# KopierSFlow ERP — .htaccess para cPanel/Apache
# Coloca este archivo en la misma carpeta que index.php

Options -Indexes
Options -ExecCGI

# ── Forzar HTTPS ─────────────────────────────────────────────
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ── Enviar todo por index.php ─────────────────────────────────
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?_url=/$1 [QSA,L]

# ── Bloquear acceso a archivos sensibles ─────────────────────
<FilesMatch "\.(sql|log|env|json|md|lock|ini)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Bloquear acceso a carpetas del sistema
<IfModule mod_rewrite.c>
    RewriteRule ^(core|modules|views|logs|uploads/docs)/.*$ - [F,L]
</IfModule>

# ── Headers de seguridad ─────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# ── PHP config via htaccess (cPanel) ─────────────────────────
<IfModule mod_php8.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_value session.cookie_httponly 1
    php_value session.cookie_secure 1
    php_value session.use_strict_mode 1
    php_value upload_max_filesize 20M
    php_value post_max_size 22M
    php_value max_execution_time 120
    php_value memory_limit 256M
</IfModule>

# ── Permitir acceso a assets ─────────────────────────────────
<FilesMatch "\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$">
    Order allow,deny
    Allow from all
</FilesMatch>
