security:
  password_hashers:
    TerraFlow\Entity\User:
      algorithm: auto
    TerraFlow\Security\RecoveryCodePasswordHolder:
      algorithm: auto


  providers:
    # used to reload user from session & other features (e.g. switch_user)
    app_user_provider:
      id: TerraFlow\Security\UserProvider

  firewalls:
    dev:
      pattern: ^/(_(profiler|wdt)|css|images|js)/
      security: false

    main:
      lazy: true
      two_factor:
        auth_form_path: 2fa_login
        check_path: 2fa_login_check
        # false: Session-Ziel nutzen (z. B. Rückkehr zu /oauth/authorize nach Login auf dem OAuth-IdP).
        # true würde nach 2FA immer / laden und Fremdanmeldungen (getterraflow.de → itsandre.mov) abbrechen.
        always_use_default_target_path: false
        default_target_path: /
      form_login:
        enable_csrf: true
        login_path: app_storefront_login
        check_path: app_storefront_login
        always_use_default_target_path: false
        default_target_path: /
      logout:
        path: app_storefront_logout
        target: /
      remember_me:
        secret: '%kernel.secret%'
        lifetime: 604800 # 1 Woche in Sekunden
        path: /
        always_remember_me: false

  access_control:
    # SchebTwoFactorBundle: Logout während 2FA; Formular nur im Zwischenzustand
    - { path: ^/logout, roles: PUBLIC_ACCESS }
    - { path: ^/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
    # OAuth2 (League): Token- und Userinfo-Endpunkt ohne Session
    - { path: ^/oauth/token, roles: PUBLIC_ACCESS }
    - { path: ^/oauth/userinfo, roles: PUBLIC_ACCESS }
    - { path: ^/auth/oauth/, roles: PUBLIC_ACCESS }
    - { path: ^/admin, roles: IS_AUTHENTICATED_FULLY }
