# SendPoS - Rendimiento y seguridad del servidor
Options -Indexes
DirectoryIndex index.php

# ---------------------------------------------------------------------------
# HTTPS obligatorio (se omite en local para no romper el entorno de pruebas)
# ---------------------------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On

  RewriteCond %{HTTPS} off
  RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
  RewriteCond %{HTTP_HOST} !^localhost [NC]
  RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Carpetas internas: nunca se sirven por HTTP. El código PHP las incluye
  # desde el disco, así que bloquearlas aquí no afecta al sistema.
  RewriteRule ^(config|core|sql|tools|docs|vendor|\.git|\.baileys)(/|$) - [F,L]
</IfModule>

# ---------------------------------------------------------------------------
# Compresión
# ---------------------------------------------------------------------------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json application/font-woff2 image/svg+xml
</IfModule>

<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript application/javascript application/json application/font-woff2 image/svg+xml
</IfModule>

# ---------------------------------------------------------------------------
# Caché
# ---------------------------------------------------------------------------
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 30 days"
  ExpiresByType application/javascript "access plus 30 days"
  ExpiresByType image/png "access plus 90 days"
  ExpiresByType image/jpeg "access plus 90 days"
  ExpiresByType image/webp "access plus 90 days"
  ExpiresByType image/svg+xml "access plus 90 days"
  ExpiresByType font/woff2 "access plus 180 days"
  ExpiresByType font/woff "access plus 180 days"
</IfModule>

# ---------------------------------------------------------------------------
# Cabeceras de seguridad
# ---------------------------------------------------------------------------
<IfModule mod_headers.c>
  <FilesMatch "\.(css|js|woff2|woff|svg|png|jpg|jpeg|webp|gif|ico)$">
    Header set Cache-Control "public, max-age=2592000, immutable"
  </FilesMatch>
  <FilesMatch "\.(php|html)$">
    Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
    Header set Pragma "no-cache"
    Header set Expires "0"
  </FilesMatch>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(self), microphone=(), camera=()"
</IfModule>

# HSTS solo cuando la petición ya es HTTPS (en local no se envía).
<IfModule mod_headers.c>
  <If "%{HTTPS} == 'on'">
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  </If>
</IfModule>

# ---------------------------------------------------------------------------
# Archivos que nunca deben ejecutarse ni descargarse
# ---------------------------------------------------------------------------
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

<FilesMatch "\.(sql|sqlite|ini|log|bak|old|orig|dist|md|json|lock|sh|bat|yml|yaml)$">
  Require all denied
</FilesMatch>

# ---------------------------------------------------------------------------
# Carpetas de subida: nada de PHP dentro de ellas
# ---------------------------------------------------------------------------
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
  <If "%{REQUEST_URI} =~ m#/uploads/#">
    Require all denied
  </If>
  <If "%{REQUEST_URI} =~ m#/firmas/#">
    Require all denied
  </If>
</FilesMatch>
