# ============================================================
# ROOT .htaccess — TEST ERP
# Path: /public_html/test_erp/.htaccess
# Updated: 2026-07-22 (Phase A+B — Test-ready revision)
# ============================================================

Options -Indexes

# ------------------------------------------------------------
# 1) Sensitive extension block
# ------------------------------------------------------------
<FilesMatch "\.(sql|bak|old|log|env|ini|swp|swo|dist|conf|sh|md|zip|tar|gz|rar|7z)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ------------------------------------------------------------
# 2) Backup/old file pattern block
# ------------------------------------------------------------
<FilesMatch "(^_old_|_old_|_old\.|\.php_old$|\.html_old$|_backup|_bak)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ------------------------------------------------------------
# 3) Debug/test file block
# ------------------------------------------------------------
<FilesMatch "^(test_|debug_|phpinfo|adminer|pma_)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ------------------------------------------------------------
# 4) Hidden file block
# ------------------------------------------------------------
<FilesMatch "^\.">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ------------------------------------------------------------
# 5) Sensitive directory block
# PHP require/include is not affected; only direct browser access is denied.
# ------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(?:config|backup|backup_105|logs|migrations|_old_junk_20260721)(?:/|$) - [F,L,NC]
</IfModule>

# ------------------------------------------------------------
# 6) Security headers
# ------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-XSS-Protection "1; mode=block"
</IfModule>
