# Deploymentcenter - Front-Controller-Routing
#
# Reihenfolge ist bewusst gewaehlt: erst die Routen (jeweils mit [L]), danach
# die Sperrregeln fuer alles, was nicht geroutet wurde. Zusaetzlich liegt in
# config/, src/ und sql/ jeweils eine eigene .htaccess als zweite
# Verteidigungslinie, falls mod_rewrite oder AllowOverride ausfaellt.

Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Bereits umgeschriebene Anfragen nicht erneut anfassen.
    RewriteRule ^public/ - [L]

    # ------------------------------------------------------------------
    # 1. Statische Assets
    # ------------------------------------------------------------------
    RewriteRule ^assets/(.*)$ public/assets/$1 [L,QSA]

    # ------------------------------------------------------------------
    # 2. API
    # ------------------------------------------------------------------
    RewriteRule ^api/health/?$                       public/api/health.php [L,QSA]
    RewriteRule ^api/openapi(?:\.json)?/?$           public/api/openapi.php [L,QSA]

    RewriteRule ^api/errors/v1/report/?$             public/api/errors/v1/report.php [L,QSA]
    RewriteRule ^api/bugtracker/v1/report/?$         public/api/bugtracker/v1/report.php [L,QSA]
    RewriteRule ^api/bugtracker/v1/projects/?$       public/api/bugtracker/v1/projects.php [L,QSA]
    RewriteRule ^api/bugtracker/v1/manage(?:/(.*))?$ public/api/bugtracker/v1/manage/index.php [L,QSA]

    RewriteRule ^api/license/v1(?:/(.*))?$           public/api/license/v1/index.php [L,QSA]
    RewriteRule ^api/watchdog/v1(?:/(.*))?$          public/api/watchdog/v1/index.php [L,QSA]
    RewriteRule ^api/updateservice/v1(?:/(.*))?$     public/api/updateservice/v1/index.php [L,QSA]
    RewriteRule ^api/tokens/v1/provision/?$          public/api/tokens/v1/provision.php [L,QSA]

    # Fallback fuer direkt adressierte Dateien unterhalb von /api/
    RewriteRule ^api/(.*)$ public/api/$1 [L,QSA]

    # ------------------------------------------------------------------
    # 3. Oeffentliche Dokumentation (public/docs/)
    #    Muss vor der Sperrregel stehen, sonst wuerde ^docs/ blockiert.
    # ------------------------------------------------------------------
    RewriteRule ^docs/?$      public/docs/index.php [L,QSA]
    RewriteRule ^docs/(.+)$   public/docs/$1 [L,QSA]

    # ------------------------------------------------------------------
    # 4. WebUI
    # ------------------------------------------------------------------
    RewriteRule ^install_db\.php$ public/install_db.php [L,QSA]
    RewriteRule ^login\.php$      public/login.php [L,QSA]
    RewriteRule ^logout\.php$     public/logout.php [L,QSA]
    RewriteRule ^index\.php$      public/index.php [L,QSA]
    RewriteRule ^$                public/index.php [L,QSA]

    # ------------------------------------------------------------------
    # 5. Alles Uebrige sperren: Anwendungscode, Konfiguration, Skripte
    # ------------------------------------------------------------------
    RewriteRule ^(config|src|sql|scripts|cli|var|client-dotnet)(/|$) - [F,L]
    RewriteRule ^Serverdaten\.txt$ - [F,L]
</IfModule>

# ----------------------------------------------------------------------
# Sicherheits-Header
# ----------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# ----------------------------------------------------------------------
# Dateischutz auch ohne mod_rewrite
# ----------------------------------------------------------------------
<FilesMatch "^(Serverdaten\.txt|\.env.*|composer\.(json|lock)|deploy_config\.json)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>