The guild's seal

Disaster: some smart aleck has booked every table at the Drunken Dragon for the next ten years, under the name “Sauron”. Anyone can send a pigeon, and that's exactly the problem.

So Gorm has made a deal with the guilds. Each one receives a seal, a secret token, to show with every reservation:

Authorization: Bearer silver-blades-7f3a9c

The demo seals are displayed by app:fonder-guildes (establish the guilds), in the console.

Your mission

1. In security.yaml, add an api firewall for the ^/api paths:
   • stateless (stateless: true): no session and no cookie, the seal comes with every request;
   • authenticated by access token (access_token), with your SceauHandler (seal handler).
2. Complete SceauHandler: find the guild (Guilde) that bears this seal (sceau). If none does, the seal is rejected.
3. Restrict POST /api/reservations to the guilds (ROLE_GUILDE). The menu stays open to everyone.
4. Link each reservation to the guild that made it.

The order trap

Symfony picks a single firewall per request: the first one whose pattern matches. main has no pattern, so it takes every request. The api firewall must be declared before it.

Why “stateless”?

A scroll is not a browser: it doesn't keep a session cookie. With stateless: true, Symfony checks the seal on every request and never opens a session. Another benefit: a website session, Bruna's for example, gives no rights at all on the API.