Symfony 3 anonymous route - symfony

Question

I have a problem with creation anonymous route in my project. I have almost all bundle protected but some routes I need to make accessible externally. I tried many hours how it should be but seems that I am missing something. I am attaching config files.
Config.yml
security:
access_decision_manager:
strategy: consensus
encoders:
FOS\UserBundle\Model\UserInterface: bcrypt
AppBundle\Domain\Customer\Customer: bcrypt
role_hierarchy:
ROLE_CUSTOMER: ROLE_USER
ROLE_CUSTOMER_CONFIRMED: ROLE_CUSTOMER
ROLE_ACCOUNT: ROLE_USER
ROLE_ADMIN: ROLE_ACCOUNT
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
providers:
fos_userbundle:
id: fos_user.user_provider.username
customer:
id: app.customer.user_provider
firewalls:
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
api_customers_login:
pattern: ^/api/customers/login
anonymous: true
api_login:
pattern: ^/api/login
stateless: true
anonymous: true
form_login:
provider: customer
check_path: /api/login
success_handler: lexik_jwt_authentication.handler.authentication_success
failure_handler: lexik_jwt_authentication.handler.authentication_failure
require_previous_session: false
api:
provider: customer
# pattern: ^/api(?!/doc|/conventions/*|/speakers/*|/events/*|/workshops/*|/agendadays/*)
pattern: ^/api(?!/doc|/public/*)
stateless: true
guard:
authenticators:
- lexik_jwt_authentication.jwt_token_authenticator
# - app.customer.jwt_token_authenticator
shop:
provider: customer
pattern: ^/shop
form_login:
provider: customer
csrf_token_generator: security.csrf.token_manager
use_referer: true
login_path: shop_login
check_path: shop_login_check
# check_path: shop_login
always_use_default_target_path: true
default_target_path: shop_default_index
logout:
path: shop_logout
target: shop_default_index
# handlers: [user.logout_handler]
anonymous: true
remember_me:
secret: '%secret%'
# lifetime: 86400 # 1 day
lifetime: 3600 # 1 day
path: /shop
name: shop_remember
main:
provider: fos_userbundle
pattern: ^/(?!/api)
# #deprecated
entry_point: user.entry_point
form_login:
provider: fos_userbundle
csrf_token_generator: security.csrf.token_manager
use_referer: true
login_path: fos_user_security_login
check_path: fos_user_security_check
always_use_default_target_path: false
default_target_path: homepage
logout:
path: fos_user_security_logout
target: homepage
handlers: [user.logout_handler]
anonymous: true
switch_user: true
remember_me:
secret: '%secret%'
lifetime: 3600 # 1 day
path: /
name: main_remember
access_control:
- { path: ^/[0-9]+/agenda/feed.xml, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api/customers/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api/public, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
- { path: ^/api/doc, roles: [ROLE_ADMIN, ROLE_ACCOUNT] }
- { path: ^/shop/.+/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/shop/.+/customer/email-confirm, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/shop/.+/customer, roles: ROLE_CUSTOMER }
- { path: ^/shop/.+/cart/checkout, roles: ROLE_CUSTOMER_CONFIRMED }
- { path: ^/shop/.+/cart, roles: ROLE_CUSTOMER }
- { path: ^/shop, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/presence/check, roles: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/users/current, roles: [ROLE_ADMIN] }
- { path: ^/users, roles: [ROLE_SUPER_ADMIN] }
- { path: ^/action-log, roles: [ROLE_SUPER_ADMIN] }
- { path: ^/, roles: [ROLE_ADMIN, ROLE_ACCOUNT] }
In controller action is defined like:
/**
*
* #Route("/{convention}/agenda/feed.xml", name="convention_agenda_feed")
* #param Request $request
* #param Convention $convention
* #return Response
* #throws \InvalidArgumentException
*/
public function agendaFeedAction(Request $request, Convention $convention): Response
{
There are no other annotations on controller.
I need to access page like 'localhost/22/agenda/feed.xml' without logging in, but now when I open that page I am redirected immediatelly yo login page.

Answer 1

Bceause this statement matches all routes:
{ path: ^/, roles: [ROLE_ADMIN, ROLE_ACCOUNT] } and for all routes you need ROLE_ADMIN or ROLE_ACCOUNT, you need to be more specific to avoid this. Something like ^/api that you have.