# ─── Désactiver le listing des répertoires ──────────────────────────────────
Options -Indexes

# ─── Bloquer les fichiers sensibles ─────────────────────────────────────────
<FilesMatch "\.(zip|tar|gz|rar|7z|sql|log|env|bak|old|orig|save|swp|tmp|sh|py|rb|pl)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# ─── Bloquer l'accès direct aux fichiers cachés ──────────────────────────────
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# ─── Cache long terme pour assets statiques (hachés par Vite) ───────────────
<IfModule mod_expires.c>
    ExpiresActive On

    # HTML → toujours revalider
    ExpiresByType text/html                 "access plus 0 seconds"

    # JS / CSS (noms hachés par Vite → 1 an)
    ExpiresByType application/javascript    "access plus 1 year"
    ExpiresByType text/javascript           "access plus 1 year"
    ExpiresByType text/css                  "access plus 1 year"

    # Images
    ExpiresByType image/webp                "access plus 1 year"
    ExpiresByType image/png                 "access plus 1 year"
    ExpiresByType image/jpeg                "access plus 1 year"
    ExpiresByType image/svg+xml             "access plus 1 year"
    ExpiresByType image/x-icon              "access plus 1 year"
    ExpiresByType image/vnd.microsoft.icon  "access plus 1 year"

    # Vidéo
    ExpiresByType video/mp4                 "access plus 1 year"
    ExpiresByType video/webm                "access plus 1 year"

    # Polices
    ExpiresByType font/woff2                "access plus 1 year"
    ExpiresByType font/woff                 "access plus 1 year"

    # JSON (données dynamiques → courte durée)
    ExpiresByType application/json          "access plus 1 hour"
</IfModule>

<IfModule mod_headers.c>
    # Assets immutables (Vite génère des noms hachés)
    <FilesMatch "\.(js|css|webp|png|jpg|jpeg|svg|ico|woff2|woff|mp4|webm)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>

    # HTML → pas de cache
    <FilesMatch "\.html$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
    </FilesMatch>

    # JSON → courte durée
    <FilesMatch "\.json$">
        Header set Cache-Control "public, max-age=3600, must-revalidate"
    </FilesMatch>

    # Headers de sécurité
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ─── Compression gzip ────────────────────────────────────────────────────────
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml font/woff2 font/woff
</IfModule>

# ─── SPA routing (React / Vite) ──────────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.html [L]
</IfModule>