# ==============================================================
# Inveetaire — public/.htaccess
# ==============================================================
# This file sits in the public/ web root.
#
# Responsibilities:
#   1. Route all requests through the front controller (index.php).
#   2. Serve existing static files (CSS, JS, images, fonts) directly.
#   3. Block access to hidden files (dotfiles like .env, .htaccess itself).
#   4. Disable directory listing.
#   5. Set baseline HTTP security headers.
#
# All PHP application logic is routed through public/index.php.
# The Router (INIT-007) handles URL-to-controller resolution.
# ==============================================================

# Disable directory listing.
Options -Indexes -MultiViews

# ── FRONT CONTROLLER REWRITE ──────────────────────────────────
# Condition: The requested file does NOT already exist on disk.
# Condition: The requested path is NOT an existing directory.
# Action:    Route the request to index.php (the front controller).
#
# This allows direct serving of static assets:
#   public/assets/css/app.css   → served as-is
#   public/assets/js/app.js     → served as-is
#   public/assets/fonts/*.woff2 → served as-is
#
# Everything else goes to index.php:
#   /login        → index.php (Router resolves)
#   /app/couple/  → index.php (Router resolves)
#   /{slug}/invite/{code} → index.php (Router resolves)

<IfModule mod_rewrite.c>
    RewriteEngine On

    # If the app is installed in a subdirectory (e.g. /inveetaire/public/),
    # Apache sets SCRIPT_FILENAME correctly. No RewriteBase is needed for
    # relative rewrites. Uncomment RewriteBase only if URLs break:
    # RewriteBase /

    # Pass existing files directly (static assets).
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Route everything else to the front controller.
    RewriteRule ^ index.php [L]
</IfModule>

# ── SECURITY: Block access to hidden/dotfiles ─────────────────
# Prevents direct access to files like .htaccess, .env (if
# accidentally placed in public/), .git, etc.

<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# ── SECURITY: HTTP Response Headers ───────────────────────────
# Baseline security headers. Applied to all responses from public/.
# Content Security Policy (CSP) is configured per-page in views (INIT-008+).

<IfModule mod_headers.c>
    # Prevent MIME type sniffing attacks.
    Header always set X-Content-Type-Options "nosniff"

    # Prevent the page from being displayed in a frame (clickjacking).
    Header always set X-Frame-Options "SAMEORIGIN"

    # Enable browser XSS filter (legacy browsers).
    Header always set X-XSS-Protection "1; mode=block"

    # Prevent referrer leaking across origins.
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Baseline Content Security Policy (CSP)
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-src 'self' https://www.google.com https://*.google.com; frame-ancestors 'none';"
</IfModule>

# ── CHARSET: UTF-8 ────────────────────────────────────────────
# All application content is UTF-8 (DBP v1.0 Ch.3).
AddDefaultCharset UTF-8
