security:
    encoders:
        App\Entity\Global\Utilisateur:
            algorithm: auto

    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\Global\Utilisateur
                property: email
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            anonymous: true
            lazy: true
            provider: app_user_provider
            guard:
                authenticators:
                    - App\Security\AppAuthenticator
            logout:
                path: app_logout
                # where to redirect after logout
                # target: app_any_route
            pattern: ^/
            user_checker: App\Security\UtilisateurChecker

            remember_me:
                secret:   '%kernel.secret%'
                lifetime: 2426400 #30 Jours
                path:     /


            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#firewalls-authentication
            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/admin, roles: ROLE_ADMIN }
        - { path: ^/pgi, roles: ROLE_USER }

    access_denied_url: /pgi/unauthorized

    role_hierarchy:
        ROLE_RESPONSABLE_MOIJEUTRI: ROLE_USER
        ROLE_ATTACHE_COMMERCIAL: ROLE_USER
        ROLE_RESPONSABLE_BACK_OFFICE: ROLE_USER
        ROLE_ASSISTANT_LOGISTIQUE: ROLE_USER
        ROLE_ASSISTANT_COMPTABLE: ROLE_USER
        ROLE_OFFICE_MANAGER: ROLE_USER
        ROLE_JURISTE: ROLE_USER
        ROLE_RESPONSABLE_QHSE: ROLE_USER
        ROLE_RESPONSABLE_ECOBOX: ROLE_USER
        ROLE_RESPONSABLE_RSE: [ROLE_RESPONSABLE_ECOBOX, ROLE_ALLOWED_TO_SWITCH]
        ROLE_ASSISTANT_COMMERCIAL:
            [ROLE_ATTACHE_COMMERCIAL, ROLE_ALLOWED_TO_SWITCH]
        ROLE_RESPONSABLE_COMMERCIAL:
            [ROLE_ASSISTANT_COMMERCIAL, ROLE_ALLOWED_TO_SWITCH]
        ROLE_RESPONSABLE_EXPLOITATION:
            [
                ROLE_ASSISTANT_LOGISTIQUE,
                ROLE_RESPONSABLE_BACK_OFFICE,
                ROLE_ALLOWED_TO_SWITCH,
            ]
        ROLE_DIRECTRICE_EXPLOITATION:
            [
                ROLE_RESPONSABLE_EXPLOITATION,
                ROLE_RESPONSABLE_COMMERCIAL,
                ROLE_ALLOWED_TO_SWITCH,
            ]
        ROLE_RESPONSABLE_COMPTABLE:
            [ROLE_ASSISTANT_COMPTABLE, ROLE_ALLOWED_TO_SWITCH]
        ROLE_DIRECTEUR_FINANCE_COMPTABILITE:
            [ROLE_RESPONSABLE_COMPTABLE, ROLE_ALLOWED_TO_SWITCH]
        ROLE_RESPONSABLE_PROJET:
            [
                ROLE_RESPONSABLE_RSE,
                ROLE_RESPONSABLE_ECOBOX,
                ROLE_RESPONSABLE_QHSE,
                ROLE_ALLOWED_TO_SWITCH,
            ]
        ROLE_DIRECTEUR_GENERAL:
            [
                ROLE_DIRECTRICE_EXPLOITATION,
                ROLE_DIRECTEUR_FINANCE_COMPTABILITE,
                ROLE_OFFICE_MANAGER,
                ROLE_JURISTE,
                ROLE_RESPONSABLE_PROJET,
                ROLE_RESPONSABLE_RSE,
                ROLE_RESPONSABLE_MOIJEUTRI,
                ROLE_ALLOWED_TO_SWITCH,
            ]
        ROLE_ADMIN: [ROLE_DIRECTEUR_GENERAL, ROLE_ALLOWED_TO_SWITCH]
