security :
    enable_authenticator_manager : true

    # User providers
    providers :
        pimcore_provider :
            id : dam.security.user_provider
        pimcore_admin_provider :
            id : Pimcore\Security\User\UserProvider

    firewalls :
        # Development firewall (disable security for certain paths)
        dev :
            pattern : ^/(_(profiler|wdt)|css|images|js)/
            security : false

        # Pimcore WebDAV HTTP basic (DO NOT CHANGE)
        pimcore_webdav :
            pattern : ^/asset/webdav
            provider : pimcore_admin_provider
            http_basic : ~

        # Pimcore Admin Bundle firewall
        admin :
            context : pimcore_admin
            provider : pimcore_admin_provider
            pattern : ^/admin
            stateless : false
            form_login :
                login_path : pimcore_admin_login
                check_path : pimcore_admin_login_check
                default_target_path : pimcore_admin_index
                failure_path : pimcore_admin_login
                always_use_default_target_path : true
                require_previous_session : false
                username_parameter : email  # Ensure these match your form
                password_parameter : password
            custom_authenticators :
                - App\Security\OktaAdminAuthenticator
                - Pimcore\Bundle\AdminBundle\Security\Authenticator\AdminTokenAuthenticator
            logout :
                path : pimcore_admin_logout
                invalidate_session : true
                target : pimcore_admin_login
            entry_point : security.authenticator.form_login.admin


        login :
            pattern : ^/api/login
            stateless : true
            provider : pimcore_provider
            #            # context: pimcore_context
            json_login :
                check_path : /api/login
                username_path : email
                success_handler : lexik_jwt_authentication.handler.authentication_success
                failure_handler : lexik_jwt_authentication.handler.authentication_failure
        register :
            pattern : ^/api/register
            stateless : true
            lazy : true
            # context: pimcore_context

        authCheck :
            pattern : ^/api/authCheck
            stateless : true
            provider : pimcore_provider
            # context: pimcore_context
            custom_authenticators :
                - 'jwt_Authentication'
                - 'okta_Authentication'
            entry_point : 'jwt_Authentication'

        api :
            pattern : ^/graphql/
            stateless : true
            lazy : true
            provider : pimcore_provider
            # context: pimcore_context
            custom_authenticators :
                - 'okta_Authentication'
                - 'jwt_Authentication'
            entry_point : 'jwt_Authentication'

        share :
            pattern : ^/api/share
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        shareLink :
            pattern : ^/api/sharelink
            stateless : true
            lazy : true
            # context: pimcore_context

        sendShareLink :
            pattern : ^/api/sendsharelink
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        countrylist :
            pattern : ^/api/countries
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        languagelist :
            pattern : ^/api/languages
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        assetDownload :
            pattern : ^/asset/download
            stateless : true
            provider : pimcore_provider
            context : pimcore_context
            custom_authenticators :
                - 'okta_Authentication'
                - 'jwt_Authentication'
            entry_point : 'jwt_Authentication'

        assetslist :
            pattern : ^/api/assets
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #          - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        assetsByCategorylist :
            pattern : ^/api/category/assets
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        assetsCatalogAttributes :
            pattern : ^/api/catalogattributes
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        brandPortalCategorylist :
            pattern : ^/api/categories
            stateless : true
            custom_authenticators :
                - 'okta_Authentication'
                - 'jwt_Authentication'
            entry_point : 'jwt_Authentication'

        videoThumbnails :
            pattern : ^/api/videothumbnails
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        getVideoPreviewFilePath :
            pattern : ^/api/assetvideopath
            stateless : true
            lazy : true
            # context: pimcore_context

        fileSizes :
            pattern : ^/api/filesizes
            #        stateless: true
            #        anonymous: false
            #        provider: pimcore_user_provider
            #        custom_authenticators:
            #          authenticators:
            #            - lexik_jwt_authentication.jwt_token_authenticator
            stateless : true
            lazy : true
            # context: pimcore_context

        assetResolution :
            pattern : ^/api/assetresolution
            stateless : true
            lazy : true
            # context: pimcore_context

        assetResolutionByAssetIds :
            pattern : ^/api/assetresolutionbyids
            stateless : true
            lazy : true
            # context: pimcore_context

        confirmEmail :
            pattern : ^/api/confirmemail
            stateless : true
            lazy : true
            # context: pimcore_context

        assetTypes :
            pattern : ^/api/assettypes
            stateless : true
            lazy : true
            # context: pimcore_context

