# Stock Management System - Apache Security Configuration
# Place this file in your application root directory

# Disable directory listing
Options -Indexes

# Enable mod_rewrite for clean URLs (if needed in future)
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Redirect HTTP to HTTPS (uncomment if using SSL)
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Enable compression for faster loading
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/xml
</IfModule>

# Set character encoding
AddDefaultCharset utf-8

# Block access to sensitive files
<FilesMatch "^(config\.php|\.htaccess|database\.sql|INSTALLATION_GUIDE\.md|README\.md|IMPLEMENTATION_SUMMARY\.md)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block access to hidden files and directories
<FilesMatch "^\.|^#.*#|~$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# Set proper cache headers for static files
<IfModule mod_expires.c>
    ExpiresActive On
    
    # Images
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    
    # CSS and JavaScript
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    
    # Fonts
    ExpiresByType application/x-font-ttf "access plus 1 year"
    ExpiresByType font/ttf "access plus 1 year"
    ExpiresByType application/x-font-woff "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    
    # Default
    ExpiresDefault "access plus 2 days"
</IfModule>

# Prevent access to PHP files in uploads directory
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php5.c>
    php_flag engine off
</IfModule>
<IfModule mod_php7.c>
    php_flag engine off
</IfModule>

# Block common malicious requests
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # Block SQL injection attempts
    RewriteCond %{QUERY_STRING} (\"|'|%22|%27)+.*(\bselect\b|\bunion\b|\bwhere\b|\binsert\b|\bupdate\b|\bdelete\b) [NC,OR]
    RewriteCond %{QUERY_STRING} (\bor\b|\band\b|%20or%20|%20and%20)+.*(\b1\b|%271%27) [NC]
    RewriteRule ^.*$ - [F]
    
    # Block XSS attempts
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
    RewriteCond %{QUERY_STRING} javascript: [NC]
    RewriteCond %{QUERY_STRING} base64_ [NC]
    RewriteRule ^.*$ - [F]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    # Prevent MIME type sniffing
    Header always set X-Content-Type-Options "nosniff"
    
    # Enable XSS protection in older browsers
    Header always set X-XSS-Protection "1; mode=block"
    
    # Clickjacking protection
    Header always set X-Frame-Options "SAMEORIGIN"
    
    # Control referrer information
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Protect against access to .env files
<Files .env>
    Order allow,deny
    Deny from all
</Files>

# Allow access only to necessary files
<FilesMatch "\.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Allow from all
    </IfModule>
</FilesMatch>

# Ensure .php files are executed, not downloaded
<FilesMatch "\.php$">
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</FilesMatch>

# Disable PHP execution in upload directories
<Directory "*/uploads">
    <IfModule mod_php.c>
        php_flag engine off
    </IfModule>
    <FilesMatch "\.(jpg|jpeg|png|gif|pdf|txt)$">
        Allow from all
    </FilesMatch>
    <FilesMatch "\.(php|php3|php4|php5|php7|phtml|pht|phps)$">
        Deny from all
    </FilesMatch>
</Directory>

# Disable file uploads in reports directory
<Directory "*/reports">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <FilesMatch "\.(csv|txt)$">
        Require all granted
    </FilesMatch>
</Directory>
