parameters:
    oro_security.allowed_protocols: ['http', 'https']

services:
    oro_security.authorization_checker:
        class: Oro\Bundle\SecurityBundle\Authorization\AuthorizationChecker
        decorates: security.authorization_checker
        arguments:
            - '@.inner'
            - '@oro_security.acl.object_identity_factory'
            - '@oro_security.acl.annotation_provider'
            - '@oro_security.acl.group_provider.chain'
            - '@logger'
        tags:
            - { name: monolog.logger, channel: security }

    oro_security.request_authorization_checker:
        class: Oro\Bundle\SecurityBundle\Authorization\RequestAuthorizationChecker
        arguments:
            - '@security.authorization_checker'
            - '@oro_entity.orm.entity_class_resolver'
            - '@oro_security.acl.annotation_provider'

    oro_security.class_authorization_checker:
        class: Oro\Bundle\SecurityBundle\Authorization\ClassAuthorizationChecker
        arguments:
            - '@security.authorization_checker'
            - '@oro_security.acl.object_identity_factory'
            - '@oro_security.acl.annotation_provider'
            - '@logger'
        tags:
            - { name: monolog.logger, channel: security }

    oro_security.token_accessor:
        class: Oro\Bundle\SecurityBundle\Authentication\TokenAccessor
        public: true
        arguments:
            - '@security.token_storage'

    Oro\Bundle\SecurityBundle\Authentication\TokenAccessorInterface:
        alias: oro_security.token_accessor

    oro_security.acl.base_manager:
        class: Oro\Bundle\SecurityBundle\Acl\Persistence\BaseAclManager

    oro_security.acl.manager:
        class: Oro\Bundle\SecurityBundle\Acl\Persistence\AclManager
        public: true
        arguments:
            - '@oro_security.acl.object_identity_factory'
            - '@oro_security.acl.extension_selector'
            - '@?security.acl.dbal.provider'
            - '@oro_security.acl.ace_provider'
        calls:
            - [ setBaseAclManager, [ '@oro_security.acl.base_manager' ] ]

    oro_security.acl.privilege_repository:
        class: Oro\Bundle\SecurityBundle\Acl\Persistence\AclPrivilegeRepository
        arguments:
            - '@oro_security.acl.manager'
            - '@translator'

    oro_security.acl.sid_manager:
        class: Oro\Bundle\SecurityBundle\Acl\Persistence\AclSidManager
        arguments:
            - '@?security.acl.dbal.provider'
        calls:
            - [ setBaseAclManager, [ '@oro_security.acl.base_manager' ] ]

    security.acl.cache.doctrine.cache_impl:
        public: false
        parent: oro.data.cache
        tags:
            - { name: 'cache.pool', namespace: 'oro_acl' }

    oro_security.acl.ace_provider:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Persistence\AceManipulationHelper

    oro_security.acl.extension_selector:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Extension\AclExtensionSelector
        arguments:
            - !abstract '$extensionNames defined in Oro\Bundle\SecurityBundle\DependencyInjection\Compiler\AclConfigurationPass'
            - !abstract '$extensionContainer defined in Oro\Bundle\SecurityBundle\DependencyInjection\Compiler\AclConfigurationPass'
            - '@oro_security.acl.object_id_accessor'

    oro_security.acl.extension.entity:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Extension\EntityAclExtension
        arguments:
            - '@oro_security.acl.object_id_accessor'
            - '@oro_entity.orm.entity_class_resolver'
            - '@oro_security.entity_security_metadata_provider'
            - '@oro_security.owner.metadata_provider.chain'
            - '@oro_security.owner.entity_owner_accessor'
            - '@oro_security.owner.ownership_decision_maker.chain'
            - '@oro_security.acl.permission_manager'
            - '@oro_security.acl.group_provider.chain'
            - '@oro_security.acl.extension.field'
        tags:
            - { name: oro_security.acl.extension, priority: 20 }

    oro_security.acl.extension.action:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Extension\ActionAclExtension
        arguments:
            - '@oro_security.action_metadata_provider'
        tags:
            - { name: oro_security.acl.extension, priority: 10 }

    oro_security.acl.provider:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Domain\RootBasedAclProvider
        arguments:
            - '@oro_security.acl.object_identity_factory'
            - '@oro_security.acl.security_identity_to_string_converter'
            - '@oro_security.acl.full_access_field_root_acl_builder'
        calls:
            - [setUnderlyingCache, ['@security.acl.underlying.cache']]

