security:

    role_hierarchy:
        ROLE_FREELANCER:    ROLE_USER
        ROLE_MANAGER:       ROLE_USER
        ROLE_SUPER_MANAGER: ROLE_MANAGER
        ROLE_ADMIN:         ROLE_USER
        ROLE_SUPER_ADMIN:   [ ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH ]

    encoders:
        App\Entity\User:
            algorithm: bcrypt

    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        entity_provider:
            entity:
                class:  App\Entity\User
                property: username

    firewalls:
        dev:
            pattern:    ^/(_(profiler|wdt)|css|images|js)/
            security:   false

        docs:
            pattern:    ^/api/docs
            anonymous:  true

        register:
            pattern:    ^/api/register
            stateless:  true
            anonymous:  true

        forgot_password:
            pattern:  ^/api/forgot-password
            stateless: true
            anonymous: true

        reset_password:
            pattern:  ^/api/reset-password.*
            stateless: true
            anonymous: true

        verify_token:
            pattern:  ^/api/verify.*
            stateless: true
            anonymous: true

        profile_login:
            pattern:    ^/api/profile_login.*
            stateless:  true
            anonymous:  true

        linkedin_login:
            pattern:    ^/api/linkedin_login.*
            stateless:  true
            anonymous:  true

        chat_token:
            pattern:    ^/api/chat_token
            stateless:  true
            anonymous:  true

        login:
            pattern:    ^/api/login
            stateless:  true
            anonymous:  true
            provider:   entity_provider
            json_login:
                check_path:               /api/login
                username_path:            email
                password_path:            password
                success_handler:          lexik_jwt_authentication.handler.authentication_success
                failure_handler:          lexik_jwt_authentication.handler.authentication_failure
                require_previous_session: false

        api:
            pattern:  ^/api
            stateless: true
            anonymous: false
            provider: entity_provider
            guard:
                authenticators:
                    - lexik_jwt_authentication.jwt_token_authenticator

    access_control:
        - { path: ^/api/docs, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/forgot-password, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/reset-password.*, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/verify.*, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/profile_login.*, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/linkedin_login.*, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/chat_token, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }