# To get started with security, check out the documentation:
# https://symfony.com/doc/current/security.html
security:

    # https://symfony.com/doc/current/security.html#b-configuring-how-users-are-loaded
    providers:
        api_key_user_provider:
            id: Telnowedge\BaseBundle\Security\TokenUserProvider
        freepbx_chained_provider:
            chain:
                providers: [freepbx_extension_provider, freepbx_sasl_provider]
        freepbx_extension_provider:
            id: Telnowedge\BaseBundle\Security\User\ExtensionProvider
        freepbx_sasl_provider:
            id: Telnowedge\BaseBundle\Security\User\SaslProvider

    firewalls:
        main:
            anonymous: true
            stateless: true
            pattern: ^/
            guard:
                authenticators:
                   - Telnowedge\BaseBundle\Security\ApiKeyAuthenticator
                   - Telnowedge\BaseBundle\Security\XSSOHeaderAuthenticator
                provider: api_key_user_provider
                entry_point: Telnowedge\BaseBundle\Security\ApiKeyAuthenticator

            custom_form_login_ldap:
                provider: freepbx_chained_provider
                service: Symfony\Component\Ldap\Ldap
                dn_string: %ldap_user_bind%
                login_path: /login
                check_path: /login
                success_handler: Telnowedge\BaseBundle\Security\AuthenticationSuccessHandler
                failure_handler: Telnowedge\BaseBundle\Security\AuthenticationFailureHandler
            user_checker: Telnowedge\BaseBundle\Security\UserChecker

    access_control:
        - path: ^/doc
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        - path: ^/login
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        - path: ^/version$
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # Insee HTO
        - path: ^/freepbx/insee
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # Phone boot
        - path: ^/phoneprovision/setipvsmac
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # Phone boot
        - path: ^/phoneprovision/silentsetipvsmac
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # Phone boot
        - path: ^/phoneprovision/firstboot
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # Phonebook
        - path: ^/phoneprovision/phonebook
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # callflow compile cache
        - path: ^/did/callflow/compile
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # Lokkup api from asterisk
        - path: ^/directory/system/reverseLookup
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # pushkit api from asterisk
        - path: ^/3pcc/ios/system/pushkit/wakeup
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # SSO. Called by apache on Auth successful
        - path: ^/sso/auth$
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # Deprecated. Use instead /login with headers
        # SSO. Called by third party to validate token
        - path: ^/sso/link$
          roles: IS_AUTHENTICATED_ANONYMOUSLY

        # Zizanix
        - path: ^/phoneprovision/provisioning
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # Zizanix
        - path: ^/phoneprovision/userevent
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # Import ldap
        - path: '^/user/user/\d+/disable$'
          roles: IS_AUTHENTICATED_ANONYMOUSLY
          ips: [127.0.0.1, ::1]

        # For phone localhost between admin <-> api
        - path: ^/
          roles: IS_AUTHENTICATED_FULLY
          ips: [127.0.0.1, ::1]

        - path: ^/
          roles: IS_AUTHENTICATED_FULLY
          requires_channel: https
