security:
    role_hierarchy:
        ROLE_EMPLOYEE: [ROLE_CUSTOMER]
        ROLE_ADMIN: [ROLE_EMPLOYEE, ROLE_CUSTOMER]

    password_hashers:
        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

    providers:
        app_user_provider:
            entity:
                class: App\Entity\User
                property: email

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        login:
            pattern: ^/api/v1/auth/login
            stateless: true
            provider: app_user_provider
            json_login:
                check_path: /api/v1/auth/login
                username_path: email
                password_path: password
                success_handler: App\Security\LoginSuccessHandler
                failure_handler: App\Security\LoginFailureHandler

        api:
            pattern: ^/api
            stateless: true
            provider: app_user_provider
            jwt: ~

    access_control:
        # Point de sonde volontairement public pour les checks infra (healthcheck, monitoring, CI).
        - { path: ^/api/v1/health, roles: PUBLIC_ACCESS }
        # Route de login publique : c'est l'unique entree sans JWT pour obtenir le token.
        - { path: ^/api/v1/auth/login, roles: PUBLIC_ACCESS }
        - { path: ^/api/v1/auth/refresh, roles: PUBLIC_ACCESS, methods: [POST] }
        - { path: ^/api/v1/auth/logout, roles: PUBLIC_ACCESS, methods: [POST] }
        # Exposer la doc OpenAPI en dev reduit le temps d'integration frontend/QA.
        - { path: ^/api/doc, roles: PUBLIC_ACCESS }
        # Les listes catalogue/produits/services sont publiques pour la consultation.
        - { path: ^/api/v1/catalog/(brands|categories)$, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/v1/products$, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/v1/services$, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/v1/catalog/products, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/v1/public/booking/slots$, roles: PUBLIC_ACCESS, methods: [GET] }
        - { path: ^/api/v1/public/booking/employees$, roles: PUBLIC_ACCESS, methods: [GET] }
        # Stripe doit appeler ce webhook sans JWT, la verification se fait par signature.
        - { path: ^/api/v1/payments/stripe/webhook$, roles: PUBLIC_ACCESS, methods: [POST] }
        # Le reste de l'API est prive par defaut ; on ouvre seulement au cas par cas.
        - { path: ^/api, roles: ROLE_USER }

when@test:
    security:
        password_hashers:
            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
                algorithm: auto
                cost: 4
                time_cost: 3
                memory_cost: 10
