# app/config/security.yml
security:
    encoders:
        FOS\UserBundle\Model\UserInterface: bcrypt

    role_hierarchy:
        #every one that logs in has this basic role
        ROLE_USER:

        ROLE_COUNTRY_EDITOR:
        ROLE_INSTITUTE_EDITOR:
        ROLE_PARTICIPANT_IMPORT:
        ROLE_GLOBAL_EDITOR: [ROLE_USER, ROLE_COUNTRY_EDITOR, ROLE_INSTITUTE_EDITOR, ROLE_PARTICIPANT_IMPORT]
        ROLE_LME: [ROLE_USER]
        ROLE_MANAGER: [ROLE_GLOBAL_EDITOR,ROLE_LME]
        ROLE_ADMIN:   [ROLE_MANAGER, ROLE_ALLOWED_TO_SWITCH]
        #the big boss
        ROLE_SUPERADMIN: [ROLE_ADMIN]
        #special roles for other sites
        ROLE_ODISCATADMIN:
        ROLE_OCEANCD:

    providers:
        fos_userbundle:
            id: fos_user.user_provider.username_email

    firewalls:

        api_login:
            pattern:  ^/api/login_check
            stateless: true
            anonymous: true
            provider: fos_userbundle
            form_login:
                check_path:     api_login_check
                username_parameter: username
                password_parameter: password
                require_previous_session: false
        #no idea if this is working or not
        #was created for #222
        api:
            pattern: ^/api/
            anonymous: true
            stateless: true
            guard:
                authenticators:
                    - 'jwt_token_authenticator'
        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_token_generator: security.csrf.token_manager
                use_referer: true

            logout:       true
            anonymous:    true
            switch_user: { role: ROLE_ADMIN}


    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin, role: ROLE_USER }
        #- { path: ^/group, role: ROLE_USER }
        #- { path: ^/groups, role: ROLE_USER }
        - { path: ^/profile/edit, role: ROLE_USER }
        - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api,       roles: IS_AUTHENTICATED_ANONYMOUSLY }
