# ============================================================
# RiskPonse - Root access control
# ============================================================
# Every .php file in this project is directly web-callable because the app has
# no front controller. These rules close off the paths that were never meant to
# be fetched over HTTP: secrets, config, schema, migrations and shared includes.

# --- Never serve dotfiles (.env, .gitignore, ...) ------------------------------
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# --- Never serve raw SQL, env, log, markdown or backup files -------------------
<FilesMatch "\.(sql|env|log|md|bak|ini|sh)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# --- Directory listings off ----------------------------------------------------
Options -Indexes

# --- Security headers ----------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # Photos and map pins are location data - keep them out of third-party referers.
    Header always set Permissions-Policy "geolocation=(self), camera=(), microphone=()"
</IfModule>

# --- Default charset -----------------------------------------------------------
AddDefaultCharset UTF-8
