOICE: ['view_invoice','create_invoice']
            INVOICE_ADMIN: ['manage_invoice_template']
            INVOICE_ALL: ['delete_invoice']
@@ -96,7 +96,7 @@ kimai:
            TIMESHEET_OTHER: ['view_other_timesheet','start_other_timesheet','stop_other_timesheet','create_other_timesheet','edit_other_timesheet','export_other_timesheet','delete_other_timesheet']
            PROFILE: ['view_own_profile','edit_own_profile','password_own_profile','preferences_own_profile','api-token_own_profile']
            PROFILE_OTHER: ['view_other_profile','edit_other_profile','password_other_profile','roles_other_profile','preferences_other_profile','api-token_other_profile','teams_other_profile']
-            TAGS: ['view_tag','manage_tag','delete_tag']
+            TAGS: ['view_tag','manage_tag','create_tag','delete_tag']
            USER: ['view_user','create_user','delete_user','role_permissions']
            RATE: ['view_rate_own_timesheet','edit_rate_own_timesheet']
            RATE_OTHER: ['view_rate_other_timesheet','edit_rate_other_timesheet']
@@ -104,14 +104,14 @@ kimai:
            BILLABLE: ['edit_billable_own_timesheet','edit_billable_other_timesheet']
            TEAMS: ['view_team','create_team','edit_team','delete_team']
            LOCKDOWN: ['lockdown_grace_timesheet','lockdown_override_timesheet']
-            REPORTING: ['view_reporting','view_other_reporting']
+            REPORTING: ['view_reporting','view_other_reporting','project_reporting','customer_reporting']
            # some single default definitions for roles
-            SINGLE_USER: ['view_team_member','time_team_project']
+            SINGLE_USER: ['view_team_member','time_team_project','create_tag','view_reporting']
            SINGLE_TEAMLEAD: ['view_rate_own_timesheet','view_rate_other_timesheet','hourly-rate_own_profile','view_team_member']
            SINGLE_ADMIN: ['hourly-rate_own_profile','edit_exported_timesheet','teams_own_profile','view_team_member','view_all_data']
            SINGLE_SUPER_ADMIN: ['hourly-rate_own_profile','hourly-rate_other_profile','roles_own_profile','system_information','system_configuration','plugins','edit_exported_timesheet','teams_own_profile','view_team_member','upload_invoice_template','view_all_data']
            # link above sets to one complete set for each user role
-            ROLE_USER: ['@TIMESHEET','@PROFILE','@REPORTING','@SINGLE_USER']
+            ROLE_USER: ['@TIMESHEET','@PROFILE','@SINGLE_USER']
            ROLE_TEAMLEAD: ['@ACTIVITIES_TEAMLEAD','@PROJECTS_TEAMLEAD','@CUSTOMERS_TEAMLEAD','@TIMESHEET_OTHER','@INVOICE','@TIMESHEET','@PROFILE','@EXPORT','@BILLABLE','@TAGS','@REPORTING','@SINGLE_TEAMLEAD']
            ROLE_ADMIN: ['@ACTIVITIES','@PROJECTS','@CUSTOMERS','@INVOICE','@INVOICE_ADMIN','@TIMESHEET','@TIMESHEET_OTHER','@PROFILE','@TEAMS','@RATE','@RATE_OTHER','@EXPORT','@BILLABLE','@TAGS','@LOCKDOWN','@REPORTING','@SINGLE_ADMIN']
            ROLE_SUPER_ADMIN: ['@ACTIVITIES','@PROJECTS','@CUSTOMERS','@INVOICE','@INVOICE_ADMIN','@TIMESHEET','@TIMESHEET_OTHER','@PROFILE','@PROFILE_OTHER','@USER','@TEAMS','@RATE','@RATE_OTHER','@EXPORT','@BILLABLE','@TAGS','@LOCKDOWN','@REPORTING','@SINGLE_SUPER_ADMIN']
@@ -121,8 +121,6 @@ kimai:
            ROLE_TEAMLEAD: ['ROLE_TEAMLEAD']
            ROLE_ADMIN: ['ROLE_ADMIN']
            ROLE_SUPER_ADMIN: ['ROLE_SUPER_ADMIN']
-            # only here to register the (partially) unused permissions in the UI
-            ROLE_FAKE: ['CUSTOMERS_ALL_TEAMLEAD','CUSTOMERS_ALL_TEAM','PROJECTS_ALL_TEAMLEAD','PROJECTS_ALL_TEAM','ACTIVITIES_ALL_TEAMLEAD','ACTIVITIES_ALL_TEAM','INVOICE_ALL']
        # add or remove single permissions
        roles:
            ROLE_USER: []
@@ -141,7 +139,6 @@ kimai:
 #        day_limit: 4
 #        slot_duration: '00:30:00'
 #        businessHours:
-#            days: [1, 2, 3, 4, 5]
 #            begin: '08:00'
 #            end: '18:00'
 #        visibleHours:
@@ -169,142 +166,6 @@ kimai:
 # --------------------------------------------------------------------------------


