security:
    encoders:
        FOS\UserBundle\Model\UserInterface: bcrypt

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN

    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        fos_userbundle:
            id: fos_user.user_provider.username

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
            
        # https://medium.com/@joeymasip/how-to-create-an-api-with-symfony-4-and-jwt-b2334a8fbec2
        # api_login:
        #     pattern: ^/api/login
        #     stateless: true
        #     anonymous: true
        #     provider: fos_userbundle
        #     json_login:
        #         check_path: /api/login_check
        #         # username_path: username
        #         # password_path: password
        #         success_handler: lexik_jwt_authentication.handler.authentication_success
        #         failure_handler: lexik_jwt_authentication.handler.authentication_failure
        #         require_previous_session: false
        
        # api_register:
        #     pattern:  ^/api/auth_register
        #     stateless: true
        #     anonymous: true

        # refresh:
        #     pattern:  ^/api/token/refresh
        #     stateless: true
        #     anonymous: true

        # api:
        #     pattern: ^/api
        #     stateless: true
        #     anonymous: false
        #     provider: fos_userbundle
        #     guard:
        #         authenticators:
        #             - lexik_jwt_authentication.jwt_token_authenticator
        # #             # - 'jwt_token_authenticator'

        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_token_generator: security.csrf.token_manager
                default_target_path:  '/admin'
            logout:
                target: /login
            anonymous:    true
            remember_me:
                secret:   '%kernel.secret%'
                lifetime: 604800 # 1 week in seconds
                path:     /

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        # - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        # - { path: ^/api/login_check, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin, role: ROLE_ADMIN }
        # - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
        # - { path: ^/api/token/refresh, roles: IS_AUTHENTICATED_ANONYMOUSLY }