# mon-appli/.htaccess
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # ── Security: block direct access to PHP partials (underscore prefix) ──────
    RewriteRule ^admin/_.*$           - [F,L]
    RewriteRule ^modules/oracle/_.*$  - [F,L]

    # Block access to bootstrap.php directly
    RewriteRule ^bootstrap\.php$      - [F,L]

    # ── Static assets: serve directly ──────────────────────────────────────────
    RewriteCond %{REQUEST_URI} ^/assets/ [OR]
    RewriteCond %{REQUEST_URI} ^/favicon\.ico$
    RewriteRule ^ - [L]

    # ── Legacy URLs: redirect to new clean URLs (301 permanent) ────────────────
    RewriteRule ^login\.php$      /login    [R=301,L]
    RewriteRule ^logout\.php$     /logout   [R=301,L]
    RewriteRule ^profile\.php$    /profile  [R=301,L]
    RewriteRule ^about\.php$      /about    [R=301,L]

    # ── Front-controller Oracle: /oracle/* → oracle/index.php ────────────────
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^oracle/(.+)$ /oracle/index.php [L,QSA]

    # ── Routeur centralisé: tout passe par index.php ───────────────────────────
    # Sauf les fichiers existants (transition legacy) et les répertoires
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ /index.php [L,QSA]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options        "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy        "strict-origin-when-cross-origin"
    # X-XSS-Protection déprécié (peut introduire des failles) → désactivé.
    Header always set X-XSS-Protection       "0"

    # HSTS : ignoré par les navigateurs sur une réponse HTTP, actif en HTTPS.
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Content-Security-Policy — politique de départ (defense-in-depth). Autorise
    # l'inline actuel (à durcir plus tard avec des nonces) et les CDN utilisés.
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; img-src 'self' data:; font-src 'self' data: https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'"
</IfModule>

# Deny access to hidden files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
