# MAS AI Assistant - Security Protection
# Block direct access to sensitive directories and files

<IfModule mod_rewrite.c>
RewriteEngine On

# Block access to lib directory
RewriteRule ^lib/ - [F,L]

# Block access to providers directory
RewriteRule ^providers/ - [F,L]

# Block access to integrations directory
RewriteRule ^integrations/ - [F,L]

# Block access to test directory
RewriteRule ^test/ - [F,L]

# Block access to to-do directory (contains documentation)
RewriteRule ^to-do/ - [F,L]

# Block access to PHP files in root (except allowed actions)
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} !action\.(defaultadmin|generate_content|generate_design|settings|admin_settings_save)\.php$
RewriteCond %{REQUEST_FILENAME} !function\.(admin_settings|donations)\.php$
RewriteRule \.php$ - [F,L]

</IfModule>

# Protect sensitive file types
<FilesMatch "\.(log|sql|bak|backup|key|pem)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Deny access to hidden files
<FilesMatch "^\.">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
</IfModule>

