# Enable Rewrite Engine
RewriteEngine On

# ============================================
# ALLOW AUTH/ADMIN PAGES
# ============================================

# Don't block admin login pages
RewriteRule ^admin/login\.php$ - [L]
RewriteRule ^admin/ - [L]
RewriteRule ^includes/auth\.php$ - [L]

# ============================================
# BLOCK SEARCH ENGINE BOTS & MALICIOUS AGENTS
# ============================================

# Skip bot blocking for admin and auth pages
RewriteCond %{REQUEST_URI} !^/admin/ [NC]
RewriteCond %{REQUEST_URI} !^/includes/auth\.php [NC]
RewriteCond %{REQUEST_URI} !^/auth/ [NC]

# Block known bad bots and crawlers
RewriteCond %{HTTP_USER_AGENT} (bot|crawler|spider|scraper|curl|wget|python|java|php|perl|ruby|scan|httrack|webcopier|webzip|teleport|mhtracer) [NC]
RewriteRule .* - [F,L]

# Block specific search engine bots
RewriteCond %{HTTP_USER_AGENT} (Googlebot|Bingbot|Slurp|DuckDuckBot|Baiduspider|YandexBot|Sogou|Exabot|facebot|ia_archiver|AhrefsBot|SemrushBot) [NC]
RewriteRule .* - [F,L]

# Block empty user agents
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [F,L]

# ============================================
# REMOVE .php EXTENSION FROM URLs
# ============================================

# Remove .php extension from URLs (general rule)
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([^/]+)/?$ $1.php [L]

# Handle auth directory
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^auth/([^/]+)/?$ auth/$1.php [L,QSA]

# Handle admin directory
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^admin/([^/]+)/?$ admin/$1.php [L,QSA]

# Handle user directory
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^user/([^/]+)/?$ user/$1.php [L,QSA]

# Handle app/pages directory
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^pages/([^/]+)/?$ pages/$1.php [L,QSA]

# ============================================
# PROTECT SENSITIVE DIRECTORIES
# ============================================

# Prevent access to includes directory (EXCEPT auth.php)
RewriteCond %{REQUEST_URI} !^/includes/auth\.php$ [NC]
RewriteRule ^includes/ - [F,L]

# Prevent access to config directory
RewriteRule ^config/ - [F,L]

# Protect uploads directory from direct access
RewriteRule ^uploads/.*\.(php|html|txt)$ - [F,L]

# ============================================
# CUSTOM ERROR PAGES
# ============================================

ErrorDocument 403 /error/403.php
ErrorDocument 404 /error/404.php
ErrorDocument 500 /error/500.php

# ============================================
# PROTECT SENSITIVE FILES
# ============================================

<FilesMatch "\.(env|json|config|sql|log|ini|sh|bak|backup|md)$">
    Require all denied
</FilesMatch>

<FilesMatch "^\.ht">
    Require all denied
</FilesMatch>

# ============================================
# SECURITY HEADERS
# ============================================

<IfModule mod_headers.c>
    Header set X-Robots-Tag "noindex, nofollow"
    Header set X-Frame-Options "DENY"
    Header set X-Content-Type-Options "nosniff"
    Header set Referrer-Policy "no-referrer-when-cross-origin"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>

# ============================================
# PREVENT DIRECTORY LISTING
# ============================================

Options -Indexes