    oro_security.acl.full_access_field_root_acl_builder:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Domain\FullAccessFieldRootAclBuilder
        arguments:
            - '@oro_security.acl.extension_selector'

    security.acl.underlying.cache:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Cache\UnderlyingAclCache
        arguments:
            - '@security.acl.underlying.cache.doctrine.cache_impl'

    security.acl.underlying.cache.doctrine.cache_impl:
        public: false
        parent: oro.data.cache
        tags:
            - { name: 'cache.pool', namespace: 'oro_acl_underlying' }

    oro_security.entity_security_metadata_provider_link:
        tags:
            - { name: oro_service_link, service: oro_security.entity_security_metadata_provider }

    oro_security.acl.voter_link:
        tags:
            - { name: oro_service_link, service: ?security.acl.voter.basic_permissions }

    oro_security.acl.permission_granting_strategy:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Domain\PermissionGrantingStrategy
        calls:
             - [setAuditLogger, ['@?security.acl.audit_logger']]
             - [setSecurityMetadataProvider, ['@oro_security.entity_security_metadata_provider_link']]
             - [setContext, ['@oro_security.acl.voter_link']]

    oro_security.acl.permission_map:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Permission\PermissionMap
        arguments:
            - '@oro_security.acl.extension_selector'

    oro_security.cache.provider.permission:
        parent: oro.data.cache
        tags:
            - { name: 'cache.pool', namespace: 'oro_security_permission' }

    oro_security.acl.permission_manager:
        class: Oro\Bundle\SecurityBundle\Acl\Permission\PermissionManager
        arguments:
            - '@oro_entity.doctrine_helper'
            - '@oro_security.cache.provider.permission'

    oro_security.acl.configurable_permission_provider:
        class: Oro\Bundle\SecurityBundle\Acl\Permission\ConfigurablePermissionProvider
        arguments:
            - '@oro_security.configuration.provider.configurable_permission_configuration'

    oro_security.filter.privilege_capability_filter:
        class: Oro\Bundle\SecurityBundle\Filter\AclPrivilegeCapabilityFilter
        public: false
        tags:
            - { name: oro.security.filter.acl_privilege }

    oro_security.filter.privilege_entity_filter:
        class: Oro\Bundle\SecurityBundle\Filter\AclPrivilegeEntityFilter
        public: false
        tags:
            - { name: oro.security.filter.acl_privilege }

    oro_security.filter.configurable_permission_filter:
        class: Oro\Bundle\SecurityBundle\Filter\AclPrivilegeConfigurableFilter
        arguments:
            - !tagged_iterator oro.security.filter.acl_privilege
            - '@oro_security.acl.configurable_permission_provider'

    oro_security.acl.security_identity_to_string_converter:
        class: Oro\Bundle\SecurityBundle\Acl\Domain\SecurityIdentityToStringConverter

    oro_security.acl.object_identity_factory:
        class: Oro\Bundle\SecurityBundle\Acl\Domain\ObjectIdentityFactory
        arguments:
            - '@oro_security.acl.extension_selector'

    oro_security.acl.object_identity_retrieval_strategy:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Domain\ObjectIdentityRetrievalStrategy
        arguments:
            - '@oro_security.acl.object_identity_factory'

    oro_security.acl.object_id_accessor:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Domain\ObjectIdAccessor
        arguments:
            - '@oro_entity.doctrine_helper'

    oro_security.acl.group_provider.chain:
        class: Oro\Bundle\SecurityBundle\Acl\Group\ChainAclGroupProvider
        arguments:
            - !abstract '$providers defined in Oro\Bundle\SecurityBundle\DependencyInjection\Compiler\AclGroupProvidersPass'

    oro_security.owner.decision_maker:
        public: false
        class: Oro\Bundle\SecurityBundle\Owner\EntityOwnershipDecisionMaker
        arguments:
            - '@oro_security.ownership_tree_provider.chain'
            - '@oro_security.acl.object_id_accessor'
            - '@oro_security.owner.entity_owner_accessor'
            - '@oro_security.owner.metadata_provider.chain'
            - '@oro_security.token_accessor'
        tags:
           - { name: oro_security.owner.ownership_decision_maker }

    oro_security.form.type.oro_acl_access_level_selector:
        class: Oro\Bundle\SecurityBundle\Form\Type\AclAccessLevelSelectorType
        tags:
            - { name: form.type, alias: oro_acl_access_level_selector }

