# ==============================================================================
# URO AGROVET - HARDENED .HTACCESS SECURITY CONFIGURATION
# Optimized for Next.js Static Export & cPanel Apache Serving
# ==============================================================================

# ------------------------------------------------------------------------------
# 1. SERVER OPTIONS & DIRECTORY INDEXING
# ------------------------------------------------------------------------------
# Disable directory listing and CGI execution
Options -Indexes -ExecCGI

# ------------------------------------------------------------------------------
# 2. STRICTLY DISABLE EXECUTION OF SERVER-SIDE SCRIPTS
# ------------------------------------------------------------------------------
# Deny direct HTTP access to script extensions (PHP, Perl, CGI, Python, Shell, ASP, Executablables)
<FilesMatch "\.(php|phtml|php[0-9]|py|sh|cgi|pl|asp|aspx|exe|rb)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Turn off PHP Engine if PHP is loaded via Apache module
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# ------------------------------------------------------------------------------
# 3. PROTECT HIDDEN FILES, DOTFILES & SENSITIVE CONFIGURATIONS
# ------------------------------------------------------------------------------
# Block access to hidden dotfiles (e.g., .env, .git, .htaccess)
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Block access to project configuration files, logs, and server scripts
<FilesMatch "^(error_log|package\.json|package-lock\.json|next\.config\..*|server\.js|\.env.*|README\.md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ------------------------------------------------------------------------------
# 4. ESSENTIAL SECURITY HEADERS
# ------------------------------------------------------------------------------
<IfModule mod_headers.c>
    # Prevent MIME-type sniffing
    Header set X-Content-Type-Options "nosniff"

    # Prevent clickjacking / framing attacks
    Header set X-Frame-Options "SAMEORIGIN"

    # Control Referrer Information
    Header set Referrer-Policy "strict-origin-when-cross-origin"

    # Enable Cross-Site Scripting (XSS) Filter in modern/legacy browsers
    Header set X-XSS-Protection "1; mode=block"

    # Restrict unneeded browser features
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # Content Security Policy (CSP) tailored for Next.js & Cloudinary assets
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https://res.cloudinary.com blob:; connect-src 'self' https://res.cloudinary.com; frame-ancestors 'self';"

    # Enforce HTTPS via HSTS (Strict-Transport-Security) for 1 year
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

# ------------------------------------------------------------------------------
# 5. NEXT.JS STATIC EXPORT & SPA CLIENT-SIDE ROUTING
# ------------------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Enforce HTTPS Redirection
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # Serve existing static files and directories directly
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Map static clean URL routes to generated HTML files (e.g. /contact -> /contact.html)
    RewriteCond %{DOCUMENT_ROOT}/$1.html -f
    RewriteRule ^(.*)$ $1.html [L]

    # SPA Fallback to root index.html for client-side routing
    RewriteCond %{DOCUMENT_ROOT}/index.html -f
    RewriteRule ^ index.html [L]
</IfModule>
