security:

    encoders:
        App\Entity\Security\User: { algorithm: auto }
        App\Entity\Security\UserFront: { algorithm: auto }

    providers:
        chain_providers:
            chain:
                providers: [ app_user, app_user_front ]
        app_user:
            entity: { class: App\Entity\Security\User, property: login }
        app_user_front:
            entity: { class: App\Entity\Security\UserFront, property: login }

    firewalls:

        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        main:
            provider: chain_providers
            anonymous: lazy
            form_login:
                login_path: front_index
                check_path: front_index
                csrf_token_generator: security.csrf.token_manager
            guard:
                authenticators:
                    - App\Security\LoginFormAuthenticator
                    - App\Security\LoginFrontFormAuthenticator
                entry_point: App\Security\LoginFormAuthenticator
            logout:
                path: security_logout
                target: front_index
                handlers: [App\EventListener\LogoutListener]
            remember_me:
                secret: '%kernel.secret%'
                lifetime: 2592000 # 30 days in seconds
                samesite: ~ # possible values: 'strict', 'lax' and null
            switch_user: { role: CAN_SWITCH_USER }

    # Note: Only the *first* access control that matches will be used
    access_control:
        - { path: ^/, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: '%env(SECURE_SCHEME)%' }
        - { path: ^/(espace-client|customer-area|espacio-de-clientes|spazio-cliente)/(connexion|login|accesso|accesso), roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: '%env(SECURE_SCHEME)%' }
        - { path: ^/admin, roles: ROLE_ADMIN, requires_channel: '%env(SECURE_SCHEME)%' }
        # require the user to fully login to change password
        #- { path: ^/change-password, roles: IS_AUTHENTICATED_FULLY }
        # if you wanted to force EVERY URL to be protected
#        - { path: ^/, roles: IS_AUTHENTICATED_REMEMBERED }