# ==============================================================================
# SISTEM PRESENSI DIGITAL - CPANEL CLIENT .HTACCESS (NATIVE PHP AUTH & LICENSE)
# ==============================================================================
RewriteEngine On

# Block direct access to data directory
RewriteRule ^license-php/data/ - [F,L]
RewriteRule ^data/ - [F,L]


# 1. Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 2. License, Tenant, & Auth API Routing to Native PHP Engine
RewriteRule ^api/(.*)$ license-php/router.php [QSA,L]

# 3. SPA Fallback
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/api/
RewriteCond %{REQUEST_URI} !^/license-php/
RewriteRule ^ index.html [L,QSA]

# 3. Security Headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# 4. Protect Sensitive Files
<FilesMatch "\.(key|pem|env|sql|log|sh|md)$">
    Order allow,deny
    Deny from all
</FilesMatch>

<Files "license_public.key">
    Order allow,deny
    Allow from all
</Files>

# 5. Service Worker Freshness
<Files "sw.js">
    <IfModule mod_headers.c>
        Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
    </IfModule>
</Files>

DirectoryIndex index.html
