.htaccess condition with environment variables not evaluating

Base setup is as follows:
If the domain is ending in .staging.com it is the staging environment

• foobar.com.staging.com --> staging environment
• foobar.com --> live environment

I have the following .htaccess code:

• All the necessary Apache modules are enabled as far I can tell.
• The environment variables (line 1-5) are being set properly (at least if I check them within a PHP script via getenv()).
• The basic auth on itself is working as desired
• If I remove the <If> conditions around the Allow/Require blocks those also work as expected
• If I leave the <If> conditions just as they are written below the Allow/Require are simply not being evaluated.

Any idea what I'm doing wrong?

SetEnvIfNoCase Host ^([a-zA-Z-.]*)\.staging\.com$ staging_env=true
SetEnvIfNoCase Host ^([a-zA-Z-.]*)(?<!\.staging\.com)$ live_env=true
SetEnvIfNoCase Request_URI "^/export" export_folder=true
SetEnvIf Remote_Addr ^1\.2\.3\.4$ authorized_ip=true
SetEnvIf Remote_Addr "^2\.3\.4\.[0-9]+$" authorized_ip=true

AuthUserFile /home/foobar/public_html/.htpasswd
AuthName "Password Protected"
AuthType Basic

Order Deny,Allow
Satisfy any
Deny from all

<If "%{ENV:export_folder} == 'true'">
    Allow from env=authorized_ip
</If>
<If "%{ENV:export_folder} != 'true' && %{ENV:live_env} == 'true'">
    Allow from env=live_env
</If>
<If "%{ENV:staging_env} == 'true'">
    Require valid-user
    Allow from env=authorized_ip
</If>

Thanks to @covener i managed to get it working. My final solution was something like this:

SetEnvIfNoCase Host ^([a-zA-Z-.]*)\.staging\.com$ environment=staging
SetEnvIfNoCase Host ^([a-zA-Z-.]*)(?<!\.staging\.com)$ environment=production
SetEnvIfNoCase Request_URI "^/export" export_folder=true
SetEnvIf Remote_Addr ^1\.2\.3\.4$ authorized_ip=true
SetEnvIf Remote_Addr "^2\.3\.4\.[0-9]+$" authorized_ip=true

AuthUserFile /home/foobar/public_html/.htpasswd
AuthName "Password Protected"
AuthType Basic

<RequireAny>
    <RequireAll>
        Require expr %{ENV:export_folder} == 'true'
        Require expr %{ENV:authorized_ip} == 'true'
    </RequireAll>
    <RequireAll>
        Require expr %{ENV:export_folder} != 'true'
        Require expr %{ENV:environment} == 'production'
    </RequireAll>
    <RequireAll>
        Require expr %{ENV:environment} == 'staging'
        <RequireAny>
            Require expr %{ENV:authorized_ip} == 'true'
            Require expr %{REMOTE_USER} != ''
        </RequireAny>
    </RequireAll>
</RequireAny>

I think the issue here is that the <if> section is a new config section, so any use of mod_authz_compat replaces, rather than merges, with the directives from this module in the rest of the htaccess, including the satisfy.

I'd personally purge all mod_access_compat directives and use require with expressions where needed, without <if> sections. <if> has all kinds of surprising effects whereas expressions as arguments to directives are much more intuitive.

But duplicating the satisfy may be enough.