# ================================================================
# Projet : MageStock | Auteur : Régis KREMER
# Fichier : .htaccess | Version : 2.6.124 | Base : 2.6.123
# Lot : MAGESTOCK UPDATE CENTER INSTALLER PROXY RESPONSIVE RELEASE FINAL1
# Rôle : sécurité Apache, routage portable et redirection de compatibilité de l’ancienne page Magasins.
# ================================================================

# 🔁 Redirection vers HTTPS
RewriteEngine On
# Pas de RewriteBase : l’application fonctionne en /sm/, /ms/, /magestock/ ou à la racine d’un sous-domaine.

# Respecter la terminaison TLS des reverse proxies afin d’éviter une boucle HTTPS.
# Une requête est considérée sécurisée si Apache voit HTTPS directement OU si le proxy
# transmet explicitement le protocole public via les en-têtes usuels.
RewriteCond %{HTTPS} !=on
RewriteCond %{ENV:HTTPS} !on
RewriteCond %{HTTP:X-Forwarded-Proto} !^https(?:,|$) [NC]
RewriteCond %{HTTP:X-Forwarded-Ssl} !^on$ [NC]
RewriteCond %{HTTP:Forwarded} !(^|[;,][[:space:]]*)proto=https([;,]|$) [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

# 🔒 Blocage des principaux bots d'indexation
RewriteCond %{HTTP_USER_AGENT} (Googlebot|Bingbot|Slurp|DuckDuckBot|Baiduspider|YandexBot|Sogou|Exabot|facebot|ia_archiver) [NC]
RewriteRule ^.*$ - [F,L]

# ══════════════════════════════════════════════════════════════
# 🔗 URLs PROPRES - Routing
# ══════════════════════════════════════════════════════════════

# Bloquer AVANT l’exception des fichiers/dossiers existants.
# Sans cet ordre, un script PHP présent dans migrations/ ou includes/ pourrait être exécuté directement.
RewriteRule ^(?:data|includes|backups|migrations|logs|secrets)(?:/|$) - [F,L,NC]
RewriteRule (^|/)\.(?!well-known/) - [F,L]

# Ne pas réécrire les fichiers/dossiers existants
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Racine du dossier applicatif → dashboard
RewriteRule ^$ index.php?page=dashboard [L,QSA]

# URL propre login → login.php
RewriteRule ^login/?$ login.php [L,QSA]
RewriteRule ^password-recovery/?$ password-recovery.php [L,QSA]
RewriteRule ^install/?$ install.php [L,QSA]
RewriteRule ^update/?$ index.php?page=update [L,QSA]

# URL propre logout → logout.php
RewriteRule ^logout/?$ logout.php [L,QSA]

# Compatibilité temporaire : l'ancienne interface Magasins est remplacée par Gestion des magasins.
RewriteRule ^warehouses/?$ warehouse-manager [R=302,L,NE]

# Pages principales: dashboard, products, scanner, etc. dans le dossier courant
# NOTE: une seule substitution (sinon erreur Apache / routing instable)
RewriteRule ^(dashboard|products|movements|inventory|scanner|barcodes|reports|settings|users|alerts|suppliers|brands|orders|locations|lots|analytics|kits|reservations|plans-edit|plans|license|help|warehouse-manager|update)/?$ index.php?page=$1 [L,QSA]

# ══════════════════════════════════════════════════════════════
# 📄 MIME Types
# ══════════════════════════════════════════════════════════════
<IfModule mod_mime.c>
    AddType application/javascript .js
    AddType text/css .css
    AddType application/json .json
    AddType application/manifest+json .webmanifest
    AddType image/svg+xml .svg
    AddType image/x-icon .ico
</IfModule>

# ══════════════════════════════════════════════════════════════
# 🔐 Sécurité - Protection des fichiers sensibles
# ══════════════════════════════════════════════════════════════

# Bloquer accès aux dossiers sensibles

# Double syntaxe : Apache 2.4 (Require) ET 2.2 (Order/Deny) — sans conflit via IfModule.
# Corrige le risque d'exposition de data/*.json si mod_access_compat absent en 2.4.
<FilesMatch "^(data|backups|\.git|\.env|config\.php|INITIAL_PASSWORD\.txt|\.installation\.lock)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "^(ldap_sync\.php|backup_cron\.php|test_package\.sh)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</FilesMatch>

<Files "backup_*.json">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</Files>


<FilesMatch "^(release-signature\.txt|update-public-key\.php)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</FilesMatch>

<FilesMatch "\.(json|md|sh)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from all
    </IfModule>
</FilesMatch>

# ══════════════════════════════════════════════════════════════
# 🛡️ En-têtes de sécurité (défense en profondeur)
# ══════════════════════════════════════════════════════════════
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(self), geolocation=(), microphone=()"
</IfModule>

# ══════════════════════════════════════════════════════════════
# ⚡ Performance - Compression & Cache
# ══════════════════════════════════════════════════════════════
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css
    AddOutputFilterByType DEFLATE application/json application/javascript
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 month"
    ExpiresByType text/css "access plus 1 week"
    ExpiresByType application/javascript "access plus 1 week"
    ExpiresByType application/manifest+json "access plus 1 week"
</IfModule>
