RewriteEngine On

# PHP CGI/Apache costuma engolir Authorization; replica para o PHP.
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{HTTP:X-Client-Id} .
RewriteRule .* - [E=HTTP_X_CLIENT_ID:%{HTTP:X-Client-Id}]
RewriteCond %{HTTP:X-Api-Key} .
RewriteRule .* - [E=HTTP_X_API_KEY:%{HTTP:X-Api-Key}]

# Migração temporária: sanctuserp.com.br → solvtech.com.br (preserva path e query)
RewriteCond %{HTTP_HOST} ^(www\.)?sanctuserp\.com\.br$ [NC]
RewriteRule ^ https://solvtech.com.br%{REQUEST_URI} [R=301,L]

# Se a aplicação estiver em subdiretório, descomente e ajuste conforme o path:
# RewriteBase /apresentacao/
# RewriteBase /grupotupan/
# RewriteBase /comidasregionais/

# Pastas acidentais no document root (ex.: saidas/) sequestram a rota:
# Apache faz 301 /saidas → /saidas/ e serve DirectoryIndex em vez do front controller (HTTP 500 vazio).
RewriteRule ^saidas/?$ index.php?_route=saidas [QSA,L]
RewriteRule ^saidas/(.+)$ index.php?_route=saidas/$1 [QSA,L]
RewriteRule ^mdfe/?$ index.php?_route=mdfe [QSA,L]
RewriteRule ^mdfe/(.+)$ index.php?_route=mdfe/$1 [QSA,L]

# Pasta física api/v1/ (README) impede o rewrite genérico (!-d). Força o front controller da API BPO.
RewriteRule ^api/v1/?$ index.php?_route=api/v1 [QSA,L]
RewriteRule ^api/v1/(.+)$ index.php?_route=api/v1/$1 [QSA,L]

# Pasta física modulos/ (código das integrações) sequestra /modulos e o Apache responde 403.
RewriteRule ^modulos/?$ index.php?_route=modulos [QSA,L]
RewriteRule ^modulos/(.+)$ index.php?_route=modulos/$1 [QSA,L]

# Redireciona tudo para index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?_route=$1 [QSA,L]

# Desabilita listagem de diretórios
Options -Indexes

# Proteção de arquivos sensíveis
<FilesMatch "^\.env|^composer\.(json|lock)">
    Order allow,deny
    Deny from all
</FilesMatch>

# Configurações de segurança
<IfModule mod_headers.c>
    # Sobrescreve CSP da raiz htdocs (default-src 'none' quebra login, assets e AJAX)
    Header always unset Content-Security-Policy
    Header always unset Cross-Origin-Opener-Policy
    Header always unset Cross-Origin-Resource-Policy
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://code.jquery.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; style-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; img-src 'self' data: blob: https: http:; font-src 'self' data: https://cdn.jsdelivr.net https://fonts.gstatic.com; connect-src 'self' https: http: ws: wss:; frame-src 'self' blob: data:; form-action 'self'; frame-ancestors 'self'; base-uri 'self'"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Configurações PHP (mod_php / mod_php5)
<IfModule mod_php.c>
    php_value upload_max_filesize 8M
    php_value post_max_size 12M
    php_value max_execution_time 300
    php_value max_input_time 300
    php_value memory_limit 256M
</IfModule>

# PHP 7/8 como módulo Apache
<IfModule mod_php7.c>
    php_value upload_max_filesize 8M
    php_value post_max_size 12M
    php_value max_execution_time 300
    php_value max_input_time 300
    php_value memory_limit 256M
</IfModule>

<IfModule mod_php8.c>
    php_value upload_max_filesize 8M
    php_value post_max_size 12M
    php_value max_execution_time 300
    php_value max_input_time 300
    php_value memory_limit 256M
</IfModule>

