security:
    # https://symfony.com/doc/current/security/experimental_authenticators.html
    password_hashers:
        # Our user class and the algorithm we'll use to encode passwords
        # 'auto' means to let Symfony choose the best possible password hasher (Argon2 or Bcrypt)
        # https://symfony.com/doc/current/security.html#c-encoding-passwords
        App\Entity\User: 'auto'

    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        database_users:
            entity:
                class: App\Entity\User
                property: username

    firewalls:

        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            pattern: ^/
            lazy: true
            # The user provider to use.
            provider: database_users
            # This allows the user to login by submitting a username and password
            # Reference: https://symfony.com/doc/current/security/form_login_setup.html
            form_login:
                # The route name that the login form submits to
                check_path: /login
                # The name of the route where the login form lives
                # When the user tries to access a protected page, they are redirected here
                login_path: /login
                # Secure the login form against CSRF
                # Reference: https://symfony.com/doc/current/security/csrf.html
                enable_csrf: true
                # The page users are redirect to when there is no previous page stored in the
                # session (for example when the users access directly to the login page).
                default_target_path: /login
            logout:
                # The route name the user can go to in order to logout
                path: /logout
                # The name of the route to redirect to after logging out
                target: /login

            # needed because in tests we redefine the 'main' firewall to use
            # HTTP Basic instead of the login form, so this firewall has
            # multiple authenticators
            # See https://symfony.com/doc/current/security/experimental_authenticators.html#configuring-the-authentication-entry-point
            entry_point: 'form_login'
            access_denied_handler: App\Security\AccessDeniedHandler

            remember_me:
                secret: '%kernel.secret%'
                lifetime: 604800 # 1 week in seconds
                # by default, the feature is enabled by checking a
                # checkbox in the login form (see below), uncomment the
                # following line to always enable it.
                # always_remember_me: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/profile, roles: ROLE_USER }

    role_hierarchy:
        ROLE_ADMIN: ROLE_MASJID
        ROLE_MASJID: ROLE_USER