    oro_security.form.type.object_label_type:
        class: Oro\Bundle\SecurityBundle\Form\Type\ObjectLabelType
        arguments:
            - '@oro_entity.entity_class_name_helper'
        tags:
            - { name: form.type, alias: oro_acl_label }

    oro_security.form.type.oro_acl_collection:
        class: Oro\Bundle\SecurityBundle\Form\Type\PrivilegeCollectionType
        tags:
            - { name: form.type, alias: oro_acl_collection }

    oro_security.form.type.oro_acl_privilege:
        class: Oro\Bundle\SecurityBundle\Form\Type\AclPrivilegeType
        tags:
            - { name: form.type, alias: oro_acl_privilege }

    oro_security.form.type.oro_acl_permission_collection:
        class: Oro\Bundle\SecurityBundle\Form\Type\PermissionCollectionType
        tags:
            - { name: form.type, alias: oro_acl_permission_collection }

    oro_security.entity_security_metadata_provider:
        public: false
        class: Oro\Bundle\SecurityBundle\Metadata\EntitySecurityMetadataProvider
        arguments:
            - '@oro_entity_config.config_manager'
            - '@doctrine'
            - '@oro_security.entity_security_metadata_provider.cache'
            - '@event_dispatcher'
            - '@oro_security.acl.group_provider.chain'

    oro_security.entity_security_metadata_provider.cache:
        public: false
        parent: oro.data.cache
        tags:
            - { name: 'cache.pool', namespace: 'oro_acl_entities' }

    oro_security.action_metadata_provider:
        class: Oro\Bundle\SecurityBundle\Metadata\ActionSecurityMetadataProvider
        public: false
        arguments:
            - '@oro_security.acl.annotation_provider'

    oro_security.acl.annotation_provider:
        class: Oro\Bundle\SecurityBundle\Metadata\AclAnnotationProvider
        public: false
        parent: oro.static_config_provider.abstract
        arguments:
            - '%kernel.cache_dir%/oro/acl_annotations.php'
            - '%kernel.debug%'
            - '@oro_entity.orm.entity_class_resolver'
            - !tagged_iterator oro_security.acl.config_loader

    oro_security.acl.config_loader:
        class: Oro\Bundle\SecurityBundle\Annotation\Loader\AclConfigLoader
        public: false
        tags:
            - { name: oro_security.acl.config_loader }

    oro_security.acl.annotation_loader:
        class: Oro\Bundle\SecurityBundle\Annotation\Loader\AclAnnotationLoader
        public: false
        arguments:
            - '@oro_ui.controller_class_provider'
            - '@annotation_reader'
        tags:
            - { name: oro_security.acl.config_loader, priority: -10 }

    oro_security.entity_security_config_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\EntitySecurityMetadataConfigListener
        arguments:
            - '@oro_security.entity_security_metadata_provider'
        tags:
            - { name: kernel.event_listener, event: oro.entity_config.pre_flush, method: preFlush }

    oro_security.entity_security_metadata_provider.cache.warmer:
        class: Oro\Bundle\SecurityBundle\Cache\EntitySecurityMetadataCacheWarmer
        public: false
        arguments:
            - '@oro_security.entity_security_metadata_provider'
        tags:
            - { name: kernel.cache_warmer }

    oro_security.listener.controller:
        class: Oro\Bundle\SecurityBundle\EventListener\ControllerListener
        arguments:
            - '@oro_security.class_authorization_checker'
            - '@logger'
        tags:
            - { name: kernel.event_listener, event: kernel.controller, method: onKernelController, priority: -1 }
            - { name: monolog.logger, channel: security }

    oro_security.twig.security_extension:
        class: Oro\Bundle\SecurityBundle\Twig\OroSecurityExtension
        public: false
        arguments:
            - '@oro_platform.twig.service_locator'
        tags:
            - { name: twig.extension }

    Oro\Bundle\SecurityBundle\Encoder\DefaultCrypter:
        alias: oro_security.encoder.default

    oro_security.encoder.default:
        class: Oro\Bundle\SecurityBundle\Encoder\DefaultCrypter
        public: true
        arguments: [ '%kernel.secret%' ]

    oro_security.encoder.repetitive_crypter:
        class: Oro\Bundle\SecurityBundle\Encoder\RepetitiveCrypter
        public: true
        arguments: [ '%kernel.secret%']

    oro_security.access_rule_walker_context_factory:
        class: Oro\Bundle\SecurityBundle\ORM\Walker\AccessRuleWalkerContextFactory
        arguments:
            - '@security.token_storage'
            - '@oro_security.access_rule_executor'

    oro_security.acl_helper:
        class: Oro\Bundle\SecurityBundle\ORM\Walker\AclHelper
        public: true
        arguments:
            - '@oro_security.access_rule_walker_context_factory'
        calls:
            - [setQueryCacheProvider, ['@oro_security.acl_query.cache_provider']]

