# Exclure le corps des requêtes/réponses de l'audit log pour garder des
# lignes de taille raisonnable.
SecAuditLogParts ABIFHZ

SecRule IP:BANNED "@eq 1" \
  "id:100000,phase:1,deny,status:403,log,\
   msg:'IP is banned'"

SecRule IP:REPUTATION_SCORE "@ge 100" \
  "id:100099,phase:1,deny,status:403,log,\
   msg:'Critical reputation score',\
   setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"

SecRule TX:SQL_INJECTION_SCORE "@ge 5" \
  "id:100001,phase:2,deny,status:403,log,\
   msg:'SQL Injection detected',\
   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"

SecRule TX:XSS_SCORE "@ge 5" \
  "id:100010,phase:2,deny,status:403,log,\
   msg:'XSS detected',\
   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"

SecRule TX:RCE_SCORE "@ge 5" \
  "id:100020,phase:2,deny,status:403,log,\
   msg:'RCE detected',\
   setvar:'ip.banned=1',expirevar:'ip.banned=259200'"

SecRule TX:LFI_SCORE "@ge 5" \
  "id:100030,phase:2,deny,status:403,log,\
   msg:'LFI detected',\
   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"

SecRule TX:INBOUND_ANOMALY_SCORE "@ge 20" \
  "id:100060,phase:2,deny,status:403,log,\
   msg:'Critical anomaly score',\
   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"

# Rate limit basique par IP (indépendant du RateLimit Go déjà en place sur
# /auth/login côté control-plane — celui-ci protège tout le reste).
SecAction \
  "id:400161,phase:1,nolog,pass,\
   setvar:'ip.request_window_1sec=+1',\
   expirevar:'ip.request_window_1sec=1'"

SecRule IP:REQUEST_WINDOW_1SEC "@gt 20" \
  "id:400160,phase:1,deny,status:429,log,\
   msg:'Too many requests'"