-# --------------------------------------------------------------------------------
-# DASHBOARD
-# --------------------------------------------------------------------------------
-    dashboard:
-        user_duration:
-            title: ~
-            order: 10
-            permission: view_own_timesheet
-            widgets: [PaginatedWorkingTimeChart]
-        user_teams:
-            title: ~
-            order: 15
-            permission: ROLE_USER
-            widgets: [UserTeams, UserTeamProjects]
-        user_rates:
-            title: ~
-            order: 20
-            permission: view_rate_own_timesheet
-            widgets: [userAmountToday, userAmountWeek, userAmountMonth, userAmountYear]
-        duration:
-            title: dashboard.all
-            order: 30
-            permission: ROLE_TEAMLEAD
-            widgets: [durationToday, durationWeek, durationMonth, durationYear]
-        active_users:
-            title: ~
-            order: 40
-            permission: ROLE_TEAMLEAD
-            widgets: [activeUsersToday, activeUsersWeek, activeUsersMonth, activeUsersYear]
-        rates:
-            title: ~
-            order: 50
-            permission: view_all_data
-            widgets: [amountToday, amountWeek, amountMonth, amountYear]
-        totals:
-            title: ~
-            order: 100
-            permission: ROLE_USER
-            widgets: [TotalsUser, TotalsCustomer, TotalsProject, TotalsActivity]
-# --------------------------------------------------------------------------------
-
-
-# --------------------------------------------------------------------------------
-# LANGUAGES
-# --------------------------------------------------------------------------------
-    languages:
-        cs:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m H:i'
-        da:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        de:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        de_AT:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        de_CH:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        el:  
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        en:
-            date_type: 'yyyy-MM-dd'
-            date: 'Y-m-d'
-            date_time: 'm-d H:i'
-            duration: '%%h:%%m h'
-        en_GB:
-            date_type: 'dd/MM/yyyy'
-            date: 'd/m/Y'
-            date_time: 'd/m H:i'
-        es:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        fi:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        fr:
-            date_type: 'dd/MM/yyyy'
-            date: 'd/m/Y'
-            date_time: 'd/m H:i'
-            duration: '%%h h %%m'
-        he:
-            date_type: 'dd/MM/yyyy'
-            date: 'd/m/Y'
-            date_time: 'd/m H:i'
-            duration: '%%h:%%m'
-        hr:
-            date_type: 'dd. MM. yyyy.'
-            date: 'd. m. Y.'
-            date_time: 'd. m. H:i'
-            duration: '%%h:%%m'
-        hu:
-            date_type: 'yyyy.MM.dd.'
-            date: 'Y.m.d.'
-            date_time: 'm.d. H:i'
-        it:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        nl:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-            duration: '%%hu%%m'
-        pt:
-            date_type: 'dd/MM/yyyy'
-            date: 'd/m/Y'
-            date_time: 'd-m H:i'
-        pt_BR:
-            date_type: 'dd-MM-yyyy'
-            date: 'd-m-Y'
-            date_time: 'd-m H:i'
-        ru:
-            date_type: 'dd.MM.yyyy'
-            date: 'd.m.Y'
-            date_time: 'd.m. H:i'
-        sk:
-            date_type: 'dd. MM. yyyy'
-            date: 'd. m. Y'
-            date_time: 'd. m.  H:i'
-        sv:
-            duration: '%%h:%%m tim'
-            date_time: 'd/m H:i'
-        pl:
-            date_type: 'dd. MM. yyyy'
-            date: 'd. m. Y'
-            date_time: 'd. m.  H:i'
-# --------------------------------------------------------------------------------
+when@test:
+    kimai:
+        data_dir: '%kernel.project_dir%/tests/_data'
--- a/config/packages/mailer.yaml
+++ b/config/packages/mailer.yaml
@@ -1,3 +0,0 @@
-framework:
-    mailer:
-        dsn: '%env(MAILER_URL)%'
--- a/config/packages/monolog.yaml
+++ b/config/packages/monolog.yaml
@@ -0,0 +1,56 @@
+when@prod:
+    monolog:
+        channels: ["deprecation"]
+        handlers:
+            main:
+                type: fingers_crossed
+                action_level: error
+                handler: nested
+                excluded_http_codes: [403, 404]
+            nested:
+                type: stream
+                level: info
+                path: "%kernel.logs_dir%/%kernel.environment%.log"
+            console:
+                type: console
+                process_psr_3_messages: false
+                channels: ["!event", "!doctrine"]
+            deprecation:
+                type: stream
+                channels: ["deprecation"]
+                path: "%kernel.logs_dir%/deprecations.log"
+
+when@dev:
+    monolog:
+        channels: ["deprecation"]
+        handlers:
+            main:
+                type: stream
+                path: "%kernel.logs_dir%/%kernel.environment%.log"
+                level: info
+                channels: ["!event"]
+            # uncomment to get logging in your browser
+            # you may have to allow bigger header sizes in your Web server configuration
+            #firephp:
+            #    type: firephp
+            #    level: info
+            #chromephp:
+            #    type: chromephp
+            #    level: info
+            console:
+                type: console
+                process_psr_3_messages: false
+                channels: ["!event", "!doctrine", "!console"]
+            deprecation:
+                type: stream
+                channels: ["deprecation"]
+                path: "%kernel.logs_dir%/deprecations.log"