    Oro\Bundle\SecurityBundle\ORM\Walker\AclHelper:
        alias: oro_security.acl_helper

    oro_security.search.acl_helper:
        class: Oro\Bundle\SecurityBundle\Search\AclHelper
        arguments:
            - '@oro_search.provider.search_mapping'
            - '@oro_security.token_accessor'
            - '@oro_security.orm.ownership_sql_walker_builder'
            - '@oro_security.owner.metadata_provider.chain'
            - '@oro_security.search.acl_helper.condition_provider'

    oro_security.search.acl_helper.condition_provider:
        class: Oro\Bundle\SecurityBundle\Search\SearchAclHelperConditionProvider
        arguments:
            - !tagged_iterator oro_security.acl_helper.condition

    oro_security.orm.ownership_sql_walker_builder:
        public: false
        class: Oro\Bundle\SecurityBundle\ORM\Walker\OwnershipConditionDataBuilder
        arguments:
            - '@security.authorization_checker'
            - '@security.token_storage'
            - '@oro_security.acl.object_id_accessor'
            - '@oro_security.entity_security_metadata_provider'
            - '@oro_security.owner.metadata_provider.chain'
            - '@oro_security.ownership_tree_provider.chain'
            - '@security.acl.voter.basic_permissions'
        calls:
            - [setAclGroupProvider, ['@oro_security.acl.group_provider.chain']]

    oro_security.ownership_tree_provider.chain:
        class: Oro\Bundle\SecurityBundle\Owner\ChainOwnerTreeProvider
        arguments:
            - !tagged_iterator oro_security.ownership.tree_provider

    oro_security.ownership_tree_provider:
        public: false
        class: Oro\Bundle\SecurityBundle\Owner\OwnerTreeProvider
        arguments:
            - '@doctrine'
            - '@oro_security.database_checker'
            - '@oro_security.ownership_tree_provider.cache'
            - '@oro_security.owner.ownership_metadata_provider'
            - '@security.token_storage'
        calls:
            - [setLogger, ['@logger']]
        tags:
            - { name: oro_security.ownership.tree_provider }

    oro_security.database_checker:
        public: false
        class: Oro\Bundle\EntityBundle\Tools\DatabaseChecker
        arguments:
            - '@doctrine'
            - ['oro_user']
            - '@oro_distribution.handler.application_status'
        tags:
            - { name: oro_entity.database_checker }

    oro_security.ownership_tree_provider.cache:
        public: false
        parent: oro.data.cache
        tags:
            - { name: 'cache.pool', namespace: 'oro_acl_owner_tree' }

    oro_security.ownership_tree.cache.warmer:
        class: Oro\Bundle\SecurityBundle\Cache\OwnerTreeCacheWarmer
        public: false
        arguments:
            - '@oro_security.ownership_tree_provider.chain'
        tags:
            - { name: kernel.cache_warmer }

    oro_security.ownership_tree_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\OwnerTreeListener
        arguments:
            - '@oro_security.ownership_tree_provider.chain'
        calls:
            - ['addSupportedClass', ['Oro\Bundle\UserBundle\Entity\User', [owner, organization], [businessUnits, organizations]]]
            - ['addSupportedClass', ['Oro\Bundle\OrganizationBundle\Entity\BusinessUnit', [owner, organization], [users]]]
            - ['addSupportedClass', ['Oro\Bundle\OrganizationBundle\Entity\Organization']]
        tags:
            - { name: doctrine.event_listener, event: onFlush }
            - { name: doctrine.event_listener, event: postFlush }

    oro_security.doctrine_acl_cache_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\DoctrineAclCacheListener
        arguments:
            - '@oro_security.acl_query.cache_provider'
            - '@oro_security.ownership_tree_provider'
        tags:
            - { name: doctrine.event_listener, event: onFlush }

    oro_security.token.factory.username_password_organization:
        class: Oro\Bundle\SecurityBundle\Authentication\Token\UsernamePasswordOrganizationTokenFactory

    oro_security.token.provider.rememberme:
        class: Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider
        public: true
        arguments:
            - '@doctrine.dbal.default_connection'

