security:
    enable_authenticator_manager: true

    providers:
        pimcore_admin:
            id: Pimcore\Security\User\UserProvider

        # we use a custom user provider which loads users from the User class
        # the user provider is defined as service in services.yml
        app_user_provider:
            id: app.security.user_provider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false

        # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
        pimcore_webdav:
            pattern: ^/asset/webdav
            provider: pimcore_admin
            http_basic: ~

        # Pimcore Admin Bundle firewall
        pimcore_admin: '%pimcore_admin_bundle.firewall_settings%'

        # app_firewall is valid for the whole site
        app_firewall:
            # the provider defined above
            provider: app_user_provider
            form_login:
                login_path: /prihlaseni
                check_path: /login-check
                username_parameter: email
                password_parameter: password
                target_path_parameter: target
                enable_csrf: true
            logout:
                path: /logout
                target: /
                # optional: to keep logins of other firewalls (like admin)
                invalidate_session: false

    access_control:
        # Pimcore admin ACl  // DO NOT CHANGE!
        - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
        - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
        - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
        - { path: ^/admin, roles: ROLE_PIMCORE_USER }
        - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }

    role_hierarchy:
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]