# ============================================================
# Burgmann-Direct Enterprise Limited — .htaccess
# Apache 2.4+ / PHP 8+
# ============================================================

Options -Indexes
ServerSignature Off

# ── PHP settings ────────────────────────────────────────────
<IfModule mod_php.c>
  php_flag  display_errors  Off
  php_value upload_max_filesize 10M
  php_value post_max_size        12M
  php_value max_execution_time   60
</IfModule>

# ── Rewrite engine ──────────────────────────────────────────
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Force HTTPS (uncomment in production)
  # RewriteCond %{HTTPS} off
  # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Block access to sensitive files
  RewriteRule ^(config|includes|database)/ - [F,L]
  RewriteRule ^\.env$                        - [F,L]
  RewriteRule ^setup\.php$                   - [F,L]

  # Allow direct file/dir access
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Route to folder index.php
  RewriteRule ^([a-z0-9\-]+)/?$ $1/index.php [L]
  RewriteRule ^admin/([a-z0-9\-]+)/?$ admin/$1/index.php [L]
</IfModule>

# ── Security headers ─────────────────────────────────────────
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options  "nosniff"
  Header always set X-Frame-Options         "SAMEORIGIN"
  Header always set X-XSS-Protection        "1; mode=block"
  Header always set Referrer-Policy         "strict-origin-when-cross-origin"
</IfModule>

# ── Caching for static assets ────────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css              "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType image/jpeg            "access plus 6 months"
  ExpiresByType image/png             "access plus 6 months"
  ExpiresByType image/webp            "access plus 6 months"
  ExpiresByType application/pdf       "access plus 1 month"
</IfModule>

# ── Block uploads directory execution ───────────────────────
<Directory "assets/uploads">
  <FilesMatch "\.(php|php3|php4|php5|phtml|pl|py|cgi)$">
    Order Deny,Allow
    Deny from all
  </FilesMatch>
</Directory>
