# ==========================================================================
# Root .htaccess -- Server Hardening, Compression, Caching, Security Headers
# ==========================================================================

# ---- Rewrite Engine ----
RewriteEngine On

# ---- Force HTTPS (uncomment on production with SSL) ----
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ---- GZIP Compression ----
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE text/plain
</IfModule>

# ---- Browser Caching ----
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 0 seconds"
    ExpiresByType application/javascript "access plus 0 seconds"
    ExpiresByType text/javascript "access plus 0 seconds"
    ExpiresByType image/jpeg "access plus 6 months"
    ExpiresByType image/png "access plus 6 months"
    ExpiresByType image/webp "access plus 6 months"
    ExpiresByType image/svg+xml "access plus 6 months"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# ---- Security Headers ----
<IfModule mod_headers.c>
    # Content Security Policy
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.tiktok.com https://www.instagram.com https://www.youtube.com; frame-src https://www.tiktok.com https://www.instagram.com https://www.youtube.com https://www.youtube-nocookie.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self';"

    # Prevent MIME type sniffing
    Header set X-Content-Type-Options "nosniff"

    # Clickjacking protection
    Header set X-Frame-Options "SAMEORIGIN"

    # Referrer policy
    Header set Referrer-Policy "strict-origin-when-cross-origin"

    # Disable sensitive browser APIs not used by this application
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"

    # HTTP Strict Transport Security (enable on SSL production deployments)
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Remove server signature
    Header unset X-Powered-By
    Header unset Server
</IfModule>

# ---- Server Signature ----
ServerSignature Off

# ---- Block Sensitive Files ----
<FilesMatch "\.(sql|log|lock|env|bak|ini|sh|md|yml|yaml|json|gitignore)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ---- Block dotfiles (except .htaccess) ----
<FilesMatch "^\.(?!htaccess)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ---- Disable Directory Listing ----
Options -Indexes

# ---- Block access to core and model PHP files directly ----
<FilesMatch "^(Database|Auth|CSRF|FileUpload|helpers)\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>

# ---- Custom Error Documents ----
ErrorDocument 404 /404.php
ErrorDocument 500 /500.php
