# public/.htaccess
Options -Indexes -ExecCGI

# Nunca expor erros PHP ao browser
php_flag display_errors off
php_flag display_startup_errors off

# Forçar charset UTF-8
AddDefaultCharset UTF-8

# Bloquear acesso a ficheiros sensíveis que por engano caiam em public/
<FilesMatch "\.(env|sql|log|md|bak|sh|bat|ini|cfg|conf|key|pem)$">
  Require all denied
</FilesMatch>

# Bloquear ficheiros PHP de app/ que por engano caiam aqui
<FilesMatch "^(config|db|auth|helpers|layout_top|layout_bottom)\.php$">
  Require all denied
</FilesMatch>

# Bloquear acesso directo a ficheiros de upload temporários
<FilesMatch "\.(csv|xlsx|xls)$">
  Require all denied
</FilesMatch>

# Headers de segurança HTTP (fallback — o config.php já os envia via PHP)
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always unset X-Powered-By
  Header always unset Server
</IfModule>

# Remover X-Powered-By via PHP também
<IfModule mod_php.c>
  php_flag expose_php off
</IfModule>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Forçar HTTPS em produção (descomentar quando tiver certificado SSL)
  # RewriteCond %{HTTPS} off
  # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Servir ficheiros/pastas reais directamente (css, js, imagens)
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # URLs limpas opcionais: /clientes/ver/3 → index.php?p=clientes&a=ver&id=3
  RewriteRule ^([a-z_]+)(?:/([a-z_]+))?(?:/(\d+))?/?$ index.php?p=$1&a=$2&id=$3 [L,QSA]
</IfModule>
