# ========================================================
# CensoAcacías - Configuración Apache / cPanel (.htaccess)
# ========================================================

# Deshabilitar listado de directorios
Options -Indexes

# Charset por defecto
AddDefaultCharset UTF-8

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Forzar HTTPS en cPanel (compatible con proxies y SSL flexible)
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{HTTP_HOST} !^localhost [NC]
    RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Bloquear acceso directo a archivos sensibles
<FilesMatch "^(config\.php|config\.example\.php|schema\.sql|migracion_colores\.sql|install\.lock|\.git|\.env)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Encabezados para Service Worker y Manifest de PWA
<IfModule mod_headers.c>
    <Files "sw.js">
        Header set Service-Worker-Allowed "/"
        Header set Cache-Control "no-cache, no-store, must-revalidate"
    </Files>
    <Files "manifest.json">
        Header set Content-Type "application/manifest+json; charset=utf-8"
    </Files>
</IfModule>
