# MSPE Public Folder .htaccess

RewriteEngine On
RewriteBase /

# Disable directory listing
Options -Indexes

# Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Handle SPA-style routing if needed - redirect 404s to index
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/api/
RewriteCond %{REQUEST_URI} !^/admin/
RewriteRule ^.*$ 404.html [L]

# Block dev/test/seed scripts in production
<FilesMatch "^(db_seed|db_test|email-test)\.php$">
	<IfModule mod_authz_core.c>
		Require all denied
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order deny,allow
		Deny from all
	</IfModule>
</FilesMatch>

# Protect .env files
<FilesMatch "^\.env">
	<IfModule mod_authz_core.c>
		Require all denied
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order deny,allow
		Deny from all
	</IfModule>
</FilesMatch>

# Prevent access to hidden files
<FilesMatch "^\.">
	Order allow,deny
	Deny from all
</FilesMatch>

# Prevent access to JSON data files from web
<FilesMatch "\.(json)$">
	<IfModule mod_authz_core.c>
		Require all denied
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order deny,allow
		Deny from all
	</IfModule>
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
	Header set X-Content-Type-Options "nosniff"
	Header set X-Frame-Options "SAMEORIGIN"
	Header set X-XSS-Protection "0"
	Header set Referrer-Policy "strict-origin-when-cross-origin"
	Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
	Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
	Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com https://www.google.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
</IfModule>

# Enable compression
<IfModule mod_deflate.c>
	AddOutputFilterByType DEFLATE text/html text/plain text/css application/json application/javascript text/xml
</IfModule>

# Browser caching
<IfModule mod_expires.c>
	ExpiresActive On
	ExpiresByType image/jpg "access plus 1 month"
	ExpiresByType image/jpeg "access plus 1 month"
	ExpiresByType image/png "access plus 1 month"
	ExpiresByType image/gif "access plus 1 month"
	ExpiresByType image/webp "access plus 1 month"
	ExpiresByType text/css "access plus 1 week"
	ExpiresByType application/javascript "access plus 1 week"
</IfModule>
