# Mbarara Environmental Reporting System - Apache Configuration
# File: .htaccess

# Enable rewrite engine
RewriteEngine On


# Allow direct access to image files and favicon
RewriteRule \.(ico|png|gif|jpg|jpeg|webmanifest|json|css|js|svg|woff|woff2|ttf|eot)$ - [L]
RewriteRule ^assets/images/ - [L]



# Allow favicon files to be served directly
RewriteRule ^favicon\.ico$ - [L]
RewriteRule ^assets/images/favicon/ - [L]
RewriteRule \.(ico|png|json|webmanifest)$ - [L]

RewriteRule ^api/ - [L,NC]

# Set the base directory for rewrites
RewriteBase /

# Security Headers
<IfModule mod_headers.c>
    # Prevent MIME type sniffing
    Header set X-Content-Type-Options "nosniff"
    
    # Enable XSS protection
    Header set X-XSS-Protection "1; mode=block"
    
    # Prevent clickjacking
    Header set X-Frame-Options "SAMEORIGIN"
    
    # Referrer policy
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    
# Content Security Policy (CSP) - Updated to allow all external CDN resources
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://code.jquery.com https://cdn.jsdelivr.net https://unpkg.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com https://unpkg.com; img-src 'self' data: https: blob:; connect-src 'self' https://api.github.com https://unpkg.com https://tile.openstreetmap.org https://stamen-tiles.a.ssl.fastly.net; frame-src https://www.google.com https://www.googletagmanager.com; frame-ancestors 'self';"
    
    # HSTS (HTTPS Strict Transport Security)
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# Prevent directory listing
Options -Indexes

# Protect sensitive files
<FilesMatch "\.(env|log|ini|htaccess|htpasswd|bak|config|sql|sh)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Protect sensitive directories (deny access except from localhost)
RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$
RewriteRule ^(cron|config|includes)/ - [F,L]

# Prevent PHP execution in uploads directory
RewriteRule ^uploads/.*\.(php|php5|php7|phtml|phps)$ - [F,L]

# URL Rewriting - Clean URLs
# Remove .php extension
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}\.php -f
RewriteRule ^(.*)$ $1.php [L]

# Custom error pages
ErrorDocument 400 /error.php?code=400
ErrorDocument 401 /error.php?code=401
ErrorDocument 403 /error.php?code=403
ErrorDocument 404 /error.php?code=404
ErrorDocument 500 /error.php?code=500

# Redirect www to non-www (or vice versa)
# Uncomment the appropriate lines below:

# Redirect www to non-www
# RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
# RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# Redirect non-www to www
# RewriteCond %{HTTP_HOST} !^www\. [NC]
# RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

# Force HTTPS (uncomment when SSL is configured)
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Performance optimizations
<IfModule mod_deflate.c>
    # Compress text, HTML, JavaScript, CSS, and XML
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
</IfModule>

# Browser caching
<IfModule mod_expires.c>
    ExpiresActive On
    
    # Images
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"
    
    # CSS and JavaScript
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    
    # Fonts
    ExpiresByType font/ttf "access plus 1 year"
    ExpiresByType font/otf "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType application/font-woff "access plus 1 year"
    
    # Others
    ExpiresByType text/html "access plus 1 hour"
    ExpiresByType application/pdf "access plus 1 month"
    ExpiresByType application/x-shockwave-flash "access plus 1 month"
</IfModule>

# Prevent hotlinking
<IfModule mod_rewrite.c>
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?localhost [NC]
    RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
    RewriteRule \.(jpg|jpeg|png|gif|mp4|pdf)$ - [NC,F,L]
</IfModule>

# Custom routing for API
RewriteRule ^api/([^/]+)/([^/]+)/?$ api/$1.php?action=$2 [QSA,L]
RewriteRule ^api/([^/]+)/?$ api/$1.php [QSA,L]

# Custom routing for pages
# Example: /reports/123 -> pages/public/report-detail.php?id=123
RewriteRule ^reports/([0-9]+)/?$ pages/public/report-detail.php?id=$1 [QSA,L]
RewriteRule ^user/reports/([0-9]+)/?$ pages/user/report-detail.php?id=$1 [QSA,L]
RewriteRule ^admin/reports/([0-9]+)/?$ pages/admin/report-management.php?id=$1 [QSA,L]

# Redirect old URLs (example)
# Redirect 301 /old-page.php /new-page.php

# Default character set
AddDefaultCharset UTF-8

# File upload limits
php_value upload_max_filesize 10M
php_value post_max_size 30M
php_value max_execution_time 300
php_value max_input_time 300

# Disable server signature
ServerSignature Off

# Custom 404 for missing files
<FilesMatch "\.(jpg|jpeg|png|gif|css|js)$">
    ErrorDocument 404 "/assets/images/404.jpg"
</FilesMatch>