Challenge 1 / 2

You add this to security.yaml:

security:
    access_control:
        - { path: ^/admin, roles: ROLE_ADMIN }

Now you want a page at /admin/login that everyone can see, even if they're not logged in. What's the simplest way to do that?

Put #[IsGranted('PUBLIC_ACCESS')] on the login controller so it overrides anything in security.yaml.

Add a more specific access rule above the admin rule, like - { path: ^/admin/login, roles: PUBLIC_ACCESS }, so the login page is allowed first.

Delete the access control rule and add #[IsGranted('ROLE_ADMIN') to every admin controller you need protected.

Change the rule to - { path: ^/admin, roles: ROLE_USER } so anyone who can log in can see the login page.