# ==========================================================================
# Biznesnetwork — Apache configuration for cPanel shared hosting
# ==========================================================================

# --- Disable directory listing -------------------------------------------
Options -Indexes +FollowSymLinks

# --- Default charset ------------------------------------------------------
AddDefaultCharset UTF-8

# --- Front controller routing --------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # If you deploy in a subfolder, set the base accordingly (e.g. /biznesnetwork/)
    # RewriteBase /

    # Block direct access to sensitive directories.
    RewriteRule ^(app|core|config|storage|cache|data|includes)(/|$) - [F,L]

    # Allow real files and directories in assets to be served directly.
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Everything else goes through the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# --- Security headers -----------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Cross-Origin-Opener-Policy "same-origin"
    # Remove revealing server signature where possible.
    Header unset X-Powered-By
</IfModule>

# --- Correct MIME types (some hosts don't serve SVG/webp/fonts correctly) --
# Without this, SVG logos/flags can fail to render as <img> on cPanel/Apache.
<IfModule mod_mime.c>
    AddType image/svg+xml             .svg .svgz
    AddType image/webp                .webp
    AddType image/x-icon              .ico
    AddType image/png                 .png
    AddType image/jpeg                .jpg .jpeg
    AddType font/woff2                .woff2
    AddType application/javascript    .js
    AddType text/css                  .css
</IfModule>

# --- Compression ----------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css \
        application/javascript application/json application/xml \
        image/svg+xml application/rss+xml
</IfModule>

# --- Browser caching for static assets ------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    ExpiresByType image/png "access plus 30 days"
    ExpiresByType image/jpeg "access plus 30 days"
    ExpiresByType image/svg+xml "access plus 30 days"
    ExpiresByType image/webp "access plus 30 days"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType application/json "access plus 0 seconds"
</IfModule>

# --- Protect hidden & sensitive files -------------------------------------
<FilesMatch "(^\.|\.(ini|log|sh|sql|md|lock|json|dist)$|composer\.(json|lock))">
    Require all denied
</FilesMatch>

# Allow the manifest / well-known files explicitly if needed.
<Files "robots.txt">
    Require all granted
</Files>
<Files "sitemap.xml">
    Require all granted
</Files>

# --- Custom error documents (handled by the app, fallback static) ---------
ErrorDocument 404 /index.php
ErrorDocument 500 /index.php

# --- PHP runtime hardening (ignored if not supported) ---------------------
<IfModule mod_php.c>
    php_flag display_errors Off
    php_value max_execution_time 60
</IfModule>