+
+when@test:
+    monolog:
+        handlers:
+            main:
+                type: stream
+                path: "%kernel.logs_dir%/%kernel.environment%.log"
+                level: info
+                channels: ["!event"]
--- a/config/packages/nelmio_api_doc.yaml
+++ b/config/packages/nelmio_api_doc.yaml
@@ -26,7 +26,7 @@ nelmio_api_doc:
            - { alias: TagEntity,                   type: App\Entity\Tag,                           groups: [Default, Entity, Tag] }
            - { alias: TimesheetEditForm,           type: App\Form\API\TimesheetApiEditForm,        groups: [Default, Entity, Timesheet, Not_Expanded] }
            - { alias: TimesheetEntity,             type: App\Entity\Timesheet,                     groups: [Default, Entity, Timesheet, Timesheet_Entity, Not_Expanded] }
-            - { alias: TimesheetEntityExpanded,     type: App\Entity\Timesheet,                     groups: [Default, Entity, Timesheet, Timesheet_Entity, Expanded] }
+            - { alias: TimesheetExpanded,           type: App\Entity\Timesheet,                     groups: [Default, Entity, Timesheet, Timesheet_Entity, Expanded] }
            - { alias: TimesheetCollection,         type: App\Entity\Timesheet,                     groups: [Default, Collection, Timesheet, Not_Expanded] }
            - { alias: TimesheetCollectionExpanded, type: App\Entity\Timesheet,                     groups: [Default, Collection, Timesheet, Subresource, Expanded] }
            - { alias: UserCreateForm,              type: App\Form\API\UserApiCreateForm,           groups: [Default, Entity, User, User_Entity] }
@@ -48,18 +48,19 @@ nelmio_api_doc:
            title: Kimai - API Docs
            description: |
                JSON API for the Kimai time-tracking software: [API documentation](https://www.kimai.org/documentation/rest-api.html), [Swagger definition file](doc.json)
-            version: '0.6'
-        securityDefinitions:
-            apiUser:
-                type: apiKey
-                description: 'Value: {Username}'
-                name: X-AUTH-USER
-                in: header
-            apiToken:
-                type: apiKey
-                description: 'Value: {API Token}'
-                name: X-AUTH-TOKEN
-                in: header
+            version: '0.7'
+        components:
+            securitySchemes:
+                apiUser:
+                    type: apiKey
+                    description: 'Value: {Username}'
+                    name: X-AUTH-USER
+                    in: header
+                apiToken:
+                    type: apiKey
+                    description: 'Value: {API Token}'
+                    name: X-AUTH-TOKEN
+                    in: header
        security:
            - X-AUTH-USER: []
            - X-AUTH-TOKEN: []
--- a/config/packages/prod/doctrine.yaml
+++ b/config/packages/prod/doctrine.yaml
@@ -1,31 +0,0 @@
-doctrine:
-    orm:
-        metadata_cache_driver:
-            type: service
-            id: doctrine.system_cache_provider
-        query_cache_driver:
-            type: service
-            id: doctrine.system_cache_provider
-        result_cache_driver:
-            type: service
-            id: doctrine.result_cache_provider
-
-services:
-    doctrine.result_cache_provider:
-        class: Symfony\Component\Cache\DoctrineProvider
-        public: false
-        arguments:
-            - '@doctrine.result_cache_pool'
-    doctrine.system_cache_provider:
-        class: Symfony\Component\Cache\DoctrineProvider
-        public: false
-        arguments:
-            - '@doctrine.system_cache_pool'
-
-framework:
-    cache:
-        pools:
-            doctrine.result_cache_pool:
-                adapter: cache.app
-            doctrine.system_cache_pool:
-                adapter: cache.system
--- a/config/packages/prod/monolog.yaml
+++ b/config/packages/prod/monolog.yaml
@@ -1,16 +0,0 @@
-monolog:
-    handlers:
-        main:
-            type: fingers_crossed
-            action_level: error
-            handler: nested
-            excluded_http_codes: [403, 404]
-        nested:
-            type: stream
-            level: info
-            path: "%kernel.logs_dir%/%kernel.environment%.log"
-
-        console:
-            type: console
-            process_psr_3_messages: false
-            channels: ["!event", "!doctrine"]
--- a/config/packages/routing.yaml
+++ b/config/packages/routing.yaml
@@ -1,3 +1,12 @@
 framework:
    router:
-        strict_requirements: ~
+        utf8: true
+
+        # Configure how to generate URLs in non-HTTP contexts, such as CLI commands.
+        # See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
+        #default_uri: http://localhost
+
+when@prod:
+    framework:
+        router:
+            strict_requirements: null
--- a/config/packages/scheb_2fa.yaml
+++ b/config/packages/scheb_2fa.yaml
@@ -0,0 +1,14 @@
+# Documentation at https://symfony.com/bundles/SchebTwoFactorBundle/6.x/configuration.html
+scheb_two_factor:
+    security_tokens:
+        - Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken
+        - Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken
+    totp:
+        enabled: true
+        template: security/2fa.html.twig    # Overwritten template
+        window: 1                           # How many codes before/after the current one would be accepted as valid
+#        server_name: Server Name           # Server name used in QR code
+        issuer: Kimai                       # Issuer name used in QR code
+#        parameters:                        # Additional parameters added in the QR code
+#            image: 'https://my-service/img/logo.png'
+    two_factor_condition: App\Security\TwoFactorCondition
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -1,15 +1,18 @@
 security:
-    encoders:
+    enable_authenticator_manager: true
+
+    password_hashers:
        App\Entity\User: auto

