# Unique Earn — Clean URLs + Security (subdirectory install)
# Live path: /unique-earn-pro/admin_proj/

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /unique-earn-pro/admin_proj/

# ---- Real files & folders ----
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# ---- Hide .php (GET only) ----
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{THE_REQUEST} \s/+(.+?)\.php[\s?] [NC]
RewriteCond %{REQUEST_URI} !google_callback\.php [NC]
RewriteCond %{REQUEST_URI} !google_auth\.php [NC]
RewriteRule ^(.+)\.php$ $1 [R=301,L,QSA,NE]

# ---- /page → page.php ----
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.+)$ $1.php [L,QSA]
</IfModule>

# Custom 404
ErrorDocument 404 /unique-earn-pro/admin_proj/404.php

DirectoryIndex index.php index.html

# ---- Security headers ----
<IfModule mod_headers.c>
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-Content-Type-Options "nosniff"
  Header set X-XSS-Protection "1; mode=block"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
  # Clickjacking / basic hardening
  Header always set Content-Security-Policy "frame-ancestors 'self'"
</IfModule>

# Block sensitive files
<FilesMatch "(?i)\.(env|log|sql|bak|old|swp)$">
  Require all denied
</FilesMatch>
<FilesMatch "(?i)^(config\.php|composer\.(json|lock)|package\.json)$">
  # config is included by PHP — still deny direct web hit if possible
</FilesMatch>
<Files "config.php">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
  </IfModule>
</Files>

# Disable directory listing
Options -Indexes

# Block common attack scripts
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule (^|/)(\.git|\.svn|\.env|wp-admin|xmlrpc\.php) - [F,L,NC]
</IfModule>
# facebook_submit uses .php explicitly

# PWA
<IfModule mod_mime.c>
  AddType application/manifest+json .webmanifest
  AddType application/manifest+json .json
</IfModule>
<Files "manifest.json">
  Header set Content-Type "application/manifest+json"
</Files>
