# ================================================================
# Gujarat Home Guard Guard Portal
# Camera + Location Permission Policy
# ================================================================

<IfModule mod_headers.c>

    # ------------------------------------------------------------
    # Remove restrictive headers inherited from parent/root rules
    # ------------------------------------------------------------

    Header unset Permissions-Policy
    Header always unset Permissions-Policy

    Header unset Feature-Policy
    Header always unset Feature-Policy


    # ------------------------------------------------------------
    # Guard Portal permissions
    #
    # Camera:
    #   Face Enrollment / Face Login માટે same-origin camera allowed.
    #
    # Microphone:
    #   Required નથી, એટલે completely blocked.
    #
    # Geolocation:
    #   Guard attendance/location tracking માટે same-origin allowed.
    # ------------------------------------------------------------

    Header always set Permissions-Policy "camera=(self), microphone=(), geolocation=(self)"


    # ------------------------------------------------------------
    # Compatibility for older Android WebView / browsers
    # ------------------------------------------------------------

    Header always set Feature-Policy "camera 'self'; microphone 'none'; geolocation 'self'"

</IfModule>


# ================================================================
# Do not cache Guard Portal camera pages
# ================================================================

<IfModule mod_expires.c>
    ExpiresActive Off
</IfModule>


<IfModule mod_headers.c>

    <FilesMatch "^(face-enroll|face-verify|camera-diagnostic)\.php$">

        Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"

        Header always set Pragma "no-cache"

        Header always set Expires "0"

    </FilesMatch>

</IfModule>


# ================================================================
# Protect sensitive Guard Portal file types
# ================================================================

<FilesMatch "\.(env|ini|log|sql|bak|backup|old|dist)$">

    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>

    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>

</FilesMatch>


# ================================================================
# Prevent directory listing
# ================================================================

Options -Indexes


# ================================================================
# Basic security headers
# ================================================================

<IfModule mod_headers.c>

    Header always set X-Content-Type-Options "nosniff"

    Header always set X-Frame-Options "SAMEORIGIN"

    Header always set Referrer-Policy "strict-origin-when-cross-origin"

</IfModule>