<IfModule mod_rewrite.c>
  Options -Indexes +FollowSymLinks
  RewriteEngine On
  RewriteBase /ENIGMA_IMPUESTOS/
  RewriteRule ^index\.html$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /ENIGMA_IMPUESTOS/index.html [L]
</IfModule>

# ─────────────────────────────────────────────────────────────────────────────
# Cabeceras de seguridad. Esta es la CSP AUTORITATIVA (la de <meta> en index.html
# queda como respaldo si este módulo no está habilitado). A diferencia del <meta>,
# aquí sí surte efecto `frame-ancestors` para bloquear el embebido en <iframe>.
# Si se agrega un nuevo backend/CDN, hay que sumarlo también en index.html.
# ─────────────────────────────────────────────────────────────────────────────
<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://www.google.com https://www.gstatic.com; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.cdnfonts.com; font-src 'self' https://fonts.cdnfonts.com data:; img-src 'self' data: blob: https://primefaces.org https://ui-avatars.com https://bwipjs-api.metafloor.com https://pdtirbackupssqlserver.s3.amazonaws.com https://pdtirbackupssqlserver.s3.us-east-1.amazonaws.com https://storage.googleapis.com; connect-src 'self' https://*.enigmadev.co wss://*.enigmadev.co https://date.nager.at https://api.ipify.org https://*.tucompra.net https://*.abcpagos.com https://www.google.com https://pdtirbackupssqlserver.s3.amazonaws.com https://pdtirbackupssqlserver.s3.us-east-1.amazonaws.com https://storage.googleapis.com; frame-src https://www.google.com; frame-ancestors 'self'; form-action 'self' https://*.abcpagos.com https://*.tucompra.net; object-src 'none'; base-uri 'self'"

  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
</IfModule>