    providers:
        chain_provider:
            chain:
                providers: [kimai_internal,kimai_ldap]
+        kimai_internal:
+            entity:
+                class: App\Entity\User
        kimai_ldap:
            id: App\Ldap\LdapUserProvider
-        kimai_internal:
-            id: App\Security\DoctrineUserProvider

    firewalls:
        dev:
@@ -17,43 +20,47 @@ security:
            security: false

        api:
-            request_matcher: App\Security\ApiRequestMatcher
+            request_matcher: App\API\Authentication\ApiRequestMatcher
            user_checker: App\Security\UserChecker
-            anonymous: false
            stateless: true
            remember_me: false
            provider: chain_provider
-            guard:
-                authenticators:
-                    - App\Security\TokenAuthenticator
+            custom_authenticators:
+                - App\API\Authentication\TokenAuthenticator

        secured_area:
-            kimai_saml: ~
            kimai_ldap: ~
            pattern: ^/
            user_checker: App\Security\UserChecker
-            anonymous: true
            stateless: false

-            guard:
-                authenticators:
-                    - App\Security\ApiAuthenticator
+            entry_point: form_login
+
+            custom_authenticators:
+                - App\API\Authentication\SessionAuthenticator
+                - App\Saml\SamlAuthenticator

            remember_me:
-                secret:   '%kernel.secret%'
+                secret: '%kernel.secret%'
                lifetime: 604800
-                path:     /
+                path: /
+                always_remember_me: true

            # activate all configured user provider
            provider: chain_provider

            form_login:
-                check_path: fos_user_security_check
-                login_path: fos_user_security_login
-                csrf_token_generator: security.csrf.token_manager
+                check_path: security_check
+                login_path: login
+                enable_csrf: true
+
+            two_factor:
+                auth_form_path: 2fa_login
+                check_path: 2fa_login_check
+                remember_me_sets_trusted: true

            logout:
-                path: fos_user_security_logout
+                path: logout
                target: homepage

    access_decision_manager:
@@ -67,11 +74,28 @@ security:
        ROLE_SUPER_ADMIN: ROLE_ADMIN

