RewriteEngine On
RewriteBase /curve/

Options -Indexes

# Prevent Apache from treating extensionless paths as folders
DirectorySlash Off


#################################
# Landing page
#################################

RewriteRule ^$ index.php [L]


#################################
# Reserva routes
#################################

# Direct /reserva visits → landing first
# (skip when coming from landing CTA)
RewriteCond %{QUERY_STRING} !(^|&)started=1(&|$)
RewriteRule ^reserva/?$ /curve/ [R=302,L]

RewriteRule ^reserva/?$ reserva/index.php [L,QSA]


#################################
# Admin routes
#################################

RewriteRule ^admin/?$ admin/visitors.php [L,QSA]

RewriteRule ^admin/visitors/?$ admin/visitors.php [L,QSA]

RewriteRule ^admin/users/?$ admin/users.php [L,QSA]

RewriteRule ^admin/login/?$ admin/login.php [L,QSA]

RewriteRule ^admin/logout/?$ admin/logout.php [L,QSA]


#################################
# Block sensitive paths
#################################

RewriteRule ^data/ - [F,L]

RewriteRule ^admin/includes/ - [F,L]

RewriteRule ^tools/ - [F,L]


#################################
# Protect configuration files
#################################

<FilesMatch "^(config\.local\.php|config\.php|composer\.(json|lock)|\.env)$">
    Require all denied
</FilesMatch>


#################################
# Security headers
#################################

<IfModule mod_headers.c>

    Header always set X-Frame-Options "SAMEORIGIN"

    Header always set X-Content-Type-Options "nosniff"

    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

</IfModule>