security:
    encoders:
        App\Entity\User:
            algorithm: auto

    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    providers:
        # used to reload user from session & other features (e.g. switch_user)
        app_user_provider:
            entity:
                class: App\Entity\User
        api_user_provider:
            id: App\Security\ApiUserProvider
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false


        api-login:
            pattern: ^/api/login
            stateless: true
            provider: api_user_provider
            anonymous: true
            json_login:
                check_path: /api/login_check
                success_handler: lexik_jwt_authentication.handler.authentication_success
                failure_handler: lexik_jwt_authentication.handler.authentication_failure

        api:
            pattern:  ^/api
            stateless: true
            anonymous: false
            provider: api_user_provider
            guard:
                authenticators:
                    - lexik_jwt_authentication.jwt_token_authenticator

        main:
            anonymous: true
            provider: app_user_provider
            guard:
                authenticators:
                    - App\Security\PanelAuthenticator
            logout:
                path: panel_logout
                target: /login
            # activate different ways to authenticate
            # https://symfony.com/doc/current/security.html#firewalls-authentication

            # https://symfony.com/doc/current/security/impersonating_user.html
            # switch_user: true

    # Easy way to control access for large sections of your site
    # Note: Only the *first* access control that matches will be used
    access_control:
        # Public routes
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/panel/informe/varios/lista-precios, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        
        # API routes - Admin only
        - { path: ^/api, roles: ROLE_ADMIN }
        
        # Admin only routes
        - { path: ^/panel/caja-general, roles: ROLE_ADMIN }
        - { path: ^/panel/tipo-movimiento, roles: ROLE_ADMIN }
        - { path: ^/panel/usuarios, roles: ROLE_ADMIN }
        - { path: ^/panel/remitos, roles: ROLE_ADMIN }
        - { path: ^/panel/proveedor, roles: ROLE_ADMIN }
        - { path: ^/panel/cheques, roles: ROLE_ADMIN }
        - { path: ^/panel/configuracion, roles: ROLE_ADMIN }
        - { path: ^/panel/provincia, roles: ROLE_ADMIN }
        - { path: ^/panel/localidad, roles: ROLE_ADMIN }
        - { path: ^/panel/proveedor-debe-haber, roles: ROLE_ADMIN }
        
        # Admin and Cajero routes
        - { path: ^/panel/massive-update, roles: [ROLE_ADMIN, ROLE_CAJERO] }
        - { path: ^/panel/historico-procesos, roles: [ROLE_ADMIN, ROLE_CAJERO] }
        - { path: ^/panel/articulo.*eliminados, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/categoria, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/grupo, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/csv, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/marca-producto, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        
        # Cajero only routes
        - { path: ^/panel/resumen-caja, roles: ROLE_CAJERO }
        - { path: ^/panel/caja-movimiento-extra$, roles: ROLE_CAJERO }
        
        # Multi-role routes (Admin, Cajero, Vendedor)
        - { path: ^/panel/facturacion-envios-afip, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_VENDEDOR] }
        - { path: ^/panel/cuenta-corriente, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_VENDEDOR] }
        
        # Multi-role routes (Admin, Cajero, Vendedor, Logistica)
        - { path: ^/panel/facturacion, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_VENDEDOR, ROLE_LOGISTICA] }
        
        # Articulo routes - more restrictive patterns first
        - { path: ^/panel/articulo/.*/edit, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/articulo/new, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/articulo/.*/(active|delete), roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/articulo/import, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_LOGISTICA] }
        - { path: ^/panel/articulo, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_VENDEDOR, ROLE_LOGISTICA] }
        
        # Cliente routes - edit/new/delete accessible to admin, logistica and vendedor
        - { path: ^/panel/cliente/.*/edit, roles: [ROLE_ADMIN, ROLE_LOGISTICA, ROLE_VENDEDOR] }
        - { path: ^/panel/cliente/new, roles: [ROLE_ADMIN, ROLE_LOGISTICA, ROLE_VENDEDOR] }
        - { path: ^/panel/cliente/[0-9]+$, roles: [ROLE_ADMIN, ROLE_LOGISTICA, ROLE_VENDEDOR] }
        - { path: ^/panel/cliente, roles: [ROLE_ADMIN, ROLE_CAJERO, ROLE_VENDEDOR, ROLE_LOGISTICA] }
        
        # Informes access (Admin, Logistica, Vendedor)
        - { path: ^/panel/informes, roles: [ROLE_ADMIN, ROLE_LOGISTICA, ROLE_VENDEDOR] }
        
        # Transport - accessible to all authenticated users
        - { path: ^/panel/transporte, roles: IS_AUTHENTICATED_FULLY }
        
        # General panel access - must be authenticated
        - { path: ^/panel, roles: IS_AUTHENTICATED_FULLY }
