<?xml version="1.0" encoding="utf-16"?>
<xsd:schema attributeFormDefault="unqualified" elementFormDefault="qualified" version="1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <xsd:element name="policy" type="policyType" />
  <xsd:complexType name="policyType">
    <xsd:sequence>
      <xsd:element name="settings" type="settingsType" minOccurs="1" maxOccurs="1"/>
      <xsd:element name="authentication-rules" type="authentication-rulesType" maxOccurs="1" minOccurs="0"/>
      <xsd:element name="bean-shell-rules" type="bean-shell-rulesType" maxOccurs="1" minOccurs="0"/>
      <xsd:element name="authorization-rules" type="authorization-rulesType" maxOccurs="1" minOccurs="0"/>
      <xsd:element name="url-rules" type="url-rulesType" maxOccurs="1" minOccurs="0"/>
      <xsd:element name="header-rules" type="header-rulesType" maxOccurs="1" minOccurs="0"/>
      <xsd:element name="virtual-patches" type="virtual-patchesType" maxOccurs="1" minOccurs="0"/>
      <xsd:element name="outbound-rules" type="outbound-rulesType" maxOccurs="1" minOccurs="0"/>
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="outbound-rulesType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="add-header" type="add-headerType" />
      <xsd:element maxOccurs="unbounded" name="add-http-only-flag" type="add-http-only-flagType" />
      <xsd:element maxOccurs="unbounded" name="add-secure-flag" type="add-secure-flagType" />
      <xsd:element maxOccurs="unbounded" name="dynamic-insertion" type="dynamic-insertionType" />
      <xsd:element maxOccurs="unbounded" name="detect-content" type="detect-contentType" />
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="detect-contentType">
  	<xsd:attribute name="id" type="xsd:string" use="optional"/>
    <xsd:attribute name="content-type" type="xsd:string" />
    <xsd:attribute name="pattern" type="xsd:string" />
    <xsd:attribute name="path" type="xsd:string"/>
  </xsd:complexType>
  
  <xsd:complexType name="dynamic-insertionType">
  	<xsd:sequence>
    	<xsd:element name="replacement" type="replacementType" />
    </xsd:sequence>
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
    <xsd:attribute name="pattern" type="xsd:string" />
    <xsd:attribute name="path" type="xsd:string"/>
  </xsd:complexType>
  
  <xsd:complexType name="add-secure-flagType">
    <xsd:sequence>
      <xsd:element name="cookie" type="cookieType" />
    </xsd:sequence>
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
  
  <xsd:complexType name="cookieType">
    <xsd:attribute name="name" type="xsd:string" />
  </xsd:complexType>
  
  <xsd:complexType name="add-http-only-flagType">
    <xsd:sequence>
      <xsd:element name="cookie" type="cookieType" />
    </xsd:sequence>
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
  
  <xsd:complexType name="add-headerType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="path-exception" type="pathType" />
    </xsd:sequence>
    <xsd:attribute name="name" type="xsd:string" />
    <xsd:attribute name="value" type="xsd:string" />
    <xsd:attribute name="path" type="xsd:string" />
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
    
  <xsd:complexType name="virtual-patchesType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="virtual-patch" type="virtual-patchType" />
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="virtual-patchType">
    <xsd:attribute name="id" type="xsd:string" />
    <xsd:attribute name="path" type="xsd:string" />
    <xsd:attribute name="variable" type="xsd:string" />
    <xsd:attribute name="pattern" type="xsd:string" />
    <xsd:attribute name="message" type="xsd:string" />
  </xsd:complexType>
  
  <xsd:complexType name="header-rulesType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="restrict-content-type" type="restrict-content-typeType" />
      <xsd:element maxOccurs="unbounded" name="restrict-user-agent" type="restrict-user-agentType" />
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="restrict-user-agentType">
  	<xsd:attribute name="id" type="xsd:string" use="optional"/>
    <xsd:attribute name="deny" type="xsd:string" />
    <xsd:attribute name="allow" type="xsd:string" />
  </xsd:complexType>
  
  <xsd:complexType name="restrict-content-typeType">
  	<xsd:attribute name="id" type="xsd:string" use="optional"/>
    <xsd:attribute name="deny" type="xsd:string" />
    <xsd:attribute name="allow" type="xsd:string" />
  </xsd:complexType>
  
  <xsd:complexType name="url-rulesType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="restrict-extension" type="restrict-extensionType" />
      <xsd:element maxOccurs="unbounded" name="restrict-method" type="restrict-methodType" />
      <xsd:element maxOccurs="unbounded" name="enforce-https" type="enforce-httpsType" />
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="enforce-httpsType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="path-exception" type="pathType" />
    </xsd:sequence>
    <xsd:attribute name="path" type="xsd:string" />
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
  