    access_control:
-        - { path: '^/auth', roles: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)$', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/auth', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/login', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/register', role: IS_AUTHENTICATED_ANONYMOUSLY }
-        - { path: '^/(%app_locales%)/resetting', role: IS_AUTHENTICATED_ANONYMOUSLY }
+        - { path: '^/auth/2fa', role: IS_AUTHENTICATED_2FA_IN_PROGRESS }
+        - { path: '^/auth', roles: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)$', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/auth', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/login', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/register', role: PUBLIC_ACCESS }
+        - { path: '^/(%app_locales%)/resetting', role: PUBLIC_ACCESS }
        - { path: '^/(%app_locales%)/', roles: ROLE_USER }
        - { path: '^/api', roles: IS_AUTHENTICATED_REMEMBERED }
+
+when@test:
+    # this configuration simplifies testing URLs protected by the security mechanism
+    # See https://symfony.com/doc/current/cookbook/testing/http_authentication.html
+    security:
+        password_hashers:
+            App\Entity\User:
+                algorithm: auto
+                # see https://github.com/symfony/recipes/pull/1026
+                cost: 4 # Lowest possible value for bcrypt
+                time_cost: 3 # Lowest possible value for argon
+                memory_cost: 10 # Lowest possible value for argon
+
+        firewalls:
+            secured_area:
+                http_basic: ~
--- a/config/packages/tabler.yaml
+++ b/config/packages/tabler.yaml
@@ -0,0 +1,139 @@
+#
+# Configuration file for the Tabler bundle
+#
+# For more information about the bundle settings visit:
+# https://github.com/kevinpapst/TablerBundle/blob/master/Resources/docs/configurations.md
+#
+tabler:
+    options:
+        # dark or normal layout
+        dark_mode: false
+        # condensed = one nav-bar, false = two nav-bars
+        navbar_condensed: true
+        # overlap = https://preview.tabler.io/layout-navbar-overlap.html
+        navbar_overlap: true
+        # boxed layout (true) or full-screen (false)
+        boxed_layout: false
+        # right to left = true
+        rtl_mode: false
+        # true = only avatar, false = show username and title as well
+        user_menu_condensed: true
+        # url to your company logo
+        logo_url: "touch-icon-192x192.png"
+
+    knp_menu:
+        enable: false
+        main_menu: tabler_main
+        breadcrumb_menu: false
+
+    routes:
+        tabler_welcome: dashboard
+        tabler_login: login
+        tabler_logout: logout
+        tabler_login_check: security_check
+        tabler_registration: registration_register
+        tabler_registration_register: registration_register
+        tabler_password_reset: resetting_request
+        tabler_password_reset_sent: resetting_send_email
+
+    icons:
+        about: fas fa-info-circle
+        activity: fas fa-tasks
+        admin: fas fa-wrench
+        administration: fas fa-toolbox
+        applications: fas fa-rocket
+        audit: fas fa-history
+        avatar: fas fa-user
+        back: fas fa-long-arrow-alt-left
+        barcode: fas fa-barcode
+        bookmark: far fa-star
+        bookmarked: fas fa-star
+        calendar: far fa-calendar-alt
+        cancel: fas fa-times
+        clock: far fa-clock
+        collapse: fas fa-chevron-down
+        columns: fas fa-table
+        comment: far fa-comment
+        configuration: fas fa-cog
+        copy: far fa-copy
+        create: fas fa-plus
+        csv: fas fa-table
+        customer: fas fa-user-tie
+        dashboard: fas fa-tachometer-alt
+        debug: far fa-file-alt
+        delete: far fa-trash-alt
+        details: fas fa-info-circle
+        display: fas fa-layer-group
+        doctor: fas fa-medkit
+        documentation: fas fa-book
+        dot: fas fa-circle
+        download: fas fa-download
+        duration: far fa-hourglass
+        edit: far fa-edit
+        end: fas fa-stopwatch
+        export: fas fa-file-export
+        failure: fas fa-times
+        fax: fas fa-fax
+        filter: fas fa-filter
+        help: far fa-question-circle
+        home: fas fa-home
+        invoice: fas fa-file-contract
+        invoice-template: fas fa-file-signature
+        left: fas fa-chevron-left
+        left2: fas fa-angle-double-left
+        link: fas fa-link
+        list: fas fa-list
+        locked: fas fa-lock
+        login: fas fa-sign-in-alt
+        logout: fas fa-sign-out-alt
+        mail: far fa-envelope
+        mail-sent: fas fa-paper-plane
+        manual: fas fa-book
+        mobile: fas fa-mobile
+        money: fas fa-coins
+        ods: fas fa-table
+        off: fas fa-toggle-off
+        on: fas fa-toggle-on
+        password: fas fa-key
+        pause: fas fa-pause
+        pause-small: far fa-pause-circle
+        pin: fas fa-thumbtack
