<?xml version="1.0" encoding="UTF-8"?>
<!--
  IIS config for the Nibula backend folder.

  The front controller is the only reachable file: every other path is rewritten
  onto it and answered as an API request, so endpoint sources, config.php,
  migrations and vendor files are never served.

  httpErrors is set to PassThrough here, unlike the site root. Everything under
  this folder is the API, and the front controller already answers errors with
  its own JSON envelope (401 for a missing X-Api-Key, 404 for an unknown
  endpoint, 500 for an unhandled exception). Without PassThrough, IIS replaces
  those bodies with its own HTML and every API error reaches the client in the
  wrong format.
-->
<configuration>
    <system.webServer>
        <rewrite>
            <rules>

                <rule name="PassThroughCoreIndex" stopProcessing="true">
                    <match url="^core/index\.php$" ignoreCase="true" />
                    <action type="None" />
                </rule>

                <rule name="RewriteToFrontController" stopProcessing="true">
                    <match url="^(.*)$" ignoreCase="true" />
                    <action type="Rewrite" url="core/index.php" appendQueryString="true" />
                </rule>

            </rules>
        </rewrite>

        <directoryBrowse enabled="false" />

        <httpErrors errorMode="Custom" existingResponse="PassThrough" />

        <httpProtocol>
            <customHeaders>
                <remove name="WWW-Authenticate" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>