# app/config/security.yml
security:
    encoders:
        FOS\UserBundle\Model\UserInterface: bcrypt

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: ROLE_ADMIN

    providers:
        fos_userbundle:
            id: fos_user.user_provider.username_email

    firewalls:
        dev:
            pattern:  ^/(_(profiler|wdt)|css|images|js)/
            security: false
        admin:
            pattern:            /admin(.*)
            form_login:
                provider:       fos_userbundle
                login_path:     /admin/login
                check_path:     /admin/login_check
                default_target_path: /admin/
            logout:
                path:           /admin/logout
                target:         /admin/login
            anonymous:    true
        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_token_generator: security.csrf.token_manager
                # if you are using Symfony < 2.8, use the following config instead:
                # csrf_provider: form.csrf_provider
            oauth:
                resource_owners:
                    facebook:           "/login/check-facebook"
                    google:             "/login/check-google"
                    twitter:            "/login/check-twitter"
                    instagram:          "/login/check-instagram"
                login_path:        /login
                failure_path:      /login
                oauth_user_provider:
                    #this is my custom user provider, created from FOSUBUserProvider - will manage the
                    #automatic user registration on your site, with data from the provider (facebook. google, etc.)
                    service: my_user_provider
                remember_me: true
            logout:       true
            anonymous:    true
            remember_me:
                secret:      "%secret%"
                lifetime: 31536000 # 365 days in seconds
                path:     /
                domain:   ~ # Defaults to the current domain from $_SERVER

    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        
        - { path: ^/admin/api/, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/logout$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/login_check$, role: IS_AUTHENTICATED_ANONYMOUSLY }        

        - { path: ^/admin/, role: ROLE_ADMIN }
        - { path: ^/article/, role: ROLE_USER}
        - { path: ^/medias/, role: ROLE_USER }
        - { path: ^/subscription/notify.html, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/faq-support.html, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/refund-policy.html, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/subscription/, role: ROLE_USER }
        - { path: /mylist.html, role: ROLE_USER }
