# --- Sécurité : en-têtes globaux ---
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  # CSP en observation (ne bloque rien pour l’instant)
# --- CSP (global) : autorise Matomo + CDNs ---
Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https: https://staging.uslugi.fr/matomo/; script-src 'self' 'unsafe-inline' https://staging.uslugi.fr/matomo/ https://cdn.jsdelivr.net https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'"

</IfModule>

# Réduire surface d’attaque
Options -Indexes -MultiViews

# --- Réécriture & HTTPS ---
RewriteEngine On

# Forcer HTTPS (OK derrière proxy/Varnish)
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Laisser passer Let's Encrypt
RewriteRule ^\.well-known/acme-challenge/ - [L]

# --- Protection chemins & fichiers sensibles ---
# Bloquer VCS
RewriteRule ^(\.git|\.svn|\.hg)(/|$) - [F]
# Bloquer dotfiles (sauf .well-known)
RewriteRule ^\.(?!well-known/) - [F]
# Bloquer extensions sensibles
RewriteRule \.(env|ini|log|bak|old|sql|zip|tar|gz|7z)$ - [F]
# Bloquer fichiers sauvegardes *~
RewriteRule ^(.*/)?[^/]+~$ - [F]
# Bloquer certains noms explicites
<FilesMatch "^(config\.php|config\.sample\.php|composer\.json|composer\.lock|package\.json|yarn\.lock)$">
  Require all denied
</FilesMatch>
# Ceinture+bretelles : jamais de scripts dans /uploads
RewriteRule ^(?:public/)?uploads/.*\.(php|phtml|phar|phps|cgi|pl|py|sh|rb)$ - [F,NC]

# --- Routage applicatif ---
# 0) Servir les fichiers/dirs existants
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# 1) (optionnel) Normaliser la barre finale (sauf /)
RewriteCond %{REQUEST_URI} !^/$
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [R=301,L]

# 2) URL "propres" sans extension -> router.php
RewriteRule ^([^.]+)$ router.php?slug=$1 [L,QSA]

# 3) Fallback général
RewriteRule ^ index.php [L,QSA]

# --- PWA / Types & cache SW ---
AddType application/manifest+json .webmanifest

<Files "sw.js">
  Header set Cache-Control "no-cache, no-store, must-revalidate"
  Header set Pragma "no-cache"
  Header set Expires "0"
</Files>

# Activer des en-têtes différents uniquement pour /visio/join.php
SetEnvIf Request_URI "^/visio/join\.php$" IS_VISIO=1

<IfModule mod_headers.c>
  Header always unset Permissions-Policy env=IS_VISIO
  Header always unset Feature-Policy   env=IS_VISIO
  Header always set Permissions-Policy "camera=(self 'https://meet.uslugi.fr'), microphone=(self 'https://meet.uslugi.fr'), display-capture=(self 'https://meet.uslugi.fr'), fullscreen=(self 'https://meet.uslugi.fr')" env=IS_VISIO
  Header always set Feature-Policy "camera 'self' https://meet.uslugi.fr; microphone 'self' https://meet.uslugi.fr" env=IS_VISIO

  Header always set Content-Security-Policy "default-src 'self'; frame-src https://meet.uslugi.fr; script-src 'self' 'unsafe-inline' https://meet.uslugi.fr; connect-src 'self' https://meet.uslugi.fr wss://meet.uslugi.fr; img-src 'self' data: https://meet.uslugi.fr; style-src 'self' 'unsafe-inline' https://meet.uslugi.fr" env=IS_VISIO
</IfModule>

DirectoryIndex  index.php index.html