# config/packages/security.yaml
security:
  encoders:
    FOS\UserBundle\Model\UserInterface: bcrypt

  role_hierarchy:
    ROLE_ADMIN:       ROLE_USER
    ROLE_SUPER_ADMIN: ROLE_ADMIN

  providers:
    fos_userbundle:
      id: fos_user.user_provider.username_email

  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    main:
      pattern: ^/
      form_login:
        require_previous_session: false
        provider: fos_userbundle
        csrf_token_generator: security.csrf.token_manager
        default_target_path: home_redirect
        always_use_default_target_path: true
      logout:       true
      anonymous:    true
      remember_me:
        secret:   '%env(resolve:APP_SECRET)%'
        lifetime: 604800
        path:     /
        user_provider: fos_userbundle

  access_control:
    - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/regisztracio, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/activate, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/tour-types/\d/info-document, role: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/users, role: ROLE_SUPER_ADMIN }
    - { path: ^/user/toggle-enabled, role: ROLE_SUPER_ADMIN }
    - { path: ^/bookings, role: ROLE_SUPER_ADMIN }
    - { path: ^/bookings/calendar, role: ROLE_SUPER_ADMIN }
    - { path: ^/bookable-dates, role: ROLE_SUPER_ADMIN }
    - { path: ^/appointments/organizing, role: ROLE_PROGRAM_ORGANIZER }
    - { path: ^/change-project, role: ROLE_USER }
    - { path: ^/home_redirect, role: ROLE_USER }
    - { path: ^/profile, role: ROLE_USER }
    - { path: ^/appointments/attendees/parents-consent, role: ROLE_USER }
    - { path: ^/, allow_if: "'ROLE_PROGRAM_ORGANIZER' not in roles and 'ROLE_USER' in roles" }
