Options -MultiViews
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Clean questionnaire URLs.
    RewriteRule ^q/([A-Za-z0-9_-]+)/?$ public/index.php [QSA,L]
    RewriteRule ^s/([A-Za-z0-9_-]+)/?$ public/index.php [QSA,L]

    # The folder root is handled by index.php.
</IfModule>

# BEGIN MEDCAL WEB SECURITY
# Disable Apache/LiteSpeed directory indexes everywhere in this MedCal tree.
Options -Indexes

# Friendly errors without Apache/server signature details.
ErrorDocument 403 /medcal/public/403.php
ErrorDocument 404 /medcal/public/404.php
ErrorDocument 500 /medcal/public/500.php

# Conservative security headers that do not interfere with MedCal OAuth,
# questionnaires, external APIs or the current inline JS/CSS architecture.
<IfModule mod_headers.c>
    Header always unset X-Powered-By
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Permitted-Cross-Domain-Policies "none"
</IfModule>

# TRACE/TRACK are not application methods and can assist legacy proxy attacks.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^(?:TRACE|TRACK)$ [NC]
    RewriteRule ^ - [F,L]
</IfModule>

# Never expose common secrets, dumps, backups, logs or source-control files
# through a direct HTTP request.
<FilesMatch "(^\.|\.env$|\.ini$|\.log$|\.sql$|\.sqlite$|\.sqlite3$|\.bak$|\.backup$|\.old$|\.orig$|\.save$|\.swp$|\.zip$|\.tar$|\.tgz$|\.rar$|\.7z$|composer\.(json|lock)$|package(-lock)?\.json$|phpunit\.xml$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>
# END MEDCAL WEB SECURITY
