# ============================================
# USER MANAGER v4.0 - LAYER 1: MODSECURITY
# Servizio: Nextcloud
# TUTTO PROTETTO (no frontend pubblico)
# ============================================
# IMPORTANTE: Questo blocco va DENTRO <VirtualHost>
# PHP: 8.1+ (usa set-cookies-template.php)
# ============================================

<IfModule security2_module>
    SecRuleEngine On
    
    # COLLABORA WOPI - Bypass per protocollo WOPI (se usi Collabora)
    SecRule REQUEST_URI "^/index\.php/apps/richdocuments/wopi/" "id:2300001,phase:1,allow,nolog,msg:'WOPI file access'"
    SecRule REQUEST_URI "^/browser/" "id:2300002,phase:1,allow,nolog,msg:'Collabora browser assets'"
    SecRule REQUEST_URI "^/cool/" "id:2300003,phase:1,allow,nolog,msg:'Collabora COOL'"
    SecRule REQUEST_URI "^/hosting/" "id:2300004,phase:1,allow,nolog,msg:'Collabora hosting'"
    
    # Include whitelist globale
    Include /etc/modsecurity/usermanager-global-whitelist.conf
    
    # Include whitelist servizio
    Include /etc/modsecurity/usermanager-whitelist-{SERVICE_NAME}.conf
    
    # Escludi file User Manager
    SecRule REQUEST_URI "^/(set-cookies\.php|403\.html)" "id:8000001,phase:1,pass,nolog,ctl:ruleEngine=Off"
    
    # Include deny-all
    Include /etc/modsecurity/usermanager-deny-all.conf
    
    <LocationMatch "^/403\.(html|php)$">
        SecRuleEngine Off
    </LocationMatch>
</IfModule>

# ErrorDocument
ErrorDocument 403 /403.php
