# Bolana ERP — Apache rewrite (XAMPP / shared hosting)
<IfModule mod_rewrite.c>
    RewriteEngine On

    # XAMPP lokal (subfolder): RewriteBase /bolana/
    # Hosting public_html (root domain): ganti jadi → RewriteBase /
    RewriteBase /bolana/

    # Force HTTPS in production (uncomment on live hosting)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Block ONLY real files/dirs under sensitive folders
    # (do NOT block clean URLs like /app/dashboard — those go to index.php)
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^(app|storage|database|routes|views)(/|$) - [F,L]

    # Serve existing public files (assets, etc.) as-is
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Front controller
    RewriteRule ^ index.php [L,QSA]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set X-XSS-Protection "1; mode=block"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Uncomment on HTTPS production:
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# Deny access to hidden / config-ish files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Blok file sensitif — robots.txt harus tetap bisa diakses Google
<FilesMatch "\.(sql|md|log|env)$">
    Require all denied
</FilesMatch>

<FilesMatch "\.txt$">
    Require all denied
</FilesMatch>

<Files "robots.txt">
    Require all granted
</Files>

<Files "promt.txt">
    Require all denied
</Files>

Options -Indexes