    oro_security.token.factory.organization_rememberme:
        class: Oro\Bundle\SecurityBundle\Authentication\Token\OrganizationRememberMeTokenFactory

    oro_security.authentication.organization_guesser:
        class: Oro\Bundle\SecurityBundle\Authentication\Guesser\OrganizationGuesser

    oro_security.authentication.listener.basic:
        class: Oro\Bundle\SecurityBundle\Http\Firewall\OrganizationBasicAuthenticationListener
        arguments:
            - '@security.token_storage'
            - '@security.authentication.manager'
            - null
            - null
            - '@oro_organization.organization_manager'
            - '@?logger'
        calls:
            - [setTokenFactory, ['@oro_security.token.factory.username_password_organization']]
        public: false
        abstract: true

    oro_security.authentication.provider.username_password_organization:
        class: Oro\Bundle\SecurityBundle\Authentication\Provider\UsernamePasswordOrganizationAuthenticationProvider
        arguments:
            - ~ # UserProviderInterface $userProvider
            - ~ # UserCheckerInterface $userChecker
            - ~ # string $providerKey
            - '@security.encoder_factory'
            - '%security.authentication.hide_user_not_found%'
        calls:
            - [setTokenFactory, ['@oro_security.token.factory.username_password_organization']]
            - [setOrganizationGuesser, ['@oro_security.authentication.organization_guesser']]
        abstract: true
        public: false

    oro_security.authentication.provider.organization_rememberme:
        class: Oro\Bundle\SecurityBundle\Authentication\Provider\OrganizationRememberMeAuthenticationProvider
        arguments:
            - ~ # UserCheckerInterface $userChecker
        calls:
            - [setTokenFactory, ['@oro_security.token.factory.organization_rememberme']]
            - [setOrganizationGuesser, ['@oro_security.authentication.organization_guesser']]
        abstract: true
        public: false

    oro_security.listener.context_listener:
        class: Oro\Bundle\SecurityBundle\Http\Firewall\ContextListener
        arguments:
            - '@security.token_storage'
            - '@doctrine'
            - '@logger'
        tags:
            - { name: kernel.event_listener, event: kernel.request, method: onKernelRequest, priority: 7 }

    oro_security.listener.api_listener:
          class: Oro\Bundle\SecurityBundle\EventListener\ApiEventListener
          arguments:
              - '@oro_security.request_authorization_checker'
              - '@oro_security.acl_helper'
              - '@request_stack'
          tags:
              - { name: kernel.event_listener, event: oro_api.request.find.after, method: onFindAfter }

    oro_security.listener.refresh_context_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\RefreshContextListener
        arguments:
            - '@security.token_storage'
            - '@doctrine'
        tags:
            - { name: doctrine.event_listener, event: preClose }
            - { name: doctrine.event_listener, event: onClear }

    oro_security.form.extension.aclprotected_type:
        class: Oro\Bundle\SecurityBundle\Form\Extension\AclProtectedTypeExtension
        arguments:
            - '@oro_security.acl_helper'
        tags:
            - { name: form.type_extension, alias: entity, extended_type: Symfony\Bridge\Doctrine\Form\Type\EntityType }

    oro_security.listener.search_listener:
          class: Oro\Bundle\SecurityBundle\EventListener\SearchListener
          arguments:
              - '@oro_security.owner.ownership_metadata_provider'
          tags:
              - { name: kernel.event_listener, event: oro_search.prepare_entity_map, method: prepareEntityMapEvent, priority: 100 }
              - { name: kernel.event_listener, event: oro_search.search_mapping_collect, method: collectEntityMapEvent, priority: -100 }

    oro_security.walker_hint_provider.current_user:
        public: false
        class: Oro\Bundle\SecurityBundle\ORM\Walker\CurrentUserWalkerHintProvider
        arguments:
             - '@security.token_storage'

    oro_security.query_hint.filter_by_current_user:
        public: false
        abstract: true
        tags:
            -
                name: oro_entity.query_hint
                hint: oro_security.filter_by_current_user
                alias: HINT_FILTER_BY_CURRENT_USER
                tree_walker: Oro\Bundle\SecurityBundle\ORM\Walker\CurrentUserWalker
                walker_hint_provider: oro_security.walker_hint_provider.current_user

    oro_security.configuration.provider.permission_configuration:
        class: Oro\Bundle\SecurityBundle\Configuration\PermissionConfigurationProvider
        parent: oro.static_config_provider.abstract
        arguments:
            - '%kernel.cache_dir%/oro/permissions.php'
            - '%kernel.debug%'

