# config/packages/security.yaml
security:
  enable_authenticator_manager: true

  providers:
    app_user_provider:
      entity:
        class: App\Entity\User
        property: email

  password_hashers:
    App\Entity\User:
      algorithm: auto

  firewalls:
    # 1) Static & profiler
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false

    # 2) Mot-de-passe oublié
    reset_password:
      pattern: ^/(?:reset-password|reinitialisation-mdp)
      security: false

    # 3) Pare-feu unique pour tout le site (front + /api)
    main:
      pattern: ^/
      lazy: true
      provider: app_user_provider
      custom_authenticator: App\Security\AppCustomAuthenticator
      access_denied_handler: App\Security\AccessDeniedHandler
      logout:
        path: app_logout
        target: /login
        invalidate_session: true
      remember_me:
        secret: '%kernel.secret%'
        lifetime: 604800   # 7 jours

  access_control:
    # Pages publiques
    - { path: ^/(?:reset-password|reinitialisation-mdp), roles: PUBLIC_ACCESS }
    - { path: ^/mot-de-passe-oublie,                     roles: PUBLIC_ACCESS }
    - { path: ^/verify/email,                            roles: PUBLIC_ACCESS }
    - { path: ^/register,                                roles: PUBLIC_ACCESS }
    - { path: ^/login,                                   roles: PUBLIC_ACCESS }
    - { path: ^/conditions-generales,                    roles: PUBLIC_ACCESS }

    # Espace membre et API privée
    - { path: ^/dashboard,            roles: ROLE_USER }
    - { path: ^/theme,                roles: ROLE_USER }
    - { path: ^/creation-nouvelle-page, roles: ROLE_USER }
    - { path: ^/compte,               roles: ROLE_USER }
    - { path: ^/api/username,         roles: ROLE_USER }
    - { path: ^/api/my-profile,       roles: ROLE_USER }
    - { path: ^/premium,              roles: ROLE_USER }
    - { path: ^/choose-username,      roles: IS_AUTHENTICATED_FULLY }
    - { path: ^/merci,                roles: ROLE_USER }


    # Tout le reste
    - { path: ^/, roles: PUBLIC_ACCESS }
