# ============================================================
#  منصة خبرة — إعدادات الاستضافة والأمان (Apache / cPanel)
# ============================================================

AddDefaultCharset UTF-8
AddCharset UTF-8 .html .css .js .json
DirectoryIndex index.html
Options -Indexes

# ============================================================
#  إلزام الاتصال المشفّر
#  عطّل هذا القسم مؤقتًا فقط إذا لم تُفعّل شهادة SSL بعد
# ============================================================
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteCond %{HTTP_HOST} !^localhost [NC]
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# ============================================================
#  الرؤوس الأمنية
# ============================================================
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
  Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS

  # سياسة المحتوى: تسمح بخطوط جوجل فقط، وتمنع أي مصدر خارجي آخر
  Header always set Content-Security-Policy "default-src 'self'; \
script-src 'self' 'unsafe-inline'; \
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; \
font-src 'self' https://fonts.gstatic.com data:; \
img-src 'self' data: blob:; \
connect-src 'self'; \
form-action 'self'; \
frame-ancestors 'self'; \
base-uri 'self'; \
object-src 'none'"

  Header unset X-Powered-By
  Header always unset Server
</IfModule>

# ============================================================
#  التخزين المؤقت
# ============================================================
<IfModule mod_headers.c>
  # ملف البيانات الاحتياطي لا يُخزَّن — حتى يصل التحديث فورًا
  <FilesMatch "^data\.js$">
    Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
  </FilesMatch>
  # صفحات HTML تُراجَع دائمًا
  <FilesMatch "\.html$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css               "access plus 6 hours"
  ExpiresByType application/javascript "access plus 6 hours"
  ExpiresByType image/png              "access plus 30 days"
  ExpiresByType image/jpeg             "access plus 30 days"
  ExpiresByType image/webp             "access plus 30 days"
  ExpiresByType image/svg+xml          "access plus 30 days"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/plain
  AddOutputFilterByType DEFLATE application/javascript application/json image/svg+xml
</IfModule>

# ============================================================
#  حماية الملفات الحسّاسة
# ============================================================
<FilesMatch "\.(json|docx|xlsx|md|txt|log|sql|bak|old|ini)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# ملفات النظام المخفية
<FilesMatch "^\.">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# ============================================================
#  صفحة التنصيب — احذفها أو امنعها بعد الانتهاء
#  لتعطيل الوصول إليها نهائيًا أزل علامة # من السطور التالية
# ============================================================
# <Files "install.php">
#   <IfModule mod_authz_core.c>
#     Require all denied
#   </IfModule>
# </Files>