    oro_security.configuration.provider.configurable_permission_configuration:
        class: Oro\Bundle\SecurityBundle\Configuration\ConfigurablePermissionConfigurationProvider
        public: true
        parent: oro.static_config_provider.abstract
        arguments:
            - '%kernel.cache_dir%/oro/configurable_permissions.php'
            - '%kernel.debug%'

    oro_security.configuration.builder.permission_configuration:
        class: Oro\Bundle\SecurityBundle\Configuration\PermissionConfigurationBuilder
        arguments:
            - '@oro_entity.doctrine_helper'
            - '@validator'
            - '@doctrine.orm.entity_manager'

    oro_security.layout.data_provider.acl:
        class: Oro\Bundle\SecurityBundle\Layout\DataProvider\AclProvider
        arguments:
            - '@security.authorization_checker'
            - '@doctrine'
        tags:
            - { name: layout.data_provider, alias: acl }

    oro_security.form.field_acl_helper:
        class: Oro\Bundle\SecurityBundle\Form\FieldAclHelper
        public: false
        arguments:
            - '@security.authorization_checker'
            - '@oro_entity_config.config_manager'
            - '@oro_entity.doctrine_helper'

    # the form extension registered with `oro_security.form.extension.decorator` decorator service
    # and cannot be registered with form.type_extension tag because
    # this extension should be registered as first extension for all forms.
    oro_security.form.extension.aclprotected_fields_type:
        class: Oro\Bundle\SecurityBundle\Form\Extension\AclProtectedFieldTypeExtension
        arguments:
            - '@oro_security.form.field_acl_helper'
            - '@logger'

    oro_security.form.extension.decorator:
        class: Oro\Bundle\SecurityBundle\Form\Extension\AclFormExtension
        decorates: 'form.extension'
        arguments:
            - '@oro_security.form.extension.aclprotected_fields_type'
            - '@.inner'

    oro_security.acl.extension.field:
        public: false
        class: Oro\Bundle\SecurityBundle\Acl\Extension\FieldAclExtension
        arguments:
            - '@oro_security.acl.object_id_accessor'
            - '@oro_security.owner.metadata_provider.chain'
            - '@oro_security.owner.ownership_decision_maker.chain'
            - '@oro_security.owner.entity_owner_accessor'
            - '@oro_entity_config.config_manager'
            - '@oro_security.entity_security_metadata_provider'

    oro_security.entity_serializer.field_filter:
        class: Oro\Bundle\SecurityBundle\Filter\EntitySerializerFieldFilter
        arguments:
            - '@security.authorization_checker'
            - '@oro_entity_config.config_manager'
            - '@oro_api.entity_serializer.doctrine_helper'

    oro_security.listener.config_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\FieldAclConfigListener
        arguments:
            - '@oro_security.entity_security_metadata_provider'
        tags:
            - { name: kernel.event_listener, event: oro.entity_config.pre_flush, method: preFlush }

    oro_security.helper.property_path_helper:
        class: Oro\Bundle\SecurityBundle\Util\PropertyPathSecurityHelper
        arguments:
            - '@security.authorization_checker'
            - '@doctrine'
            - '@oro_entity_config.provider.entity'

    oro_security.csrf_protected_request_helper:
        class: Oro\Bundle\SecurityBundle\Request\CsrfProtectedRequestHelper
        arguments:
            - '@oro_security.csrf_request_manager'

    oro_security.framework_extra.converter.doctrine.orm_decorator:
        class: Oro\Bundle\SecurityBundle\Request\ParamConverter\DoctrineParamConverter
        decorates: sensio_framework_extra.converter.doctrine.orm
        parent: sensio_framework_extra.converter.doctrine.orm
        arguments:
            - '@oro_security.request_authorization_checker'

    oro_security.security.acl.security_identity_retrieval_strategy.cacheable:
        class: Oro\Bundle\SecurityBundle\Acl\Domain\CacheableSecurityIdentityRetrievalStrategy
        decorates: security.acl.security_identity_retrieval_strategy
        decoration_priority: -255 # should be at the top of the decoration chain
        arguments:
            - '@.inner'

