# =====================================================
# ANTI-BOT PROTECTION — Portal Access Control
# =====================================================
# Every .php request in this directory is routed through
# gate.php for validation. Static assets (CSS/JS/images)
# are served directly to avoid PHP overhead.
# =====================================================

# Prevent directory listing
Options -Indexes

# Disable server signature
ServerSignature Off

# ——— HARD DENY: Sensitive files ———
# Blocked at Apache level, before PHP runs.
# PHP include/require still works (filesystem level).

# Block sensitive file extensions from web access
<FilesMatch "\.(sql|txt|log|ps1|bak|env|sh|bat|ini)$">
    Require all denied
</FilesMatch>

# Block config, debug, and db utility files from web access
<FilesMatch "^(config\.php|antibot_config\.php|debug|\.ht|db_connection\.php|db_schema)">
    Require all denied
</FilesMatch>

# ——— REWRITE ENGINE ———
RewriteEngine On

# --- Layer 1: Block known bot User-Agents at Apache level (fastest) ---
RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider|scraper|curl|wget|python|scrapy|phantom|headless|selenium|webdriver|puppeteer|playwright|httpclient|postman|nikto|sqlmap|nmap|httrack|mechanize|go-http|node-fetch|axios|burp|acunetix|dirbuster|gobuster|ffuf) [NC]
RewriteRule \.php$ - [F,L]

# --- Skip gate.php itself (prevent infinite rewrite loop) ---
RewriteRule ^gate\.php$ - [L]

# --- Skip static assets (serve directly, zero PHP overhead) ---
RewriteRule \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|webp|mp4|webm|pdf|map)$ - [L]

# --- Handle bare directory access (/portal/ with no filename) ---
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(.*)$ gate.php?__file=index.php [L,QSA]

# --- Route ALL .php requests through the gate ---
RewriteRule ^(.+\.php)$ gate.php?__file=$1 [L,QSA]
