# ============================================
# USER MANAGER v4.0 - LAYER 1: MODSECURITY
# Servizio: PrestaShop/ThirtyBees
# Frontend: LIBERO | Backoffice: PROTETTO
# ============================================
# IMPORTANTE: Questo blocco va DENTRO <VirtualHost>
# PHP: 7.2 (usa set-cookies-template-php72.php)
# ============================================

<IfModule security2_module>
    SecRuleEngine On
    
    # ESCLUSIONE FRONTEND: Disabilita ModSec per tutto TRANNE /{BO_PATH}
    SecRule REQUEST_URI "!^/{BO_PATH}" "id:5000001,phase:1,pass,nolog,ctl:ruleEngine=Off"
    
    # Include whitelist globale (localhost, server IP, Docker)
    Include /etc/modsecurity/usermanager-global-whitelist.conf
    
    # Include whitelist servizio
    Include /etc/modsecurity/usermanager-whitelist-{SERVICE_NAME}.conf
    
    # Escludi file User Manager da ModSecurity
    SecRule REQUEST_URI "^/({BO_PATH}/)?(set-cookies\.php|403\.(html|php)|device-token-checker\.php)" "id:5000002,phase:1,pass,nolog,ctl:ruleEngine=Off"
    
    # Include deny-all (chi non passa whitelist → 403)
    Include /etc/modsecurity/usermanager-deny-all.conf
    
    # Esclusioni con LocationMatch
    <LocationMatch "^/({BO_PATH}/)?403\.(html|php)$">
        SecRuleEngine Off
    </LocationMatch>
    
    <LocationMatch "^/({BO_PATH}/)?set-cookies\.php$">
        SecRuleEngine Off
    </LocationMatch>
    
    <LocationMatch "^/({BO_PATH}/)?device-token-checker\.php$">
        SecRuleEngine Off
    </LocationMatch>
</IfModule>

# ErrorDocument per pagina blocco personalizzata
ErrorDocument 403 /{BO_PATH}/403.php

# ============================================
# LAYER 2: HTPASSWD per /{BO_PATH}
# ============================================
<Location /{BO_PATH}>
    AuthType Basic
    AuthName "Accesso Backoffice - Layer 2"
    AuthUserFile /etc/apache2/.htpasswd_{SERVICE_NAME}
    Require valid-user
</Location>

# Esclusioni htpasswd per file User Manager
<LocationMatch "^/{BO_PATH}/(set-cookies\.php|403\.php|device-token-checker\.php)$">
    Satisfy Any
    Require all granted
</LocationMatch>