    oro_security.acl.voter.basic_permissions:
        class: Oro\Bundle\SecurityBundle\Acl\Voter\AclVoter
        decorates: security.acl.voter.basic_permissions
        parent: security.acl.voter.basic_permissions
        arguments:
            index_1: '@oro_security.acl.object_identity_retrieval_strategy'
            index_3: '@oro_security.acl.permission_map'
        calls:
            - [setAclExtensionSelector, ['@oro_security.acl.extension_selector']]
            - [setAclGroupProvider, ['@oro_security.acl.group_provider.chain']]

    oro_security.acl.dbal.provider:
        decorates: security.acl.dbal.provider
        parent: security.acl.dbal.provider
        # make ACL DBAL provider public because it can be used as standalone service, for example in migrations
        public: true
        arguments:
            index_1: '@oro_security.acl.permission_granting_strategy'

    oro_security.alias.acl.dbal.provider:
        alias: security.acl.dbal.provider
        public: true

    oro_security.token_serializer:
        class: Oro\Bundle\SecurityBundle\Authentication\TokenSerializer
        arguments:
            - '@doctrine'

    oro_security.generator.random_token:
        class: Oro\Bundle\SecurityBundle\Generator\RandomTokenGenerator
        arguments:
            - '@oro_security.encoder.default'

    Oro\Bundle\SecurityBundle\Generator\RandomTokenGeneratorInterface:
        alias: oro_security.generator.random_token

    oro_security.form.data_transformer.factory.crypted_data:
        class: Oro\Bundle\SecurityBundle\Form\DataTransformer\Factory\CryptedDataTransformerFactory
        arguments:
            - '@oro_security.encoder.default'
            - '@logger'
        lazy: true
        public: false

    oro_security.owner.checker:
        class: Oro\Bundle\SecurityBundle\Owner\OwnerChecker
        arguments:
           - '@oro_entity.doctrine_helper'
           - '@oro_organization.business_unit_manager'
           - '@oro_security.owner.ownership_metadata_provider'
           - '@oro_security.owner.entity_owner_accessor'
           - '@security.authorization_checker'
           - '@oro_security.token_accessor'
           - '@oro_security.ownership_tree_provider'
           - '@security.acl.voter.basic_permissions'

    oro_security.provider.console.console_context_global_options_provider:
        class: Oro\Bundle\SecurityBundle\Provider\Console\ConsoleContextGlobalOptionsProvider
        arguments:
            - '@service_container'
        tags:
            - { name: oro_platform.console.global_options_provider }

    oro_security.csrf.cookie_token_storage:
        class: Oro\Bundle\SecurityBundle\Csrf\CookieTokenStorage
        public: false
        arguments:
            - ~ #sets in Oro\Bundle\SecurityBundle\DependencyInjection\OroSecurityExtension
            - '@request_stack'
            - ~ #sets in Oro\Bundle\SecurityBundle\DependencyInjection\OroSecurityExtension

    oro_security.csrf_token_manager:
        class: Symfony\Component\Security\Csrf\CsrfTokenManager
        public: false
        arguments:
            - '@security.csrf.token_generator'
            - '@oro_security.csrf.cookie_token_storage'

    oro_security.csrf_request_manager:
        class: Oro\Bundle\SecurityBundle\Csrf\CsrfRequestManager
        public: true
        arguments:
            - '@oro_security.csrf_token_manager'

    oro_security.event_listener.csrf_protection_request_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\CsrfProtectionRequestListener
        arguments:
            - '@oro_security.csrf_request_manager'
            - '@oro_security.csrf_token_manager'
        tags:
            - { name: kernel.event_listener, event: kernel.controller, method: onKernelController, priority: -10 }
            - { name: kernel.event_listener, event: kernel.response, method: onKernelResponse }

    oro_security.access_rule_executor:
        class: Oro\Bundle\SecurityBundle\AccessRule\AccessRuleExecutor
        public: false
        arguments:
            - [] # rules
            - ~ # service locator
            - '@oro_security.access_rule_option_matcher'

    oro_security.access_rule_option_matcher:
        class: Oro\Bundle\SecurityBundle\AccessRule\AccessRuleOptionMatcher
        public: false
        arguments:
            - '@oro_security.token_accessor'

    oro_security.access_rule.acl:
        class: Oro\Bundle\SecurityBundle\AccessRule\AclAccessRule
        public: false
        arguments:
            - '@oro_security.orm.ownership_sql_walker_builder'
            - '@oro_security.owner.metadata_provider.chain'
        tags:
            - { name: oro_security.access_rule, aclDisable: false }

