security:
    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

    role_hierarchy:
        ROLE_ADMIN: [ROLE_MODERATOR, ROLE_SIEGE_SAISIE, ROLE_SIEGE_CONSULT]
        ROLE_MODERATOR: [ROLE_BENEVOLE]
        ROLE_SIEGE_SAISIE: [ROLE_USER]
        ROLE_SIEGE_CONSULT: [ROLE_USER]
        ROLE_HOPITAL_ADMIN: [ROLE_HOPITAL_SAISIE, ROLE_HOPITAL_CONSULT]
        ROLE_HOPITAL_SAISIE: [ROLE_USER]
        ROLE_HOPITAL_CONSULT: [ROLE_USER]
        ROLE_HOPITAL: [ROLE_HOPITAL_SAISIE]
        ROLE_BENEVOLE: [ROLE_USER]

    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email

    firewalls:
        dev:
            pattern: ^/(_profiler|_wdt|assets|build)/
            security: false
        login:
            pattern: ^/api/login
            stateless: true
            provider: app_user_provider
            user_checker: App\Security\UserChecker
            json_login:
                check_path: /api/login
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure
        api:
            pattern: ^/api
            stateless: true
            provider: app_user_provider
            jwt: ~
            user_checker: App\Security\UserChecker
        main:
            lazy: true
            provider: app_user_provider

    access_control:
        - { path: ^/api/login, roles: PUBLIC_ACCESS }
        - { path: ^/api/register, roles: PUBLIC_ACCESS }
        - { path: ^/api/activate, roles: PUBLIC_ACCESS }
        - { path: ^/api/admin/registrations, roles: ROLE_ADMIN }
        - { path: ^/api/settings, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/settings, roles: ROLE_ADMIN, methods: [PUT, PATCH, POST] }
        - { path: ^/api/boutiques, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/realizations, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/realizations, roles: ROLE_SIEGE_SAISIE, methods: [POST, PUT, PATCH, DELETE] }
        - { path: ^/api/news, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/documents, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/hospitals, roles: IS_AUTHENTICATED_FULLY, methods: [GET] }
        - { path: ^/api/hospitals, roles: ROLE_ADMIN, methods: [POST, PUT, DELETE] }
        - { path: ^/api/services, roles: IS_AUTHENTICATED_FULLY, methods: [GET] }
        - { path: ^/api/services, roles: [ROLE_HOPITAL_SAISIE, ROLE_ADMIN], methods: [POST] }
        - { path: ^/api/services, roles: ROLE_ADMIN, methods: [PUT, DELETE] }
        - { path: ^/api/demandes/hopital/pending, roles: ROLE_HOPITAL_ADMIN, methods: [GET] }
        - { path: ^/api/demandes/\d+/hopital/valider, roles: ROLE_HOPITAL_ADMIN, methods: [POST] }
        - { path: ^/api/demandes/\d+/hopital/refuser, roles: ROLE_HOPITAL_ADMIN, methods: [POST] }
        - { path: ^/api/demandes/all, roles: [ROLE_HOPITAL_SAISIE, ROLE_HOPITAL_CONSULT, ROLE_HOPITAL_ADMIN, ROLE_BENEVOLE], methods: [GET] }
        - { path: ^/api/demandes, roles: ROLE_HOPITAL_SAISIE, methods: [POST] }
        - { path: ^/api/demandes, roles: [ROLE_HOPITAL_SAISIE, ROLE_HOPITAL_CONSULT, ROLE_HOPITAL_ADMIN, ROLE_BENEVOLE], methods: [GET] }
        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }

when@test:
    security:
        password_hashers:
            # Password hashers are resource-intensive by design to ensure security.
            # In tests, it's safe to reduce their cost to improve performance.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon
