# Deny access to sensitive files
<Files "*.log">
    Require all denied
</Files>

<Files "umar_config.php">
    Require all denied
</Files>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Prevent directory browsing
Options -Indexes

# PHP security settings
<IfModule mod_php7.c>
    php_flag expose_php off
    php_flag display_errors off
    php_flag log_errors on
</IfModule>

# Rate limiting (if mod_security is available)
<IfModule mod_security.c>
    SecRule REQUEST_URI "@contains /api/" \
        "id:1001,phase:1,t:none,t:lowercase,deny,msg:'Rate limiting',\
        setvar:ip.requests_per_minute=+1,\
        expirevar:ip.requests_per_minute=60,\
        setvar:ip.requests_per_hour=+1,\
        expirevar:ip.requests_per_hour=3600"
    
    SecRule IP:REQUESTS_PER_MINUTE "@gt 30" \
        "id:1002,phase:1,deny,msg:'Rate limit exceeded - too many requests per minute'"
    
    SecRule IP:REQUESTS_PER_HOUR "@gt 500" \
        "id:1003,phase:1,deny,msg:'Rate limit exceeded - too many requests per hour'"
</IfModule>

# CORS headers for API endpoints
<IfModule mod_headers.c>
    <LocationMatch "/api/">
        Header set Access-Control-Allow-Origin "*"
        Header set Access-Control-Allow-Methods "POST, OPTIONS"
        Header set Access-Control-Allow-Headers "Content-Type"
    </LocationMatch>
</IfModule>

# Redirect API calls to proper endpoints
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # API endpoint rewrites
    RewriteRule ^validate/?$ api/validate.php [L]
    RewriteRule ^trial/?$ api/trial.php [L]
    RewriteRule ^status/?$ api/status.php [L]
</IfModule>