        assetFilePath :
            pattern : ^/api/assetfilepath
            stateless : true
            lazy : true
            # context: pimcore_context

        totalModels :
            pattern : ^/api/totalmodels
            stateless : true
            lazy : true
            # context: pimcore_context

        labelNames :
            pattern : ^/api/labelnames
            stateless : true
            lazy : true
            # context: pimcore_context
        documentThumbnails :
            pattern : ^/api/documentthumbnails
            stateless : true
            lazy : true
            # context: pimcore_context

        documentThumbnail :
            pattern : ^/api/documentthumbnail
            stateless : true
            lazy : true
            # context: pimcore_context

        searchResult :
            pattern : ^/api/search
            stateless : true
            lazy : true

        isUsernameExist :
            pattern : ^/api/isusernameexist
            stateless : true
            lazy : true
            # context: pimcore_context

        isEmailExist :
            pattern : ^/api/isemailexist
            stateless : true
            lazy : true
            # context: pimcore_context

        assetCustomMetaData :
            pattern : ^/api/assetsCustomMetadataInfo
            stateless : true
            lazy : true
            # context: pimcore_context

        assetSearchPermission :
            pattern : ^/api/assetsearchpermission
            stateless : true
            lazy : true
            # context: pimcore_context

        overwritePassword :
            pattern : ^/api/overwritepassword
            stateless : true
            lazy : true
            # context: pimcore_context

        getCustomAttributesOptionsNames :
            pattern : ^/api/getcustomattributesoptionsnames
            stateless : true
            lazy : true
            # context: pimcore_context

        getAssetByRegionId :
            pattern : ^/api/getassetbyregionid
            stateless : true
            lazy : true
            # context: pimcore_context

        forgotPasswordLink :
            pattern : ^/api/forgotpasswordlink
            stateless : true
            lazy : true
            # context: pimcore_context

        recoveryLinkPasswordReset :
            pattern : ^/api/recoverylinkpasswordreset
            stateless : true
            lazy : true
            # context: pimcore_context

        downloadProcessZip :
            pattern : ^/api/downloadprocesszip
            stateless : true
            lazy : true
            custom_authenticators :
                - 'okta_Authentication'
                - 'jwt_Authentication'
            entry_point : 'jwt_Authentication'
            # context: pimcore_context

        singleDownloadProcess :
            pattern : ^/api//api/singledownloadasset
            stateless : true
            lazy : true
            custom_authenticators :
                - 'okta_Authentication'
                - 'jwt_Authentication'
            entry_point : 'jwt_Authentication'

        assetsAvailableInDamPortal :
            pattern : ^/api/assetsavailableindamportal
            stateless : true
            lazy : true
            # context: pimcore_context

        resendConfirmEmail :
            pattern : ^/api/resendconfirmemail
            stateless : true
            lazy : true
            # context: pimcore_context

        assetColorSpace :
            pattern : ^/api/assetcolorspace
            stateless : true
            lazy : true
            # context: pimcore_context

        assetInfoList :
            pattern : ^/api/getassets
            stateless : true
            lazy : true
            # context: pimcore_context

        assetInfoList3 :
            pattern : ^/api/getassets3
            stateless : true
            lazy : true
            # context: pimcore_context
        assetsCount :
            pattern : ^/api/assetscount
            stateless : true
            lazy : true
            # context: pimcore_context

        filterAttributes :
            pattern : ^/api/filterattributes
            stateless : true
            lazy : true
            # context: pimcore_context

        searchResultsCount :
            pattern : ^/api/searchcount
            stateless : true
            lazy : true
            # context: pimcore_context

        recentlyAddedAssets :
            pattern : ^/api/getrecentlyaddedassests
            stateless : true
            lazy : true
            # context: pimcore_context

        recentlyAddedAttributes :
            pattern : ^/api/recentlyaddedattributes
            stateless : true
            lazy : true
            # context: pimcore_context

        catalogSliderRecentlyAddedAttributes :
            pattern : ^/api/catalogsliderrecentlyaddedattributes
            stateless : true
            lazy : true
            # context: pimcore_context

        assetTypesByCustomMetaDataId :
            pattern : ^/api/assettypesbycustommetadataid
            stateless : true
            lazy : true
            # context: pimcore_context

        favoriteVideoThumbnails :
            pattern : ^/api/favoritevideothumbnails
            stateless : true
            lazy : true
            # context: pimcore_context

        getAssetsByIds :
            pattern : ^/api/getassetsbyids
            stateless : true
            lazy : true
            # context: pimcore_context