+        pdf: fas fa-file-pdf
+        permissions: fas fa-user-lock
+        phone: fas fa-phone
+        plugin: fas fa-plug
+        print: fas fa-print
+        profile: fas fa-user-edit
+        profile-stats: far fa-chart-bar
+        project: fas fa-briefcase
+        repeat: fas fa-redo-alt
+        reporting: far fa-chart-bar
+        report: far fa-chart-bar
+        right: fas fa-chevron-right
+        right2: fas fa-angle-double-right
+        roles: fas fa-user-shield
+        save: far fa-save
+        search: fas fa-search
+        settings: fas fa-cog
+        shop: fas fa-shopping-cart
+        spinner: fas fa-spinner fa-pulse
+        start: fas fa-play
+        start-small: far fa-play-circle
+        stop: fas fa-stop
+        stop-small: far fa-stop-circle
+        success: fas fa-check
+        tag: fas fa-tags
+        team: fas fa-users
+        timesheet: fas fa-clock
+        timesheet-team: fas fa-user-clock
+        trash: far fa-trash-alt
+        unlocked: fas fa-unlock-alt
+        upload: fas fa-upload
+        user: fas fa-user
+        users: fas fa-user-friends
+        visibility: far fa-eye
+        warning: fas fa-exclamation
+        weekly-times: fas fa-th
+        widget_add: fas fa-folder-plus
+        widget_remove: fas fa-folder-minus
+        xlsx: fas fa-file-excel
--- a/config/packages/test/framework.yaml
+++ b/config/packages/test/framework.yaml
@@ -1,4 +0,0 @@
-framework:
-    test: ~
-    session:
-        storage_id: session.storage.mock_file
--- a/config/packages/test/kimai.yaml
+++ b/config/packages/test/kimai.yaml
@@ -1,2 +0,0 @@
-kimai:
-    data_dir: '%kernel.project_dir%/tests/_data'
--- a/config/packages/test/mailer.yaml
+++ b/config/packages/test/mailer.yaml
@@ -1,3 +0,0 @@
-framework:
-    mailer:
-        dsn: 'null://null'
--- a/config/packages/test/monolog.yaml
+++ b/config/packages/test/monolog.yaml
@@ -1,7 +0,0 @@
-monolog:
-    handlers:
-        main:
-            type: stream
-            path: "%kernel.logs_dir%/%kernel.environment%.log"
-            level: debug
-            channels: ["!event"]
--- a/config/packages/test/security.yaml
+++ b/config/packages/test/security.yaml
@@ -1,9 +0,0 @@
-# this configuration simplifies testing URLs protected by the security mechanism
-# See https://symfony.com/doc/current/cookbook/testing/http_authentication.html
-security:
-    encoders:
-        App\Entity\User: { algorithm: auto }
-
-    firewalls:
-        secured_area:
-            http_basic: ~
--- a/config/packages/test/web_profiler.yaml
+++ b/config/packages/test/web_profiler.yaml
@@ -1,6 +0,0 @@
-web_profiler:
-    toolbar: false
-    intercept_redirects: false
-
-framework:
-    profiler: { collect: false }
--- a/config/packages/translation.yaml
+++ b/config/packages/translation.yaml
@@ -1,5 +1,6 @@
 framework:
    default_locale: '%locale%'
    translator:
+        default_path: '%kernel.project_dir%/translations'
        fallbacks:
            - 'en'
--- a/config/packages/twig.yaml
+++ b/config/packages/twig.yaml
@@ -2,9 +2,10 @@ twig:
    debug: '%kernel.debug%'
    strict_variables: '%kernel.debug%'
    form_themes:
-        - 'form/kimai-theme.html.twig'
+        - 'form/vertical.html.twig'
    exception_controller: null
    paths:
        # used in templates/emails/layout.html.twig
        '%kernel.project_dir%/assets/css': css
-        '%kernel.project_dir%/vendor/kevinpapst/adminlte-bundle/Resources/views': theme
+        '%kernel.project_dir%/templates/bundles/TablerBundle': theme
+        '%kernel.project_dir%/vendor/kevinpapst/tabler-bundle/templates': theme
--- a/config/packages/web_profiler.yaml
+++ b/config/packages/web_profiler.yaml
@@ -0,0 +1,15 @@
+when@dev:
+    web_profiler:
+        toolbar: true
+        intercept_redirects: false
+
+    framework:
+        profiler: { only_exceptions: false }
+
+when@test:
+    web_profiler:
+        toolbar: false
+        intercept_redirects: false
+
+    framework:
+        profiler: { collect: false }
--- a/config/packages/webpack_encore.yaml
+++ b/config/packages/webpack_encore.yaml
@@ -11,3 +11,7 @@ webpack_encore:
    # Cache the entrypoints.json (rebuild Symfony's cache when entrypoints.json changes)
    # Available in version 1.2
    cache: '%kernel.debug%'
+
+when@dev:
+    webpack_encore:
+        cache: false
--- a/config/preload.php
+++ b/config/preload.php
@@ -0,0 +1,5 @@
+<?php
+
+if (file_exists(dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php')) {
+    require dirname(__DIR__).'/var/cache/prod/App_KernelProdContainer.preload.php';
+}
--- a/config/routes.yaml
+++ b/config/routes.yaml
@@ -1,3 +1,45 @@
+controllers:
+    resource: ../src/Controller/
+    type: annotation
+    prefix: /{_locale}
+    requirements:
+        _locale: '%app_locales%'
+    defaults:
+        _locale: '%locale%'
+
+api.swagger_ui:
+    path: /api/doc
+    methods: GET
+    defaults: { _controller: nelmio_api_doc.controller.swagger_ui }
+
+api.swagger:
+    path: /api/doc.json
+    methods: GET
