# ============================================================
#  krakow.assetwave.pl — APLIKACJA (login + system)
# ============================================================

RewriteEngine On
Options -Indexes -MultiViews
ServerSignature Off
DirectoryIndex index.php

# --- Wymuś HTTPS ---
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# ============================================================
#  Nagłówki bezpieczeństwa
# ============================================================
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(self), payment=(), usb=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" env=HTTPS

  # Cała aplikacja poza wyszukiwarkami
  Header always set X-Robots-Tag "noindex, nofollow, noarchive"

  # CSP — kod aplikacji wymaga inline; obce skrypty/ramki blokowane, dozwolone zaufane CDN
  Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; img-src 'self' data: blob:; media-src 'self'; font-src 'self' https://fonts.gstatic.com data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com; connect-src 'self'; form-action 'self'; frame-src 'self'"
</IfModule>

# ============================================================
#  Blokada wrażliwych plików
# ============================================================
<FilesMatch "(\.env|\.ini|\.log|\.sql|\.bak|\.old|\.swp|\.dist|\.lock|\.sh|\.bash|\.zip|\.tar|\.gz|\.7z|\.pem|\.key|composer\.(json|lock)|package(-lock)?\.json|bazadanych\.txt|\.md)$">
  Require all denied
</FilesMatch>
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
<Files "labwarden-serwer.zip">
  Require all denied
</Files>

# Zakaz wykonywania PHP w katalogach z uploadami
<IfModule mod_rewrite.c>
  RewriteRule ^(uploads|PHP/uploads)/.*\.(php|phtml|phar|pl|py|cgi|sh)$ - [F,L]
</IfModule>