        filterAttributesModification :
            pattern : ^/api/filterattributesmodified
            stateless : true
            lazy : true
            # context: pimcore_context

        getAssetsByAssetIds :
            pattern : ^/api/assetsbyassetids
            stateless : true
            lazy : true
            # context: pimcore_context

        getFavoriteAssets :
            pattern : ^/api/getfavoriteassets
            stateless : true
            lazy : true
            # context: pimcore_context

        addFavoriteAssets :
            pattern : ^/api/addfavoriteassets
            stateless : true
            lazy : true
            # context: pimcore_context

        removeFavoriteAssets :
            pattern : ^/api/removefavoriteassets
            stateless : true
            lazy : true
            # context: pimcore_context

        createFavoriteFolder :
            pattern : ^/api/createfavoritefolder
            stateless : true
            lazy : true
            # context: pimcore_context

        updateFavoriteFolder :
            pattern : ^/api/updatefavoritefolder
            stateless : true
            lazy : true
            # context: pimcore_context

        removeFavoriteFolder :
            pattern : ^/api/removefavoritefolder
            stateless : true
            lazy : true
            # context: pimcore_context

        removeAllFavoriteAssetsInFolder :
            pattern : ^/api/removeallfavoriteassetsinfolder
            stateless : true
            lazy : true
            # context: pimcore_context

        getCatalogs :
            pattern : ^/api/catalogs
            stateless : true

        recentlyAddedAttributesModified :
            pattern : ^/api/recentlyaddedfilterattributesmodified
            stateless : true
            lazy : true

        searchFilter :
            pattern : ^/api/searchfilter
            stateless : true
            lazy : true

        userDownloadData :
            pattern : ^/api/userdownloadlist
            stateless : true
            lazy : true
        downloadUpdate :
            pattern : ^/api/downloadupdate
            stateless : true
            lazy : true
            # context: pimcore_context
        notifiedRead :
            pattern : ^/api/notificationack
            stateless : true
            lazy : true

