security:
    enable_authenticator_manager: true
    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
    password_hashers:
        # auto hasher with default options for the User class (and children)
        App\Entity\User: 'auto'

        # auto hasher with custom options for all PasswordAuthenticatedUserInterface instances
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
            algorithm: 'auto'
            cost: 13

    role_hierarchy:
        ROLE_ADMIN:       [ROLE_USER, ROLE_COMMERCIAL, ROLE_LOGISTICS, ROLE_HR, ROLE_PRODUCTION, ROLE_FINANCE, ROLE_DIRECTOR, ROLE_WMS_SUPERVISOR, ROLE_WMS_SHOP_MANAGER]
        ROLE_DIRECTOR:    [ROLE_USER, ROLE_COMMERCIAL, ROLE_LOGISTICS, ROLE_HR, ROLE_PRODUCTION, ROLE_FINANCE]
        ROLE_COMMERCIAL:  [ROLE_USER]
        ROLE_LOGISTICS:   [ROLE_USER, ROLE_WMS_OPERATOR]
        ROLE_HR:          [ROLE_USER]
        ROLE_PRODUCTION:  [ROLE_USER]
        ROLE_FINANCE:     [ROLE_USER]
        ROLE_WMS_SHOP_MANAGER: [ROLE_WMS_SUPERVISOR]
        ROLE_WMS_DEVICE: []
        # Legacy role aliases (for backward compatibility)
        ROLE_DIR:         [ROLE_DIRECTOR]
        ROLE_QUOT:        [ROLE_USER]
        ROLE_FIN:         [ROLE_FINANCE]
        ROLE_COM:         [ROLE_COMMERCIAL]
        ROLE_MAG:         [ROLE_LOGISTICS, ROLE_WMS_OPERATOR]  # Warehouse/Magazine
        ROLE_EMB:         [ROLE_LOGISTICS]  # Packaging
        ROLE_WMS:         [ROLE_WMS_OPERATOR]  # WMS Operator
        # WMS-specific roles
        ROLE_WMS_SUPERVISOR: [ROLE_WMS_OPERATOR]
        ROLE_WMS_OPERATOR: [ROLE_USER]

    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        wms_api:
            pattern: ^/api/wms
            stateless: true
            security: true
            custom_authenticators:
                - App\Security\WmsDeviceAuthenticator
        main:
            lazy: true
            provider: app_user_provider
            login_throttling:
                max_attempts: 5
                interval: '15 minutes'
            custom_authenticator: App\Security\AppCustomAuthenticator
            remember_me:
                secret: '%kernel.secret%'
                lifetime: 604800
                path: /
                always_remember_me: false
            logout:
                path: app_logout

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        # Public routes
        - { path: ^/$, roles: PUBLIC_ACCESS }
        - { path: ^/login, roles: PUBLIC_ACCESS }
        - { path: ^/select-company, roles: PUBLIC_ACCESS }
        - { path: ^/forgot-password, roles: PUBLIC_ACCESS }
        - { path: ^/reset-password, roles: PUBLIC_ACCESS }
        - { path: ^/ui/components, roles: PUBLIC_ACCESS }
        - { path: ^/ui/handheld, roles: PUBLIC_ACCESS }
        - { path: ^/metrics/web-vitals, roles: PUBLIC_ACCESS }
        - { path: ^/api/wms/workstation/register, roles: PUBLIC_ACCESS }

        # Admin
        - { path: ^/admin, roles: [ROLE_ADMIN, ROLE_DIRECTOR] }
        # HR
        - { path: ^/HR_module, roles: [ROLE_HR, ROLE_ADMIN] }
        - { path: ^/hr/salary-calculation, roles: [ROLE_HR, ROLE_ADMIN, ROLE_FINANCE] }
        - { path: ^/hr/time-tracking, roles: [ROLE_HR, ROLE_ADMIN] }
        - { path: ^/hr/, roles: [ROLE_HR, ROLE_ADMIN] }

        # Commercial
        - { path: ^/quotation/customer, roles: [ROLE_QUOT, ROLE_COMMERCIAL, ROLE_ADMIN] }
        - { path: ^/quotation, roles: [ROLE_QUOT, ROLE_COMMERCIAL, ROLE_ADMIN, ROLE_DIRECTOR] }

        # Logistics
        - { path: ^/purchase/order, roles: [ROLE_LOGISTICS, ROLE_ADMIN, ROLE_DIRECTOR] }
        - { path: ^/po/reception, roles: [ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/supplier/, roles: [ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/consumable/, roles: [ROLE_LOGISTICS, ROLE_PRODUCTION, ROLE_ADMIN] }

        # Finance
        - { path: ^/FIN_module, roles: [ROLE_FINANCE, ROLE_ADMIN] }
        - { path: ^/bank/, roles: [ROLE_FINANCE, ROLE_ADMIN] }
        - { path: ^/invoice/category, roles: [ROLE_FINANCE, ROLE_ADMIN] }
        - { path: ^/currency, roles: [ROLE_FINANCE, ROLE_ADMIN] }

        # WMS (Warehouse Management System)
        - { path: ^/wms/receive, roles: [ROLE_WMS_OPERATOR, ROLE_WMS_SUPERVISOR, ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/wms/move, roles: [ROLE_WMS_OPERATOR, ROLE_WMS_SUPERVISOR, ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/wms/pick, roles: [ROLE_WMS_OPERATOR, ROLE_WMS_SUPERVISOR, ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/wms/count, roles: [ROLE_WMS_OPERATOR, ROLE_WMS_SUPERVISOR, ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/wms/, roles: [ROLE_WMS_OPERATOR, ROLE_WMS_SUPERVISOR, ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/api/wms/workstation, roles: [ROLE_WMS_DEVICE, ROLE_WMS_SHOP_MANAGER, ROLE_WMS_SUPERVISOR, ROLE_LOGISTICS, ROLE_ADMIN] }
        - { path: ^/api/wms, roles: [ROLE_WMS_DEVICE, ROLE_WMS_SHOP_MANAGER, ROLE_WMS_SUPERVISOR] }

        # Shared
        - { path: ^/profile, roles: ROLE_USER }
        - { path: ^/article, roles: [ROLE_LOGISTICS, ROLE_COMMERCIAL, ROLE_PRODUCTION, ROLE_ADMIN] }

        # Default fallback
        - { path: ^/, roles: ROLE_USER }

when@test:
    security:
        password_hashers:
            # By default, password hashers are resource intensive and take time. This is
            # important to generate secure password hashes. In tests however, secure hashes
            # are not important, waste resources and increase test times. The following
            # reduces the work factor to the lowest possible values.
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4 # Lowest possible value for bcrypt
                time_cost: 3 # Lowest possible value for argon
                memory_cost: 10 # Lowest possible value for argon
