<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # ✅ IZINKAN AKSES KE FILE STATIS
    RewriteCond %{REQUEST_URI} \.(css|js|png|jpg|jpeg|gif|ico|woff|woff2|ttf|svg|pdf|txt)$ [NC]
    RewriteRule ^ - [L]
    
    # ✅ IZINKAN AKSES FOLDER STATIS
    RewriteCond %{REQUEST_URI} ^/(css|js|img|uploads|config|vendor)/ [NC]
    RewriteRule ^ - [L]
    
    # ✅ IZINKAN AKSES KE FILE PHP YANG DIPERLUKAN
    # HAPUS "login.php" dari list karena akan menyebabkan loop!
    RewriteCond %{REQUEST_URI} ^/(logout\.php|index\.php|dashboard\.php|test_session\.php)$ [NC]
    RewriteRule ^ - [L]
    
    # 🔐 CEK APAKAH USER SUDAH LOGIN
    # Gunakan kondisi khusus untuk halaman yang memerlukan login
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    
    # Hanya redirect ke login.php jika belum login
    # Asumsi: Anda punya session check di login.php
    # Ganti dengan LOGIKA yang benar:
    RewriteCond %{REQUEST_URI} !^/login\.php$ [NC]
    RewriteRule ^(.*)$ login.php?redirect=$1 [L,QSA]
</IfModule>

# 🛡️ SECURITY HEADERS
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# 📵 CACHE CONTROL UNTUK FILE PHP
<FilesMatch "\.(php)$">
    Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
    Header set Pragma "no-cache"
    Header set Expires "Thu, 19 Nov 1981 08:52:00 GMT"
</FilesMatch>

# 🚫 BLOCK ACCESS TO SENSITIVE FILES
<FilesMatch "^(\.htaccess|\.env|config\.php|database\.php|composer\.json|composer\.lock)$">
    Order allow,deny
    Deny from all
</FilesMatch>