# Disable directory listing
Options -Indexes

# Block direct HTTP access to sensitive files
<FilesMatch "^\.(env|env\..*|git.*|htaccess|htpasswd)$">
    Require all denied
</FilesMatch>
<FilesMatch "^(composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|\.gitignore|\.gitmodules|README\.md|CLAUDE\.md)$">
    Require all denied
</FilesMatch>
<FilesMatch "\.sql$">
    Require all denied
</FilesMatch>

# Belt-and-braces: block any dotfile path component (except /.well-known)
RewriteEngine On
RewriteRule "(^|/)\.(?!well-known)" - [F,L]

# ── Canonical host: force HTTPS + strip www ───────────────────────────────────
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# ── Let static files and backoffice pass through untouched ─────────────────────
RewriteRule ^views/              -                    [L]
RewriteRule ^uploads/            -                    [L]
RewriteRule ^site/assets/        -                    [L]
RewriteRule ^assets/             -                    [L]

# ── Friendly URLs ─────────────────────────────────────────────────────────────
RewriteRule ^home/?$            site/index.php       [L]
RewriteRule ^home/equipa/?$     site/equipa.php      [L,QSA]
RewriteRule ^home/modalidades/?$ site/modalidades.php [L,QSA]
RewriteRule ^home/horario/?$    site/horario.php     [L,QSA]
RewriteRule ^home/contactos/?$  site/contactos.php   [L,QSA]
RewriteRule ^home/agendar/?$    site/agendar.php     [L,QSA]
RewriteRule ^home/inscricao/?$  site/inscricao.php   [L,QSA]
RewriteRule ^home/crossfit/?$   site/crossfit.php    [L,QSA]
RewriteRule ^home/privacidade/?$ site/privacidade.php [L,QSA]
RewriteRule ^evento/([a-zA-Z0-9-]+)/?$ site/evento.php?slug=$1 [L,QSA]

# Pass the Authorization header through to PHP
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

DirectoryIndex index.php