security:
    encoders:
        App\Entity\User:
            algorithm: auto

    # Role hierarchy for chapaland.com
    role_hierarchy:

        # Base roles
        ROLE_ADMIN     :  ROLE_USER
        ROLE_SUPERADMIN     :  [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    providers: # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
        users: { entity: { class: App\Entity\User } } # User entity
        hwi: { id: App\Security\UserProvider } # Social networks
        #in_memory: { memory: null }

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            provider: users
            anonymous: true
            lazy: true

            remember_me:
                # 1 week in seconds
                lifetime: 604800
                secret:   '%kernel.secret%'
                path:     /

            guard:
                entry_point: App\Security\LoginFormAuthenticator
                authenticators:
                    - App\Security\LoginFormAuthenticator

            two_factor:
                auth_form_path: 2fa_login
                check_path: 2fa_login_check  # The route name you have used in the routes.yaml

            oauth:
                resource_owners:
                    facebook:           "/connect/facebook-check"
                    google:             "/connect/google-check"
                    instagram:          "/connect/instagram-check"
                    spotify:            "/connect/spotify-check"
                    paypal:             "/connect/paypal-check"
                    twitter:            "/connect/twitter-check"
                    twitch:             "/connect/twitch-check"

                default_target_path: /register
                login_path:        /login
                use_forward:       false
                failure_path:      /login

                oauth_user_provider:
                    service: App\Security\UserProvider

            logout:
                path: app_logout_request
                target: app_logout
                invalidate_session: false

            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#firewalls-authentication

            # https://symfony.com/doc/current/security/impersonating_user.html
            switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/login/2fa, role: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/api, roles: ROLE_SUPERADMIN }
        - { path: ^/dashboard, roles: ROLE_ADMIN }
        - { path: ^/excel, roles: ROLE_ADMIN }
        - { path: ^/login, roles: [IS_ANONYMOUS,ROLE_USER] }
        - { path: ^/register, roles: [IS_ANONYMOUS,ROLE_USER] }
        - { path: ^/reset-password, roles: IS_ANONYMOUS }
        - { path: ^/, roles: ROLE_USER }
