security:
    enable_authenticator_manager: true

    providers:
        pimcore_admin:
            id: Pimcore\Security\User\UserProvider


        # we use a custom user provider which loads users from the Customer class
        # the user provider is provided by the CMF
        cmf_customer_provider:
            id: cmf.security.user_provider


    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
        pimcore_webdav:
            pattern: ^/asset/webdav
            provider: pimcore_admin
            http_basic: ~

        # Pimcore Admin Bundle firewall
        pimcore_admin: '%pimcore_admin_bundle.firewall_settings%'

        # Pimcore CMF bundle firewall
        cmf_webservice: '%customer_management_framework.firewall_settings%'

        # demo_frontend firewall is valid for the whole site
        demo_frontend:

            # -----------------------------------------------------
            #   SAMPLE SIMPLE FIREWALL CONFIG FOR HTTP-BASIC AUTH
            # -----------------------------------------------------
            # the provider defined above
            # provider: cmf_customer_provider
            # http_basic: ~

            # -----------------------------------------------------
            #   SAMPLE FIREWALL CONFIG FOR FORM-AUTH
            # -----------------------------------------------------

            # the provider defined above

            provider: cmf_customer_provider
            
            entry_point: form_login

            form_login:
                enable_csrf: true
                login_path: 'account-login'
                check_path: 'account-login'
                default_target_path: 'account-index'


            logout:
                path: 'account-logout'
                target: /

                # optional: to keep logins of other firewalls (like admin)
                invalidate_session: false

            remember_me:
                secret: '%kernel.secret%'

    access_control:
        # Pimcore admin ACl  // DO NOT CHANGE!
        - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
        - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_PIMCORE_USER }
        - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }

    role_hierarchy:
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]
