# =====================================================================
# WINNES — API .htaccess
# Location: public_html/api/v1/.htaccess
# =====================================================================

# ---- Tilasta HTTPS ----
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Idan ba HTTPS ba, juya zuwa HTTPS
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Tura duk requests zuwa api.php (sai dai idan fayil ko folder na gaske ne)
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ api.php [QSA,L]
</IfModule>

# ---- Hana shiga fayilolin sirri ----
<FilesMatch "^(config|db|functions|auth|webhook)\.php$">
    Require all denied
</FilesMatch>

<FilesMatch "\.(sql|log|ini|env|json|lock|md|bak|swp)$">
    Require all denied
</FilesMatch>

# ---- Hana directory listing ----
Options -Indexes

# ---- CORS don Android app ----
<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With, X-Idempotency-Key"
    Header always set Access-Control-Max-Age "86400"

    # Tsaro
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "no-referrer"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # Cire bayanan da ba a so
    Header unset X-Powered-By
    Header unset Server
</IfModule>

# ---- PHP limits ----
<IfModule mod_php.c>
    php_flag display_errors Off
    php_flag log_errors On
    php_flag expose_php Off

    php_value max_execution_time 30
    php_value max_input_time 30
    php_value memory_limit 256M
    php_value post_max_size 8M
    php_value upload_max_filesize 8M
    php_value default_charset "UTF-8"
</IfModule>

# ---- Handle OPTIONS preflight ----
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^(.*)$ $1 [R=200,L]
</IfModule>