+    defaults: { _controller: nelmio_api_doc.controller.swagger }
+
+api:
+    resource: ../src/API/
+    type: annotation
+    prefix: /api
+
+auth:
+    resource: ../src/Controller/Auth/
+    type: annotation
+    prefix: /auth
+
+security:
+    resource: ../src/Controller/Security/
+    type: annotation
+    prefix: /{_locale}
+    requirements:
+        _locale: '%app_locales%'
+    defaults:
+        _locale: '%locale%'
+
+kernel:
+    resource: ../src/Kernel.php
+    type: annotation
+
 home:
    path: /
    defaults:
@@ -14,3 +56,11 @@ homeLocale:
        _locale: '%locale%'
        route: homepage
        permanent: true
+
+2fa_login:
+    path: /{_locale}/auth/2fa
+    defaults:
+        _controller: "scheb_two_factor.form_controller::form"
+
+2fa_login_check:
+    path: /{_locale}/auth/2fa_check
--- a/config/routes/annotations.yaml
+++ b/config/routes/annotations.yaml
@@ -1,27 +0,0 @@
-controllers:
-    resource: '../../src/Controller/'
-    type: annotation
-    prefix: /{_locale}
-    requirements:
-        _locale: '%app_locales%'
-    defaults:
-        _locale: '%locale%'
-
-app.api:
-    resource: '../src/API/'
-    type: rest
-    prefix: /api
-
-auth:
-    resource: '../../src/Controller/Auth/'
-    type: annotation
-    prefix: /auth
-
-security:
-    resource: '../../src/Controller/Security/'
-    type: annotation
-    prefix: /{_locale}
-    requirements:
-        _locale: '%app_locales%'
-    defaults:
-        _locale: '%locale%'
--- a/config/routes/nelmio_api_doc.yaml
+++ b/config/routes/nelmio_api_doc.yaml
@@ -1,11 +0,0 @@
-# Expose the Kimai API documentation as HTML
-app.swagger_ui:
-    path: /api/doc
-    methods: GET
-    defaults: { _controller: nelmio_api_doc.controller.swagger_ui }
-
-# Expose the Kimai API documentation as swagger compliant JSON
-app.swagger:
-    path: /api/doc.json
-    methods: GET
-    defaults: { _controller: nelmio_api_doc.controller.swagger }
--- a/config/services-saml.yaml
+++ b/config/services-saml.yaml
@@ -1,18 +0,0 @@
-# ================================================================================
-# SAML Services
-# ================================================================================
-
-services:
-
-    kimai.saml_listener:
-        class: App\Saml\Firewall\SamlListener
-        parent: security.authentication.listener.abstract
-        abstract: true
-        calls:
-            - [setAuth, ['@App\Saml\SamlAuthFactory']]
-
-    App\Saml\Provider\SamlProvider:
-        arguments: ['@App\Repository\UserRepository', '', '@App\Saml\SamlTokenFactory', '@App\Saml\User\SamlUserFactory', '@App\Configuration\SamlConfigurationInterface']
-
-    App\Saml\Security\SamlAuthenticationSuccessHandler:
-        parent: security.authentication.success_handler
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -1,8 +1,8 @@
-# Put parameters here that don't need to change on each machine where the app is deployed
-# https://symfony.com/doc/current/best_practices/configuration.html#application-related-configuration
 parameters:
    locale: en
-    app_locales: ar|cs|da|de|de_AT|de_CH|el|en|en_GB|eo|es|eu|fa|fi|fo|fr|he|hr|hu|it|ja|ko|nb_NO|nl|pl|pt|pt_BR|ro|ru|sk|sv|tr|vi|zh_CN
+    # the original list of all locales is the next line, it can be used to regenerate the locale list in case new locales will be added
+    #app_locales: ar|cs|da|de|el|en|eo|es|eu|fa|fi|fo|fr|he|hr|hu|it|ja|ko|nb_NO|nl|pl|pt|ro|ru|sk|sv|tr|uk|vi|zh_CN|zh_Hant
+    app_locales: ar|cs|da|de|el|en|eo|es|eu|fa|fi|fo|fr|he|hr|hu|it|ja|ko|nb_NO|nl|pl|pt|pt_BR|ro|ru|sk|sv|tr|uk|vi|zh_CN|zh_Hant|cs_CZ|da_DK|da_GL|de_AT|de_BE|de_CH|de_DE|de_IT|de_LI|de_LU|el_CY|el_GR|en_AE|en_AG|en_AI|en_AS|en_AT|en_AU|en_BB|en_BE|en_BI|en_BM|en_BS|en_BW|en_BZ|en_CA|en_CC|en_CH|en_CK|en_CM|en_CX|en_CY|en_DE|en_DK|en_DM|en_ER|en_FI|en_FJ|en_FK|en_FM|en_GB|en_GD|en_GG|en_GH|en_GI|en_GM|en_GU|en_GY|en_HK|en_IE|en_IL|en_IM|en_IN|en_IO|en_JE|en_JM|en_KE|en_KI|en_KN|en_KY|en_LC|en_LR|en_LS|en_MG|en_MH|en_MO|en_MP|en_MS|en_MT|en_MU|en_MV|en_MW|en_MY|en_NA|en_NF|en_NG|en_NL|en_NR|en_NU|en_NZ|en_PG|en_PH|en_PK|en_PN|en_PR|en_PW|en_RW|en_SB|en_SC|en_SD|en_SE|en_SG|en_SH|en_SI|en_SL|en_SS|en_SX|en_SZ|en_TC|en_TK|en_TO|en_TT|en_TV|en_TZ|en_UG|en_UM|en_US|en_VC|en_VG|en_VI|en_VU|en_WS|en_ZA|en_ZM|en_ZW|es_AR|es_BO|es_BR|es_BZ|es_CL|es_CO|es_CR|es_CU|es_DO|es_EC|es_ES|es_GQ|es_GT|es_HN|es_MX|es_NI|es_PA|es_PE|es_PH|es_PR|es_PY|es_SV|es_US|es_UY|es_VE|eu_ES|fa_AF|fa_IR|fi_FI|fo_DK|fo_FO|fr_BE|fr_BF|fr_BI|fr_BJ|fr_BL|fr_CA|fr_CD|fr_CF|fr_CG|fr_CH|fr_CI|fr_CM|fr_DJ|fr_DZ|fr_FR|fr_GA|fr_GF|fr_GN|fr_GP|fr_GQ|fr_HT|fr_KM|fr_LU|fr_MA|fr_MC|fr_MF|fr_MG|fr_ML|fr_MQ|fr_MR|fr_MU|fr_NC|fr_NE|fr_PF|fr_PM|fr_RE|fr_RW|fr_SC|fr_SN|fr_SY|fr_TD|fr_TG|fr_TN|fr_VU|fr_WF|fr_YT|he_IL|hr_BA|hr_HR|hu_HU|it_CH|it_IT|it_SM|it_VA|ja_JP|ko_KP|ko_KR|nl_AW|nl_BE|nl_BQ|nl_CW|nl_NL|nl_SR|nl_SX|pl_PL|pt_AO|pt_CH|pt_CV|pt_GQ|pt_GW|pt_LU|pt_MO|pt_MZ|pt_PT|pt_ST|pt_TL|ro_MD|ro_RO|ru_BY|ru_KG|ru_KZ|ru_MD|ru_RU|ru_UA|sk_SK|sv_AX|sv_FI|sv_SE|tr_CY|tr_TR|vi_VN