    oro_security.access_rule.available_owner_check:
        class: Oro\Bundle\SecurityBundle\AccessRule\AvailableOwnerAccessRule
        public: false
        arguments:
            - '@oro_security.orm.ownership_sql_walker_builder'
            - '@oro_security.owner.metadata_provider.chain'
        tags:
            - { name: oro_security.access_rule, permission: CREATE, availableOwnerEnable: true }
            - { name: oro_security.access_rule, permission: ASSIGN, availableOwnerEnable: true }

    oro_security.form.extension.autocomplete_password_type:
        class: Oro\Bundle\SecurityBundle\Form\Extension\AutocompletePasswordTypeExtension
        tags:
            - { name: form.type_extension, extended_type: Symfony\Component\Form\Extension\Core\Type\PasswordType }

    oro_security.menu_builder.strip_dangerous_protocols:
        class: Oro\Bundle\SecurityBundle\Menu\Builder\StripDangerousProtocolsBuilder
        arguments:
            - '@oro_security.util.uri_security_helper'
        tags:
            - { name: oro_menu.builder, priority: 300 }

    oro_security.validator.constraints.not_dangerous_protocol:
        class: Oro\Bundle\SecurityBundle\Validator\Constraints\NotDangerousProtocolValidator
        arguments:
            - '@oro_security.util.uri_security_helper'
        tags:
            - { name: validator.constraint_validator, alias: oro_security.validator.constraints.not_dangerous_protocol }

    oro_security.util.uri_security_helper:
        class: Oro\Bundle\SecurityBundle\Util\UriSecurityHelper
        arguments:
            - '%oro_security.allowed_protocols%'

    oro_security.error_listener:
        class: Oro\Bundle\SecurityBundle\EventListener\ErrorListener
        decorates: exception_listener
        parent: exception_listener

    oro_security.action.generate_uuid:
        class: 'Oro\Bundle\SecurityBundle\Action\GenerateUuidAction'
        arguments:
            - '@oro_action.expression.context_accessor'
        tags:
            - { name: oro_action.action, alias: generate_uuid }

    oro_security.session.storage_factory:
        decorates: session.storage.factory
        class: Oro\Bundle\SecurityBundle\Session\SessionStorageFactory
        arguments:
            - '@.inner'
            - !tagged_iterator oro_security.session_bag

    Oro\Bundle\SecurityBundle\EntityConfig\SecurityEntityConfiguration:
        tags:
            - oro_entity_config.validation.entity_config

    Oro\Bundle\SecurityBundle\EntityConfig\SecurityFieldConfiguration:
        tags:
            - oro_entity_config.validation.entity_config

    oro_security.util.same_site_url_helper:
        class: Oro\Bundle\SecurityBundle\Util\SameSiteUrlHelper
        arguments:
            - '@request_stack'

    Oro\Bundle\SecurityBundle\Util\SameSiteUrlHelper:
        alias: oro_security.util.same_site_url_helper

    oro.session_handler:
        class: '\SessionHandlerInterface'
        public: true
        arguments:
            - !tagged_locator { tag: 'oro_session_handler', index_by: 'alias' }
            - '%session_handler_dsn%'
        factory: [ 'Oro\Bundle\SecurityBundle\Session\SessionHandlerFactory', 'create' ]

    # The fallback for the backward compatibility
    snc_redis.session.handler:
        alias: oro.session_handler

    oro_security.authentication.failure_handler:
        parent: security.authentication.failure_handler
        class: Oro\Bundle\SecurityBundle\Authentication\Handler\DefaultAuthenticationFailureHandler

    oro_security.authentication.success_handler:
        parent: security.authentication.success_handler
        class: Oro\Bundle\SecurityBundle\Authentication\Handler\DefaultAuthenticationSuccessHandler

    oro_security.acl_query.cache_instantiator:
        class: Oro\Bundle\SecurityBundle\Cache\FilesystemCacheInstantiator
        arguments:
            - '%oro_cache.data_adapter_lifetime%'
            - '%oro_cache.data_adapter_directory%'

    oro_security.acl_query.cache_user_info_provider:
        class: Oro\Bundle\SecurityBundle\Cache\DoctrineAclCacheUserInfoProvider
        arguments:
            - '@oro_security.token_accessor'

    oro_security.acl_query.cache_provider:
        class: Oro\Bundle\SecurityBundle\Cache\DoctrineAclCacheProvider
        arguments:
            - '@oro_security.acl_query.cache_instantiator'
            - '@oro_security.acl_query.cache_user_info_provider'