  <xsd:complexType name="restrict-methodType">
    <xsd:attribute name="deny" type="xsd:string" />
    <xsd:attribute name="path" type="xsd:string" />
    <xsd:attribute name="allow" type="xsd:string" />
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
  
  <xsd:complexType name="restrict-extensionType">
    <xsd:attribute name="deny" type="xsd:string" />
    <xsd:attribute name="allow" type="xsd:string" />
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
  
  <xsd:complexType name="authorization-rulesType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="restrict-source-ip" type="restrict-source-ipType" />
      <xsd:element maxOccurs="unbounded" name="must-match" type="must-matchType" />
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="must-matchType">
    <xsd:attribute name="path" type="xsd:string" />
    <xsd:attribute name="variable" type="xsd:string" />
    <xsd:attribute name="operator" type="xsd:string" />
    <xsd:attribute name="value" type="xsd:string" />
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
  </xsd:complexType>
  
  <xsd:complexType name="restrict-source-ipType">
  	<xsd:simpleContent>
  		<xsd:extension base="xsd:string">
	    	<xsd:attribute name="type" type="xsd:string" />
    		<xsd:attribute name="ip-regex" type="xsd:string" />
    		<xsd:attribute name="id" type="xsd:string" use="optional"/>
    	</xsd:extension>
    </xsd:simpleContent>
  </xsd:complexType>
  
  <xsd:complexType name="bean-shell-rulesType">
    <xsd:sequence>
      <xsd:element  maxOccurs="unbounded" name="bean-shell-script" type="bean-shell-scriptType" />
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="bean-shell-scriptType">
    <xsd:attribute name="id" type="xsd:string" use="required"/>
    <xsd:attribute name="file" type="xsd:string" />
    <xsd:attribute name="stage" type="xsd:string" />
    <xsd:attribute name="path" type="xsd:string" />
  </xsd:complexType>
  
  <xsd:complexType name="authentication-rulesType">
    <xsd:sequence>
      <xsd:element maxOccurs="unbounded" name="path-exception" type="pathType" />
    </xsd:sequence>
    <xsd:attribute name="id" type="xsd:string" use="optional"/>
    <xsd:attribute name="path" type="xsd:string" />
    <xsd:attribute name="key" type="xsd:string" />
  </xsd:complexType>
  
  <xsd:complexType name="settingsType">
    <xsd:sequence>
      <xsd:element name="mode" type="modeType" minOccurs="1" maxOccurs="1" />
      <xsd:element name="session-cookie-name" type="sessionCookieNameType" minOccurs="0" maxOccurs="1" />
      <xsd:element name="error-handling" type="error-handlingType" minOccurs="1" maxOccurs="1"/>
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="error-handlingType">
    <xsd:sequence>
      <xsd:element name="default-redirect-page" type="redirectType" minOccurs="1" maxOccurs="1"/>
      <xsd:element name="block-status" type="blockType" minOccurs="1" maxOccurs="1"/>
    </xsd:sequence>
  </xsd:complexType>
  
  <xsd:complexType name="pathType">
  	<xsd:simpleContent>
  		<xsd:extension base="xsd:string">
  			<xsd:attribute name="type" type="xsd:string"/>
  		</xsd:extension>
  	</xsd:simpleContent>
  </xsd:complexType>
  
  <xsd:complexType name="replacementType">
  	<xsd:simpleContent>
  		<xsd:extension base="xsd:string"/>
  	</xsd:simpleContent>
  </xsd:complexType>
  
  <xsd:complexType name="blockType">
  	<xsd:simpleContent>
  		<xsd:extension base="xsd:int"/>
  	</xsd:simpleContent>
  </xsd:complexType>
   
  <xsd:simpleType name="modeType">
 	<xsd:restriction base="xsd:string">
      <xsd:enumeration value="block"/>
      <xsd:enumeration value="redirect"/>
      <xsd:enumeration value="log"/>
    </xsd:restriction>
  </xsd:simpleType>
  
  <xsd:complexType name="sessionCookieNameType">
  	<xsd:simpleContent>
  		<xsd:extension base="xsd:string"/>
  	</xsd:simpleContent>
  </xsd:complexType>
  
  <xsd:complexType name="redirectType">
  	<xsd:simpleContent>
  		<xsd:extension base="xsd:string"/>
  	</xsd:simpleContent>
  </xsd:complexType>
  
</xsd:schema>
