# move-detect cloud — belongs in the DocumentRoot (Cafe24: /home/hosting_users/<ID>/www/).
# Built into the upload package as www/.htaccess by build_cafe24_package.sh.
#
# mod_rewrite is confirmed on Cafe24 web hosting. mod_headers and mod_authz_core are not,
# so every dependent block is wrapped in <IfModule> and degrades instead of 500-ing.

<IfModule mod_rewrite.c>
  RewriteEngine On

  # 1) Force HTTPS. This is REQUIRED, not hardening: src/Auth/Session.php hard-codes
  #    'cookie_secure' => true, so over plain HTTP the browser never sends the session
  #    cookie back — login appears to succeed, then silently loses the session on the very
  #    next request. All three conditions must hold before redirecting, so a TLS-terminating
  #    proxy that sets any one of them cannot trigger a redirect loop.
  #    R=302 on purpose. Promote to R=301 only after verifying in a real browser: a wrong
  #    301 is cached by clients and is very hard to walk back.
  RewriteCond %{HTTPS} !=on
  RewriteCond %{SERVER_PORT} !^443$
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]

  # 2) Front controller — every non-file, non-directory path goes to index.php.
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ index.php [QSA,L]
</IfModule>

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "no-referrer"
</IfModule>

# 3) No directory listings. Backstop against an unauthenticated listing of
#    storage/snapshots/ (JPEGs of people at work) if it is ever misplaced under the docroot.
Options -Indexes

# 4) Deny dotfiles (.git, .env, .htaccess, .user.ini, .phpunit.result.cache, ...).
<FilesMatch "^\.">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# 5) Deny anything Apache would serve as PLAINTEXT for lack of a handler. schema.sql is the
#    sharp one: it is full DDL, and unlike a .php file PHP would not swallow it.
<FilesMatch "\.(sql|md|json|lock|dist|ini|log|sh|ya?ml|cache)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# NOTE: there are deliberately no deny rules for src/ vendor/ storage/ config.php here.
# Those live OUTSIDE the DocumentRoot (siblings of www/), where no .htaccess under www/
# could reach them and none is needed. Placement is the control; keep them out of www/.