# Prompt Studio - Main .htaccess
# Security, Performance, Caching & Compression

# === Directory Index ===
DirectoryIndex index.php index.html

# =====================================================
#  REWRITE RULES & URL ROUTING
# =====================================================
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    RewriteRule ^(ar|en)/([^/]+)/?$ index.php?lang=$1&page=$2 [QSA,L]
    RewriteRule ^(ar|en)/?$ index.php?lang=$1&page=home [QSA,L]
    RewriteRule ^/?$ index.php?page=home [QSA,L]
    RewriteRule ^sitemap\.xml$ sitemap-xml.php [L]

    # Block access to sensitive directories
    RewriteRule ^data/ - [F,L]
    RewriteRule ^storage/ - [F,L]
    RewriteRule ^templates/ - [F,L]
    RewriteRule ^lang/ - [F,L]
</IfModule>

# =====================================================
#  SECURITY HEADERS
# =====================================================
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header set X-Permitted-Cross-Domain-Policies "none"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
    Header set Content-Security-Policy "default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https:; img-src 'self' data: https:; connect-src 'self' https:"
    # Remove server signature
    Header unset Server
    Header unset X-Powered-By
</IfModule>

# Hide server version
ServerSignature Off

# =====================================================
#  COMPRESSION (Gzip + Brotli)
# =====================================================
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/atom+xml
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE image/x-icon
    AddOutputFilterByType DEFLATE font/opentype
    AddOutputFilterByType DEFLATE font/ttf
    AddOutputFilterByType DEFLATE application/font-woff
    AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
</IfModule>

# Brotli compression (if available)
<IfModule mod_brotli.c>
    AddOutputFilterByType BROTLI_COMPRESS text/html
    AddOutputFilterByType BROTLI_COMPRESS text/plain
    AddOutputFilterByType BROTLI_COMPRESS text/css
    AddOutputFilterByType BROTLI_COMPRESS text/xml
    AddOutputFilterByType BROTLI_COMPRESS text/javascript
    AddOutputFilterByType BROTLI_COMPRESS application/javascript
    AddOutputFilterByType BROTLI_COMPRESS application/json
    AddOutputFilterByType BROTLI_COMPRESS application/xml
    AddOutputFilterByType BROTLI_COMPRESS image/svg+xml
</IfModule>

# =====================================================
#  BROWSER CACHING
# =====================================================
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault                          "access plus 1 month"
    # HTML
    ExpiresByType text/html                 "access plus 0 seconds"
    ExpiresByType application/xhtml+xml     "access plus 0 seconds"
    # CSS & JS
    ExpiresByType text/css                  "access plus 1 year"
    ExpiresByType application/javascript    "access plus 1 year"
    ExpiresByType text/javascript           "access plus 1 year"
    # Images
    ExpiresByType image/png                 "access plus 1 year"
    ExpiresByType image/jpeg                "access plus 1 year"
    ExpiresByType image/jpg                 "access plus 1 year"
    ExpiresByType image/gif                 "access plus 1 year"
    ExpiresByType image/webp                "access plus 1 year"
    ExpiresByType image/svg+xml             "access plus 1 year"
    ExpiresByType image/x-icon              "access plus 1 year"
    # Fonts
    ExpiresByType font/woff                 "access plus 1 year"
    ExpiresByType font/woff2                "access plus 1 year"
    ExpiresByType application/font-woff     "access plus 1 year"
    ExpiresByType application/vnd.ms-fontobject "access plus 1 year"
    ExpiresByType font/ttf                  "access plus 1 year"
    ExpiresByType font/opentype             "access plus 1 year"
    # Documents
    ExpiresByType application/pdf           "access plus 1 month"
    ExpiresByType application/xml           "access plus 0 seconds"
</IfModule>

# =====================================================
#  CACHE-CONTROL HEADERS
# =====================================================
<IfModule mod_headers.c>
    <FilesMatch "\.(css|js|woff|woff2|ttf|otf|eot|svg|png|jpe?g|gif|webp|ico)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    <FilesMatch "\.(html|htm|php|xml|json)$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>
</IfModule>

# =====================================================
#  BLOCK ACCESS TO SENSITIVE FILES
# =====================================================
# Hide all dotfiles (.htaccess, .env, .git, .svn, etc.)
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block JSON data files
<FilesMatch "\.(json)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block backup & temp files
<FilesMatch "\.(bak|obf\.bak|swp|swo|tmp|old|orig|save)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block config files
<FilesMatch "\.(ini|conf|log|sh|sql|db|sqlite)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block PHP error log
<FilesMatch "error_log$">
    Order allow,deny
    Deny from all
</FilesMatch>

# =====================================================
#  BLOCK COMMON ATTACKS
# =====================================================
<IfModule mod_rewrite.c>
    # Block SQL injection attempts
    RewriteCond %{QUERY_STRING} \.\/ [NC,OR]
    RewriteCond %{QUERY_STRING} (\%0A)|(\%0D)|(\%08)|(\%09) [NC]
    RewriteRule .* - [F,L]

    # Block script injection in URL
    RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*object.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*embed.*(>|%3E) [NC]
    RewriteRule .* - [F,L]

    # Block file inclusion attempts
    RewriteCond %{QUERY_STRING} (ftp|https?|zip|gz|rar|tar|bzip|compress|zlib): [NC,OR]
    RewriteCond %{QUERY_STRING} (proc|environ|encode|phpdata|phpfilter|phpinfo|read|write|exec|system|passthru|eval|shell_exec|popen|proc_open|pcntl) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# =====================================================
#  HOTLINK PROTECTION
# =====================================================
# Disabled - use PHP-based protection if needed

# =====================================================
#  CHARACTER ENCODING
# =====================================================
AddDefaultCharset UTF-8
AddCharset UTF-8 .html .htm .php .css .js .json .xml .txt
