# Bloquear listagem de diretórios em todo o servidor
Options -Indexes

# Segurança básica e endurecimento para HTTPS
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
  Header always set Content-Security-Policy "default-src 'self' blob: https://cdn.tailwindcss.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://demo.qz.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://cdn.tailwindcss.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://cdn.jsdelivr.net/npm/chart.js https://cdn.jsdelivr.net/npm/apexcharts https://static.cloudflareinsights.com https://infird.com https://demo.qz.io; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://cdn.tailwindcss.com https://fonts.googleapis.com; font-src 'self' https://cdnjs.cloudflare.com https://fonts.gstatic.com https://fonts.googleapis.com data:; connect-src 'self' https://cdn.jsdelivr.net https://cdn.tailwindcss.com https://cdnjs.cloudflare.com https://cloudflareinsights.com https://static.cloudflareinsights.com https://cdn-cgi.cloudflare.com https://infird.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.overcrispnet.com https://demo.qz.io http://localhost:* https://localhost:* ws://localhost:* wss://localhost:* http://127.0.0.1:* https://127.0.0.1:* ws://127.0.0.1:* wss://127.0.0.1:* http://localhost.qz.io:* https://localhost.qz.io:* ws://localhost.qz.io:* wss://localhost.qz.io:*; img-src 'self' data: https: https://picsum.photos https://fastly.picsum.photos; manifest-src 'self' blob:; frame-ancestors 'self'; form-action 'self'; base-uri 'self';"
</IfModule>

<IfModule mod_mime.c>
  AddType application/manifest+json .webmanifest
  AddType application/manifest+json .json
</IfModule>

# Compressão GZIP para reduzir tamanho das respostas
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
  AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript
  AddOutputFilterByType DEFLATE image/svg+xml application/xml
  AddOutputFilterByType DEFLATE font/woff2 font/woff font/ttf application/font-woff application/font-woff2

  # Evitar compressão em imagens e arquivos já comprimidos
  SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|webp|ico|zip|gz|bz2|rar)$ no-gzip
</IfModule>

# Cache de assets estáticos no navegador (1 ano)
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"

  # CSS e JavaScript
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType text/javascript "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"

  # Imagens
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"

  # Fontes
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType font/woff "access plus 1 year"
  ExpiresByType font/ttf "access plus 1 year"
  ExpiresByType application/font-woff "access plus 1 year"
  ExpiresByType application/font-woff2 "access plus 1 year"

  # Manifest e JSON
  ExpiresByType application/json "access plus 0 seconds"

  # HTML/PHP (sem cache longo)
  ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# Cache-Control headers adicionais
<IfModule mod_headers.c>
  # Assets com versionamento (?v=) recebem cache máximo
  <FilesMatch "\.(css|js|svg|png|jpg|jpeg|webp|gif|ico|woff2?|ttf)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>

  # Service Worker nunca deve ser cacheado no longo prazo
  <FilesMatch "^sw\.js$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>

  # HTML e PHP não devem ter cache longo
  <FilesMatch "\.(html|php)$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>
</IfModule>

# Bloqueios, redirecionamento HTTPS e rewrites compatíveis com XAMPP
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Forçar HTTPS (apenas se não estiver vindo de proxy já em HTTPS)
  RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:[0-9]+)?$ [NC]
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Redirecionar root para o cardápio
  RewriteRule ^$ cardapio/ [L,R=301]

  # Bloquear acesso direto à pasta includes/ e arquivos ocultos (.env)
  RewriteRule ^includes/ - [F,L]
  RewriteRule ^\.(.*)$ - [F,L]
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Defina o pacote “ea-php81” como a linguagem padrão de programação “PHP”.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php81___lsphp .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
