From c3d9b74dc0cfb179479b6e7bd99803291883ba2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A9ctor=20Franco?= <hectorfranco@nowo.tech>
Date: Thu, 20 Aug 2026 09:42:11 +0200
Subject: [PATCH] feat(recipe): when@prod PII capture/sampling + access_control

---
 .../1.0/config/packages/nowo_http_log.yaml    | 22 +++++++++++++++++++
 .../packages/security_nowo_http_log.yaml      |  4 ++++
 2 files changed, 26 insertions(+)
 create mode 100644 .symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/security_nowo_http_log.yaml

diff --git a/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/nowo_http_log.yaml b/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/nowo_http_log.yaml
index 010dc69..2b7ca50 100644
--- a/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/nowo_http_log.yaml
+++ b/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/nowo_http_log.yaml
@@ -57,3 +57,25 @@ nowo_http_log:
             - ROLE_ADMIN
         access_checker: null
         allow_unauthenticated: false
+
+when@prod:
+    nowo_http_log:
+        sampling_rate: 0.25
+        capture:
+            request_body: false
+            max_body_bytes: 16384
+            response_body_by_type:
+                html: false
+                json: false
+                soap: false
+                xml: false
+                text: false
+                binary: false
+                other: false
+        retention:
+            days: 14
+        export:
+            max_sync_rows: 500
+        security:
+            access_roles: [ROLE_ADMIN]
+            allow_unauthenticated: false
diff --git a/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/security_nowo_http_log.yaml b/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/security_nowo_http_log.yaml
new file mode 100644
index 0000000..45dfe2b
--- /dev/null
+++ b/.symfony/recipe/nowo-tech/http-log-bundle/1.0/config/packages/security_nowo_http_log.yaml
@@ -0,0 +1,4 @@
+# Merged into security.access_control by Symfony (REQ-SEC-004).
+security:
+    access_control:
+        - { path: ^/admin/http-log, roles: ROLE_ADMIN }