security:
    password_hashers:
        Symfony\Component\Security\Core\User\InMemoryUser: 'auto'

    providers:
        # Un seul admin : utilisateur en mémoire, hash dans .env.local (jamais commité).
        # Générer le hash : php bin/console security:hash-password
        admin_users:
            memory:
                users:
                    admin:
                        password: '%env(ADMIN_PASSWORD_HASH)%'
                        roles: ['ROLE_ADMIN']

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        main:
            lazy: true
            provider: admin_users
            form_login:
                login_path: app_login
                check_path: app_login
                enable_csrf: true
                default_target_path: app_admin_contacts
            logout:
                path: app_logout
                target: app_home
            # Anti-bruteforce : 5 tentatives / 15 min (par IP + par utilisateur)
            login_throttling:
                max_attempts: 5
                interval: '15 minutes'

    access_control:
        - { path: ^/admin, roles: ROLE_ADMIN }