 services:
    # default configuration for services in *this* file
@@ -16,11 +16,22 @@ services:
            $projectDirectory: '%kernel.project_dir%'
            $kernelEnvironment: '%kernel.environment%'

-    # makes classes in src/ available to be used as services
-    # this creates a service per class whose id is the fully-qualified class name
+    # make classes in src/ available to be used as services
+    # creates one service per class whose id is the fully-qualified class name
    App\:
        resource: '../src/*'
-        exclude: '../src/{DependencyInjection,Entity,Event,Migrations,Model,Tests,Kernel.php,Constants.php}'
+        exclude:
+            - '../src/API/Model/'
+            - '../src/DependencyInjection/'
+            - '../src/Entity/'
+            - '../src/Repository/Loader/'
+            - '../src/Repository/Paginator/'
+            - '../src/Repository/Query/'
+            - '../src/Repository/Result/'
+            - '../src/Event/'
+            - '../src/Model/'
+            - '../src/Kernel.php'
+            - '../src/Constants.php'

    # controllers are imported separately to make sure services can be injected
    # as action arguments even if you don't extend any base controller class
@@ -35,28 +46,17 @@ services:
    security.user.provider.chain:
        class: App\Security\KimaiUserProvider

-    App\Utils\LanguageService:
-        arguments: ['%app_locales%']
-
-    App\Repository\WidgetRepository:
-        arguments:
-            $widgets: '%kimai.widgets%'
-
-    App\Controller\DashboardController:
-        arguments:
-            $dashboard: '%kimai.dashboard%'
-
    App\Configuration\MailConfiguration:
        arguments: ['%env(MAILER_FROM)%']

-    App\Configuration\LanguageFormattings:
+    App\Configuration\LocaleService:
        arguments: ['%kimai.languages%']

    App\Configuration\SystemConfiguration:
        arguments:
            $settings: '%kimai.config%'

-    App\Utils\MPdfConverter:
+    App\Pdf\MPdfConverter:
        arguments:
            $cacheDirectory: '%kernel.cache_dir%'

@@ -72,15 +72,6 @@ services:
    App\Validator\Constraints\QuickEntryTimesheetValidator:
        arguments: [!tagged timesheet.validator]

-    App\Widget\WidgetService:
-        arguments:
-            $renderer: !tagged widget.renderer
-
-    App\Utils\Translator:
-        decorates: translator
-        arguments:
-            $localDomains: '%kimai.i18n_domains%'
-
    App\Utils\FileHelper:
        arguments:
            $dataDir: '%kimai.data_dir%'
@@ -88,6 +79,10 @@ services:
    App\API\Serializer\ValidationFailedExceptionErrorHandler:
        arguments: ['@translator.default', '@fos_rest.serializer.flatten_exception_handler']

+    App\Command\ExportCreateCommand:
+        arguments:
+            $mailer: '@App\Mail\KimaiMailer'
+
    # ================================================================================
    # DATABASE
    # ================================================================================
@@ -107,11 +102,6 @@ services:
        calls:
            - [ setAnnotationReader, [ "@annotation_reader" ] ]

-    # store and retrieve sessions in and from database
-    App\Security\SessionHandler:
-        arguments:
-            - !service { class: PDO, factory: ['@database_connection', 'getWrappedConnection'] }
-
    # ================================================================================
    # TIMESHEET RECORD CALCULATOR
    # ================================================================================
@@ -134,18 +124,18 @@ services:

    App\Security\RoleService:
        arguments:
-            $roles: '%security.role_hierarchy.roles%'
+            $roles: '%kimai.permission_roles%'

    App\Security\RolePermissionManager:
        arguments:
            $permissions: '%kimai.permissions%'
+            $permissionNames: '%kimai.permission_names%'

    # ================================================================================
-    # LDAP
+    # SAML Services
    # ================================================================================
-
-    App\Ldap\LdapAuthenticationProvider:
-        arguments: ['@App\Security\UserChecker', '', '', '', '@App\Configuration\LdapConfiguration']
+    App\Saml\SamlProvider:
+        arguments: ['@App\Repository\UserRepository', '@security.user.provider.concrete.kimai_internal', '@App\Configuration\SamlConfigurationInterface']

    # ================================================================================
    # REPOSITORIES
--- a/config/services_test.yaml
+++ b/config/services_test.yaml
@@ -6,8 +6,6 @@ services:
    _defaults:
        public: true

-    test.PasswordEncoder: "@security.encoder_factory"
-
    App\Configuration\SystemConfiguration:
        arguments: ['@App\Repository\ConfigurationRepository', "%kimai.config%"]

@@ -29,4 +27,8 @@ services:

    App\User\UserService:
        public: true
-        arguments: ['@App\Repository\UserRepository', '@event_dispatcher', '@validator', '@App\Configuration\SystemConfiguration', '@security.password_encoder']
+        arguments: ['@App\Repository\UserRepository', '@event_dispatcher', '@validator', '@App\Configuration\SystemConfiguration', '@security.user_password_hasher']
+
+    App\Plugin\PluginManager:
+        public: true
+        arguments: [!tagged kimai.plugin]