security:
    # In Symfony 6 il sistema authenticator e l'unico disponibile (opzione rimossa).
    role_hierarchy:
        ROLE_MAGAZZINO_MANAGER:  [ROLE_MAGAZZINO_OPERATOR]
        ROLE_MAGAZZINO_ADMIN:    [ROLE_MAGAZZINO_MANAGER]
        ROLE_ADMIN:              [ROLE_MAGAZZINO_ADMIN]
    password_hashers:
        # Our user class and the algorithm we'll use to encode passwords
        # https://symfony.com/doc/current/security.html#c-encoding-the-user-s-password
        App\Entity\User: bcrypt

    providers:
        # https://symfony.com/doc/current/security.html#b-configuring-how-users-are-loaded
        # In this example, users are stored via Doctrine in the database
        # To see the users at src/App/DataFixtures/ORM/LoadFixtures.php
        # To load users from somewhere else: https://symfony.com/doc/current/security/custom_provider.html
        database_users:
            entity: { class: App\Entity\User }

    # https://symfony.com/doc/current/security.html#initial-security-yml-setup-authentication
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            # this firewall applies to all URLs
            pattern: ^/

            # but the firewall does not require login on every page
            # denying access is done in access_control or in your controllers
            lazy: true

            # Con l'authenticator manager, se ci sono piu authenticator (es. http_basic in test)
            # serve indicare quale gestisce l'accesso anonimo (redirect al login).
            entry_point: form_login

            # This allows the user to login by submitting a username and password
            # Reference: https://symfony.com/doc/current/security/form_login_setup.html
            form_login:
                # The route name that the login form submits to
                check_path: security_login
                # The name of the route where the login form lives
                # When the user tries to access a protected page, they are redirected here
                login_path: security_login
                # Secure the login form against CSRF
                # Reference: https://symfony.com/doc/current/security/csrf_in_login_form.html
                # Con l'authenticator manager si usa enable_csrf (il template usa gia il token id 'authenticate').
                enable_csrf: true
                # The page users are redirect to when there is no previous page stored in the
                # session (for example when the users access directly to the login page).
                default_target_path: homepage
                success_handler: authentication.success.listener

            logout:
                # The route name the user can go to in order to logout
                path: security_logout
                # The name of the route to redirect to after logging out
                target: homepage
                               
    access_control:
        # this is a catch-all for the admin area
        # additional security lives in the controllers
        # no authentication for the homepage:
        - { path: ^/(%app_locales%)/api/v1/c4rgo_roi/sendmail, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/c4rgo-roi-calc, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/c4rgo-roi, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/api/testoracle, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/api/ws, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/api/wsadd, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/wssped/demoview, roles: PUBLIC_ACCESS }          
        - { path: ^/(%app_locales%)/wssped/demoview/view, roles: PUBLIC_ACCESS }          
        - { path: ^/(%app_locales%)/encdetail, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/datapcl, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/datavrml, roles: PUBLIC_ACCESS }        
        - { path: ^/(%app_locales%)/gdata, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/login, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/mac, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/geo, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/reg, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/ping, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/macsec, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/logoutpage, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/errorlogin, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/c4rgologin45198763, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/welcome, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/magazzino/admin, roles: ROLE_MAGAZZINO_ADMIN }
        - { path: ^/(%app_locales%)/magazzino, roles: ROLE_MAGAZZINO_OPERATOR }
        - { path: ^/api/v1/magazzino, roles: ROLE_MAGAZZINO_OPERATOR }
        # Upload acquisizioni da macchina (ex public/upload.php): nessun login.
        - { path: ^/api/v1/acquisition/upload, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/admin, roles: ROLE_ADMIN }
        - { path: ^/(%app_locales%)/scanadmin, roles: ROLE_SCANADMIN }
        - { path: ^/(%app_locales%)/api/v1/item/insert, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/api/v1/ping, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/api/v1/reg, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/sa, roles: ROLE_SUPERADMIN }
        - { path: ^/(%app_locales%)/api/activate, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/configuratore/configuratore3d/c4rgo, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/configuratore/api/save/get, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/configuratore/api/listaitems/get/, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/configuratore/api/gettrasporto, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/configuratore/api/getconfigengine, roles: PUBLIC_ACCESS }
        - { path: ^/(%app_locales%)/configuratore/api/get_image, roles: PUBLIC_ACCESS }
        - { path: '^/', roles: ROLE_USER }
