# TechShop Perú - Apache Configuration
# URL Amigables, Seguridad y Rendimiento

# --- Habilitar el motor de reescritura ---
RewriteEngine On

# --- Redirigir index.html a index.php ---
RewriteRule ^index\.html$ index.php [R=301,L]

# --- Prevenir listado de directorios ---
Options -Indexes

# --- Proteger archivos sensibles ---
<FilesMatch "\.(sql|md|log|htaccess|htpasswd|ini|phar|sh|bak|dist)$">
    Require all denied
</FilesMatch>

# --- Proteger archivos ocultos (dotfiles), excepto .well-known (Let's Encrypt/ACME) ---
<FilesMatch "^\.(?!well-known)">
    Require all denied
</FilesMatch>

# --- Configurar charset UTF-8 ---
AddDefaultCharset UTF-8
AddCharset UTF-8 .php .html .css .js .json .xml .svg

# --- Prevenir acceso directo a includes/ ---
RewriteRule ^includes/ - [F,L]

# --- Bloquear directorios internos y de desarrollo ---
RewriteRule ^(Sql|node_modules)/ - [F,L]

# --- Bloquear archivos de configuración del proyecto ---
<FilesMatch "^(composer\.(json|lock)|package(-lock)?\.json|vite\.config\.js|tsconfig\.json|tailwind\.config\.js)$">
    Require all denied
</FilesMatch>

# --- Caché del navegador ---
<IfModule mod_expires.c>
    ExpiresActive On

    # Imágenes - 1 mes
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 month"

    # CSS y JavaScript - 1 semana
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
    ExpiresByType text/javascript "access plus 1 week"

    # Fuentes - 1 mes
    ExpiresByType font/ttf "access plus 1 month"
    ExpiresByType font/otf "access plus 1 month"
    ExpiresByType font/woff "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 month"
    ExpiresByType application/font-woff "access plus 1 month"

    # HTML y PHP - sin caché
    ExpiresByType text/html "access plus 0 seconds"
    ExpiresDefault "access plus 1 day"
</IfModule>

# --- Compresión Gzip ---
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json
    AddOutputFilterByType DEFLATE application/xml application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE font/ttf font/otf
</IfModule>

# --- Headers de seguridad ---
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"

    # HSTS solo cuando la conexión ya es HTTPS (no rompe el sitio si aún no hay SSL)
    <If "%{HTTPS} != 'off'">
        Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    </If>

    # Cache-Control para assets con hash (inmutables)
    <FilesMatch "\.(css|js)$">
        Header set Cache-Control "public, max-age=604800"
    </FilesMatch>
    <FilesMatch "\.(jpg|jpeg|png|gif|svg|webp|ico)$">
        Header set Cache-Control "public, max-age=2592000"
    </FilesMatch>
</IfModule>

# --- Páginas de error personalizadas ---
ErrorDocument 400 index.php
ErrorDocument 401 index.php
ErrorDocument 403 index.php
ErrorDocument 404 index.php
ErrorDocument 500 index.php