security:
  # https://symfony.com/doc/current/security/experimental_authenticators.html
  enable_authenticator_manager: true
  # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
  providers:
    db:
      id: XCart\Security\UserProvider
  password_hashers:
    xcart:
      id: XCart\Security\Hasher\PasswordHasher
  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false
    login:
      provider: db
      pattern: ^/api/storefront/auth/(login|refresh)
      stateless: true
      json_login:
        check_path: /api/storefront/auth/login
        success_handler: lexik_jwt_authentication.handler.authentication_success
        failure_handler: lexik_jwt_authentication.handler.authentication_failure
      refresh_jwt:
        check_path: /api/storefront/auth/refresh
    api:
      provider: db
      pattern: ^/api/
      stateless: true
      jwt: ~
      logout:
        path: /api/storefront/auth/logout
      custom_authenticators:
        - XCart\Security\Http\Authenticator\TokenAuthenticator
    web:
      stateless: true
      custom_authenticators:
        - XCart\Security\Http\Authenticator\WebAuthenticator

    main:
      lazy: true

  access_control:
    - {path: ^/api/storefront/, roles: ROLE_USER}
    - {path: ^/api/, roles: [ROLE_USER, ROLE_ADMIN], methods: [GET]}
    - {path: ^/api/, roles: ROLE_ADMIN}