        removeZipTaskAllorOne :
            pattern : ^/api/removeziptasks
            stateless : true
            lazy : true
            custom_authenticators :
                - 'okta_Authentication'
                - 'jwt_Authentication'
            entry_point : 'jwt_Authentication'
    access_control :
        # Pimcore admin ACl  // DO NOT CHANGE!
        - { path : ^/api/login, roles : PUBLIC_ACCESS }
        - { path : ^/api/register, roles : PUBLIC_ACCESS }
        - { path : ^/api/authCheck, roles : IS_AUTHENTICATED_FULLY }
        - { path : ^/api/share, roles : PUBLIC_ACCESS }
        - { path : ^/api/downloadupdate, roles : PUBLIC_ACCESS }
        - { path : ^/api/notificationack, roles : PUBLIC_ACCESS }
        - { path : ^/api/sharelink, roles : PUBLIC_ACCESS }
        - { path : ^/api/sendsharelink, roles : PUBLIC_ACCESS }
        - { path : ^/api/countries, roles : PUBLIC_ACCESS }
        - { path : ^/api/languages, roles : PUBLIC_ACCESS }
        - { path : ^/asset/download, roles : PUBLIC_ACCESS }
        - { path : ^/api/assets, roles : PUBLIC_ACCESS }
        - { path : ^/api/category/assets, roles : PUBLIC_ACCESS }
        - { path : ^/api/categories, roles : IS_AUTHENTICATED_FULLY }
        - { path : ^/api/videothumbnails, roles : PUBLIC_ACCESS }
        - { path : ^/api/assetvideopath, roles : PUBLIC_ACCESS }
        - { path : ^/api/filesizes, roles : PUBLIC_ACCESS }
        - { path : ^/api/assetresolution, roles : PUBLIC_ACCESS }
        - { path : ^/api/assetresolutionbyids, roles : PUBLIC_ACCESS }
        - { path : ^/api/confirmemail, roles : PUBLIC_ACCESS }
        - { path : ^/api/resendconfirmemail, roles : PUBLIC_ACCESS }
        - { path : ^/api/assettypes, roles : PUBLIC_ACCESS }
        - { path : ^/api/assetfilepath, roles : PUBLIC_ACCESS }
        - { path : ^/api/documentthumbnails, roles : PUBLIC_ACCESS }
        - { path : ^/api/isemailexist, roles : PUBLIC_ACCESS }
        - { path : ^/api/isusernameexist, roles : PUBLIC_ACCESS }
        - { path : ^/api/assetsCustomMetadataInfo, roles : PUBLIC_ACCESS }
        - { path : ^/api/assetsearchpermission, roles : PUBLIC_ACCESS }
        - { path : ^/api/overwritepassword, roles : PUBLIC_ACCESS }
        - { path : ^/api/getcustomattributesoptionsnames, roles : PUBLIC_ACCESS }
        - { path : ^/api/getassetbyregionid, roles : PUBLIC_ACCESS }
        - { path : ^/api/forgotpasswordlink , roles : PUBLIC_ACCESS }
        - { path : ^/api/recoverylinkpasswordreset  , roles : PUBLIC_ACCESS }
        - { path : ^/api/downloadprocesszip  , roles : IS_AUTHENTICATED_FULLY }
        - { path : ^/api/assetsavailableindamportal , roles : PUBLIC_ACCESS }
        - { path : ^/api/search , roles : PUBLIC_ACCESS }
        - { path : ^/api/totalmodels , roles : PUBLIC_ACCESS }
        - { path : ^/api/labelnames , roles : PUBLIC_ACCESS }
        - { path : ^/api/assetcolorspace , roles : PUBLIC_ACCESS }
        - { path : ^/api/getassets , roles : PUBLIC_ACCESS }
        - { path : ^/api/getassets3 , roles : PUBLIC_ACCESS }
        - { path : ^/api/assetscount , roles : PUBLIC_ACCESS }
        - { path : ^/api/filterattributes , roles : PUBLIC_ACCESS }
        - { path : ^/api/catalogattributes , roles : PUBLIC_ACCESS }
        - { path : ^/api/searchcount , roles : PUBLIC_ACCESS }
        - { path : ^/api/getrecentlyaddedassests , roles : PUBLIC_ACCESS }
        - { path : ^/api/recentlyaddedattributes , roles : PUBLIC_ACCESS }
        - { path : ^/api/catalogsliderrecentlyaddedattributes , roles : PUBLIC_ACCESS }
        - { path : ^/api/assettypesbycustommetadataid , roles : PUBLIC_ACCESS }
        - { path : ^/api/favoritevideothumbnails , roles : PUBLIC_ACCESS }
        - { path : ^/api/getassetsbyids , roles : PUBLIC_ACCESS }
        - { path : ^/api/filterattributesmodified , roles : PUBLIC_ACCESS }
        - { path : ^/api/assetsbyassetids , roles : PUBLIC_ACCESS }
        - { path : ^/api/getfavoriteassets , roles : PUBLIC_ACCESS }
        - { path : ^/api/addfavoriteassets , roles : PUBLIC_ACCESS }
        - { path : ^/api/removefavoriteassets , roles : PUBLIC_ACCESS }
        - { path : ^/api/createfavoritefolder , roles : PUBLIC_ACCESS }
        - { path : ^/api/updatefavoritefolder , roles : PUBLIC_ACCESS }
        - { path : ^/api/removefavoritefolder , roles : PUBLIC_ACCESS }
        - { path : ^/api/userdownloadlist , roles : PUBLIC_ACCESS }
        - { path : ^/api/removeallfavoriteassetsinfolder , roles : PUBLIC_ACCESS }
        - { path : ^/api/catalogs , roles : PUBLIC_ACCESS }
        - { path : ^/api/recentlyaddedfilterattributesmodified , roles : PUBLIC_ACCESS }
        - { path : ^/api/singledownloadasset , roles : IS_AUTHENTICATED_FULLY }
        - { path : ^/send-maintenance-email, roles : ROLE_PIMCORE_USER }
        - { path : ^/admin/settings/display-custom-logo, roles : PUBLIC_ACCESS }
        - { path : ^/admin/login/2fa-verify, roles : IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path : ^/admin/login/2fa-setup, roles : ROLE_PIMCORE_USER }
        - { path : ^/admin/login/2fa, roles : IS_AUTHENTICATED_2FA_IN_PROGRESS }
        - { path : ^/admin/login$, roles : PUBLIC_ACCESS }
        - { path : ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles : PUBLIC_ACCESS }
        - { path : ^/admin, roles : ROLE_PIMCORE_USER }
        - { path : ^/asset/webdav, roles : ROLE_PIMCORE_USER }
        - { path : ^/api/searchfilter , roles : PUBLIC_ACCESS }
        - { path : ^/api/removeziptasks, roles : IS_AUTHENTICATED_FULLY }
    role_hierarchy :
        # Pimcore admin  // DO NOT CHANGE!
        ROLE_PIMCORE_ADMIN : [ ROLE_PIMCORE_USER ]
