# ============================================================
#  assetwave.pl — strona-wizytówka
#  (folder trzyma też /lw/ i /updates/ dla LabWarden na stacjach — NIE ruszać)
# ============================================================

RewriteEngine On
Options -Indexes -MultiViews
ServerSignature Off
DirectoryIndex index.php

# --- Wymuś HTTPS ---
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# --- www -> bez www ---
RewriteCond %{HTTP_HOST} ^www\.assetwave\.pl$ [NC]
RewriteRule ^ https://assetwave.pl%{REQUEST_URI} [R=301,L]

# ============================================================
#  Nagłówki bezpieczeństwa
# ============================================================
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" env=HTTPS

  # CSP — publiczna wizytówka: maksymalnie ostro (to tu wchodzi reklama)
  <If "%{REQUEST_URI} =~ m#^/panel/#">
    # panel zespołu: noindex + logowanie + CSRF; kod SPA używa inline onclick,
    # więc tylko tu dopuszczamy 'unsafe-inline' dla script-src
    Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data:; font-src data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; form-action 'self'"
  </If>
  <Else>
    Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data:; font-src https://fonts.gstatic.com data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self'; connect-src 'self'; form-action 'self'"
  </Else>

  # gdyby zostały pliki starej aplikacji — nie indeksuj
  <If "%{REQUEST_URI} =~ m#^/(PAGES|PHP|assets|STYLE_CSS)/#">
    Header set X-Robots-Tag "noindex, nofollow"
  </If>
</IfModule>

# ============================================================
#  Blokada wrażliwych plików
# ============================================================
<FilesMatch "(\.env|\.ini|\.log|\.sql|\.bak|\.old|\.swp|\.dist|\.lock|\.sh|\.bash|\.pem|\.key|composer\.(json|lock)|package(-lock)?\.json|bazadanych\.txt|\.md)$">
  Require all denied
</FilesMatch>
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
<Files "labwarden-serwer.zip">
  Require all denied
</Files>

# ============================================================
#  Cache statyków wizytówki
# ============================================================
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 7 days"
  ExpiresByType application/javascript "access plus 7 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/jpeg "access plus 30 days"
  ExpiresByType image/webp "access plus 30 days"
</IfModule>
