# Luckus .htaccess
# Hide files, set UTF-8, push HTTPS, no directory listing.

Options -Indexes -MultiViews
DefaultLanguage en-US
AddDefaultCharset UTF-8

# Block direct access to includes/ outside the document root
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS (uncomment in production once cert is in place)
    # RewriteCond %{HTTPS} off
    # RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L]

    # Pretty product URLs: /product/<slug> → /product.php?slug=<slug>
    RewriteRule ^product/([a-z0-9\-]+)/?$ product.php?slug=$1 [L,QSA]

    # Pretty news URLs: /news/<slug> → /news-detail.php?slug=<slug>
    RewriteRule ^news/([a-z0-9\-]+)/?$ news-detail.php?slug=$1 [L,QSA]

    # Pretty page URLs (e.g. /about, /inquiry/thanks)
    RewriteRule ^inquiry/thanks/?$ inquiry.php?thanks=1 [L,QSA]

    # Pretty admin URLs (optional)
    RewriteRule ^admin/?$ admin/index.php [L]
    RewriteRule ^admin/login/?$ admin/login.php [L]
    RewriteRule ^admin/logout/?$ admin/logout.php [L]

    # Block dotfiles / SQL / config
    RewriteRule ^\.(?!well-known) - [F,L]
    RewriteRule \.(sql|md|log|env|sample\.php)$ - [F,L]

    # Block direct access to sensitive folders if served at root
    RewriteRule ^(config\.php|includes/|sql/|install\.php) - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # CSP — adjust if you add external scripts
    Header set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' https://wa.me; frame-src https://wa.me; connect-src 'self'"
</IfModule>

# Caching for static assets
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/png "access plus 30 days"
    ExpiresByType image/jpeg "access plus 30 days"
    ExpiresByType image/webp "access plus 30 days"
    ExpiresByType image/svg+xml "access plus 30 days"
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
</IfModule>

# Compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json
</IfModule>
