STARTsecurity:
    encoders:
        Symfony\Component\Security\Core\User\User: plaintext

        Ec\CoreBundle\Entity\Consumer: #plaintext
            algorithm:  sha512
            iterations: 10
            encode_as_base64: true

        Application\BackendBundle\Entity\User: #plaintext
            algorithm:  sha512
            iterations: 10
            encode_as_base64: true

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    providers:
        admin:
            entity: { class: Application\BackendBundle\Entity\User }

        # admin_default:
        #     users:
        #         admin: { password: admin, roles: ['ROLE_SUPER_ADMIN', 'ROLE_AUTH'] }

        admin_provider:
            chain:
                # providers: [ admin, admin_default ]
                providers: [ admin ]

        consumer:
            entity: { class: Ec\CoreBundle\Entity\Consumer }

        # consumer_default:
        #     users:
        #         develop: { password: develop, roles:['ROLE_USER'] }

        consumer_provider:
            chain:
                # providers: [ consumer, consumer_default ]
                providers: [ consumer ]


    firewalls:
        #login:
        #    pattern:    ^(/admin)?/auth/login$
        #    security:   true

        #regist:
        #    pattern:    ^/auth/regist$
        #    security:   false

        admin:
            pattern:  ^/admin
            provider: admin_provider
            form_login:
                check_path: /admin/auth/login_check
                login_path: /admin/auth/login
                default_target_path: /admin
                post_only: true
                success_handler: backend_authentication
            logout:
                path:       /admin/auth/logout
                target:     /admin/auth/login
            anonymous: true

        # TODO: 正規表現の正当性
        consumer:
            pattern:  ^/
            provider: consumer_provider
            user_checker: frontend_consumer_user_checker
            form_login:
                check_path: /auth/login_check
                login_path: /auth/login
                default_target_path: /ec/consumer
                use_referer: true
                failure_handler: frontend_authentication
                success_handler: frontend_authentication
            logout:
                path:       /auth/logout
                target:     /auth/login
            anonymous: true

        dev:
            pattern:  ^/(_(profiler|wdt)|css|images|js)/
            security: false

    access_control:
        - { path: ^/(?!(admin|payment_notification)), roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        #- { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        #- { path: ^/_internal, roles: IS_AUTHENTICATED_ANONYMOUSLY, ip: 127.0.0.1 }

        # for admin
        - { path: ^/admin/auth/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }
        - { path: ^/admin, roles: ['ROLE_ADMIN', 'ROLE_SUPER_ADMIN'], requires_channel: https }
        - { path: ^/auth/regist$, roles: IS_AUTHENTICATED_ANONYMOUSLY }

        # for consumer
        - { path: ^/auth, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/ec/consumer/enquete_result, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/ec/consumer(!?/enquete_result), roles: IS_AUTHENTICATED_REMEMBERED }
        - { path: ^/ec/cart/(?!add), roles: IS_AUTHENTICATED_ANONYMOUSLY }
END