Path rules forgoing geoblock rules. Could we get nested rules?

[TheD3vilsAdvocate]

Summary

Hey all

I have the following issue with Pangolin: If I use Path rules to allow Nextcloud iOS app to run on IOS, the geoblocking will no longer apply since it's at the buttom of the SSO rules.

Basically, if I put it on top (position 1), it will block everything and the Path rules will never apply, the mobile app won't work. If I put it at the bottom, the rules will work but it will never pass on to the geoblock.

Paradoxically, I think SSO off + geoblock rules on would be safer then in smaller countries...

I understand the programming logic behind this, so this is basically a feature request: could we get nested SSO rules, some kind of if / else construct to fine tune our rules even more?

Motivation

It will increase security

Proposed Solution

Ad nested rules, some kind of if/else construct

Alternatives Considered

none

Additional Context

No response

[EarlSneedSinclair]

Yes, I think this describes the issue well.

The main problem seems to be that rules are currently too order-dependent. It would be useful if multiple rule conditions could complement each other instead of one matching rule preventing the others from being evaluated.

For example, it would be helpful to combine conditions such as path, country, ASN, client type, or authentication state, and then make a final decision based on all matching conditions: allow access, require login, bypass login, or block.

This would make setups more flexible and safer. For example, login could only be bypassed for specific paths and trusted countries or ASNs, while geoblocking would still apply instead of being skipped because another rule matched first.

[oschwartz10612]

I think this is a duplicate of https://github.com/orgs/fosrl/discussions/1832

We plan to add ands and ors and stuff eventually!