DirectoryIndex index.php
Options -Indexes
ServerSignature Off

RewriteEngine On
RewriteRule ^(?:fluxacms-repair\.php|FluxaCMS-module-update-recovery\.zip)$ - [F,L,NC]
RewriteRule ^(?:build|e2e|packages|node_modules|update-server)(?:/|$) - [F,L,NC]
RewriteRule ^(?:package\.json|pnpm-lock\.yaml|composer\.(?:json|lock)|playwright\.config\.mjs)$ - [F,L,NC]
RewriteCond %{REQUEST_METHOD} !^(?:GET|POST|HEAD)$ [NC]
RewriteRule ^ - [R=405,L]

RewriteRule ^(?:app|core|distribution|modules|storage|templates|tests|tools|backups|docs|admin/config)(?:/|$) - [F,L,NC]
RewriteRule ^project/(?:templates|chunks|\.vscode|\.fluxa)(?:/|$) - [F,L,NC]
RewriteRule ^project/(?:active\.php|package\.php|fluxa-project\.json|README\.md)$ - [F,L,NC]
RewriteRule (^|/)\.(?!well-known(?:/|$)) - [F,L]

<FilesMatch "\.(?:env|ini|log|sql|bak|dist)$">
    Require all denied
</FilesMatch>

<IfModule mod_headers.c>
    SetEnvIf Request_URI "^/media-svg/" CMS_SVG_RESPONSE=1
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always set Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox" env=CMS_SVG_RESPONSE
    Header always set Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox" env=REDIRECT_CMS_SVG_RESPONSE
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
</IfModule>

RewriteRule ^sitemap(?:-([0-9]+))?\.xml$ index.php?route=sitemap&part=$1 [L,QSA]
RewriteRule ^robots\.txt$ index.php?route=robots [L,QSA]
RewriteRule ^media-svg/(.+\.svg)$ index.php?route=media-svg&file=$1 [L,QSA,NC]
RewriteRule ^assets/(?!cache/|css/front-editor\.css$|js/front-editor\.js$)(.+)$ project/assets/$1 [L,NE]

# Missing admin PHP routes declared by enabled modules are dispatched by the core.
# Modules keep their handlers inside /modules and no longer need proxy files in /admin.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^admin/([a-z0-9-]+\.php)$ admin/module-route.php?route=$1 [L,QSA]

# Redirect legacy public URLs to their canonical extensionless routes.
RewriteCond %{THE_REQUEST} \s/+((?:account|auth|auth-action|cart|confirm-email|contacts|front-edit|order-action|payment-callback|payment-result|privacy|product|site-logout))\.(?:php|html)(?:[?\s]) [NC]
RewriteRule ^(account|auth|auth-action|cart|confirm-email|contacts|front-edit|order-action|payment-callback|payment-result|privacy|product|site-logout)\.(?:php|html)$ /$1/ [R=301,L,NE]

RewriteRule ^(account|auth|auth-action|cart|confirm-email|front-edit|order-action|payment-callback|payment-result|site-logout)/?$ index.php?route=$1 [L,QSA]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([A-Za-z0-9_-]+(?:/[A-Za-z0-9_-]+)*)/?$ index.php?route=cms-page&slug=$1 [L,QSA]
