Options -Indexes -MultiViews
DirectoryIndex front_controller.php index.html

RewriteEngine On

# Prevent direct web access to application internals and source artifacts.
RewriteRule ^(?:includes|migrations)(?:/|$) - [F,L,NC]

<FilesMatch "\.(?:sql|zip|md)$">
    Require all denied
</FilesMatch>

<FilesMatch "^(?:Dockerfile|\.htaccess)$">
    Require all denied
</FilesMatch>

# Render terminates TLS at its proxy and forwards the original protocol here.
# Only redirect when neither Apache nor the proxy reports an HTTPS request.
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]

# Canonical application pages are dispatched through the front controller.
# Physical diagnostics are deliberately excluded and remain Admin-only.
RewriteCond %{THE_REQUEST} \s/+(.*/)?(?:index|login|logout|signup|change_password|dashboard|student_list|student_view|student_add|student_edit_profile|student_delete|student_profile|student_talents|student_add_talent|student_edit_talent|student_delete_talent|achievement_duplicate_override|achievement_extract|student_portfolio|admin_certificates|admin_import_students|staff_list|staff_add|staff_edit|staff_delete|audit_logs|account_profile|file_asset|certificate_preview_error)\.php(?:[?\s]) [NC]
RewriteRule ^(?:index|login|logout|signup|change_password|dashboard|student_list|student_view|student_add|student_edit_profile|student_delete|student_profile|student_talents|student_add_talent|student_edit_talent|student_delete_talent|achievement_duplicate_override|achievement_extract|student_portfolio|admin_certificates|admin_import_students|staff_list|staff_add|staff_edit|staff_delete|audit_logs|account_profile|file_asset|certificate_preview_error)\.php$ front_controller.php [QSA,L]

# Preserve real static files/directories; route every other application URL.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ front_controller.php [QSA,L]

# Compress text responses before sending them to the browser.
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>

# CSS and JavaScript URLs are versioned by file modification time in PHP.
<IfModule mod_headers.c>
    # Baseline browser security policy. External origins are limited to the
    # services currently used by INVENTA (Google reCAPTCHA/fonts and jsDelivr).
    Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://www.google.com https://www.gstatic.com; worker-src 'self' blob: https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: blob: https://www.google.com https://www.gstatic.com; connect-src 'self' https://cdn.jsdelivr.net https://www.google.com https://www.gstatic.com; frame-src https://www.google.com https://recaptcha.google.com; upgrade-insecure-requests"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"

    # Render terminates TLS at its reverse proxy. Only advertise HSTS for
    # requests the proxy confirms were received over HTTPS.
    SetEnvIf X-Forwarded-Proto "^https$" INVENTA_HTTPS=1
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=INVENTA_HTTPS

    <FilesMatch "\.(?:css|js)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    <FilesMatch "\.(?:png|jpe?g|gif|webp|svg|ico)$">
        Header set Cache-Control "public, max-age=604800"
    </FilesMatch>
</IfModule>
