security:
    # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep,
    # which owns the credentials; ephub only ever sees a userinfo response.

    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email

    firewalls:
        dev:
            pattern: ^/(_profiler|_wdt|assets)/
            security: false
        main:
            lazy: true
            provider: app_user_provider
            entry_point: App\Security\LoginEntryPoint
            custom_authenticators:
                - App\Security\EpAuthenticator
            logout:
                path: app_logout
                target: app_login

    access_control:
        # The login surface itself has to stay reachable, or the entry point redirects in a loop.
        - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS }
        - { path: ^/auth/, roles: PUBLIC_ACCESS }
        - { path: ^/dev/, roles: PUBLIC_ACCESS }
        # Either role opens the app -- access_control treats a list of roles as an OR. Not
        # ROLE_USER: myep authenticates far more people than work here, and someone who holds
        # neither of these is refused at login with an explanation rather than let in to an
        # empty screen.
        - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] }

when@dev:
    security:
        firewalls:
            main:
                # Until a client is registered on myep, /dev/login lists the seeded users and
                # logs one in without credentials. The route and the controller are both
                # dev-only, so this cannot leak into another environment by accident.
                custom_authenticators:
                    - App\Security\EpAuthenticator
                    - App\Security\DevLoginAuthenticator