# ==========================================================================
#  Public document root .htaccess — front-controller routing + hardening.
# ==========================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Serve existing files and directories directly (assets, uploads).
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Route everything else through the single front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# --- Security headers (baseline; CMS may override per-response) -----------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-XSS-Protection "0"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Remove server fingerprinting where possible.
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>

# --- Disable directory listing -------------------------------------------
Options -Indexes -MultiViews

# --- Block access to sensitive files -------------------------------------
<FilesMatch "(^\.|\.(env|ini|log|sh|sql|md|lock|json|dist|bak)$)">
    Require all denied
</FilesMatch>
<Files "index.php">
    Require all granted
</Files>

# --- Compression ----------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>

# --- Long-lived caching for static assets --------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>
