# =============================================================================
# PrintFlow — Root .htaccess
# =============================================================================

Options -Indexes

# =============================================================================
# PHP Settings (shared hosting with mod_php / php_admin)
# =============================================================================
<IfModule mod_php7.c>
    php_flag  display_errors  Off
    php_flag  log_errors      On
    php_value error_reporting 32767
</IfModule>
<IfModule mod_php8.c>
    php_flag  display_errors  Off
    php_flag  log_errors      On
    php_value error_reporting 32767
</IfModule>

# =============================================================================
# Block sensitive file extensions
# =============================================================================
<FilesMatch "\.(env|sql|log|sh|bak|orig|swp|lock)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# =============================================================================
# Single mod_rewrite block — all rewrite rules in one place
# =============================================================================
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Uncomment and set if app lives in a subdirectory e.g. /tms/
    # RewriteBase /tms/

    # ── Block sensitive directories ───────────────────────────────────────
    RewriteRule ^config/    - [F,L]
    RewriteRule ^database/  - [F,L]
    RewriteRule ^includes/  - [F,L]

    # Block all pages/ EXCEPT billing-statement.php (opened directly in browser)
    RewriteRule ^pages/transactions/billing-statement\.php$ - [L]
    RewriteRule ^pages/     - [F,L]

    # Block direct access to uploaded job files
    RewriteRule ^uploads/job-files/ - [F,L]

    # ── Pass real files and directories through unchanged ─────────────────
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # ── Clean URL routes ──────────────────────────────────────────────────
    RewriteRule ^login/?$   login.php  [L,QSA]
    RewriteRule ^logout/?$  logout.php [L,QSA]
    RewriteRule ^$          index.php  [L,QSA]
</IfModule>

# =============================================================================
# Security Headers
# =============================================================================
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options  "nosniff"
    Header always set X-Frame-Options         "DENY"
    Header always set Referrer-Policy         "strict-origin-when-cross-origin"
    Header always unset X-Powered-By

    Header always set Permissions-Policy \
        "camera=(), microphone=(), geolocation=(), payment=(), usb=()"

    Header always set Content-Security-Policy \
        "default-src 'self'; \
         script-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; \
         style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; \
         img-src 'self' data:; \
         font-src 'self' https://cdn.jsdelivr.net; \
         connect-src 'self'; \
         frame-ancestors 'none'; \
         base-uri 'self'; \
         form-action 'self';"
</IfModule>

# =============================================================================
# Browser Caching for static assets
# =============================================================================
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css               "access plus 30 days"
    ExpiresByType application/javascript "access plus 30 days"
    ExpiresByType image/jpeg             "access plus 30 days"
    ExpiresByType image/png              "access plus 30 days"
    ExpiresByType image/svg+xml          "access plus 30 days"
    ExpiresByType font/woff2             "access plus 1 year"
    ExpiresByType font/woff              "access plus 1 year"
    ExpiresByType application/json       "access plus 0 seconds"
    ExpiresByType text/html              "access plus 0 seconds"
</IfModule>

# =============================================================================
# Compression
# =============================================================================
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
    <IfModule mod_headers.c>
        Header append Vary Accept-Encoding
    </IfModule>
</IfModule>

# =============================================================================
# Custom Error Pages
# IMPORTANT: These absolute paths work when PrintFlow is installed at the
# web root (e.g. http://localhost/). If installed in a subfolder
# (e.g. http://localhost/tms/), change to relative paths:
#   ErrorDocument 403 errors/403.php
# OR comment these out entirely to use Apache's default error pages.
# =============================================================================
# ErrorDocument 403 /errors/403.php
# ErrorDocument 404 /errors/404.php
# ErrorDocument 500 /errors/500.php

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
