# =========================================================
# Enable Rewrite Engine
# =========================================================
RewriteEngine On

# =========================================================
# Force HTTPS
# =========================================================
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# =========================================================
# Disable Directory Listing
# =========================================================
Options -Indexes

# =========================================================
# SEO Friendly URL
# https://domain.com/p/abc123
# =========================================================
RewriteRule ^p/([A-Za-z0-9]+)/?$ view.php?id=$1 [L,QSA]

# Prevent direct access to view.php without ID
RewriteCond %{THE_REQUEST} \s/+view\.php(\s|\?)
RewriteCond %{QUERY_STRING} ^$
RewriteRule ^view\.php$ / [R=301,L]

# =========================================================
# Security Headers
# =========================================================
<IfModule mod_headers.c>

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

# HSTS (aktifkan hanya jika seluruh subdomain sudah HTTPS)
# Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

</IfModule>

# =========================================================
# Block Sensitive Files
# =========================================================

<FilesMatch "^(config\.php|database\.sql|sample_data\.sql|README\.md|QUICK_START\.md|check_database\.php|update_database\.php|\.todos\.md)$">
    Require all denied
</FilesMatch>

# Allow publish.php
<Files "publish.php">
    Require all granted
</Files>

# Protect SQL / Logs / Data
<FilesMatch "\.(sql|log|dat|bak|old|ini|md)$">
    Require all denied
</FilesMatch>

# =========================================================
# Disable Access to Hidden Files
# =========================================================
RewriteRule "(^|/)\." - [F,L]

# =========================================================
# Prevent PHP Execution in Upload Directories (optional)
# Uncomment if needed
# =========================================================
# RewriteRule ^uploads/.*\.php$ - [F,L]

# =========================================================
# Browser Cache
# =========================================================
<IfModule mod_expires.c>

ExpiresActive On

ExpiresByType text/css "access plus 1 year"
ExpiresByType application/javascript "access plus 1 year"
ExpiresByType text/javascript "access plus 1 year"

ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType image/webp "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType image/x-icon "access plus 1 year"

ExpiresByType font/woff "access plus 1 year"
ExpiresByType font/woff2 "access plus 1 year"

</IfModule>

# =========================================================
# Cache-Control
# =========================================================
<IfModule mod_headers.c>

<FilesMatch "\.(css|js|jpg|jpeg|png|gif|svg|ico|webp|woff|woff2)$">
Header set Cache-Control "public, max-age=31536000, immutable"
</FilesMatch>

</IfModule>

# =========================================================
# Gzip Compression
# =========================================================
<IfModule mod_deflate.c>

AddOutputFilterByType DEFLATE \
text/plain \
text/html \
text/css \
text/xml \
application/xml \
application/xhtml+xml \
application/rss+xml \
application/javascript \
text/javascript \
application/json \
application/x-javascript

</IfModule>