# Rojgar Sathee — front controller routing + security headers
RewriteEngine On
RewriteBase /

# Block dotfiles
RewriteRule "^\.well-known" - [L]
RewriteRule "(^|/)\." - [F]

# Static files (and the built-in SW + manifest) served as-is
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Sitemap (.xml friendly URL -> sitemap.php)
RewriteRule ^sitemap\.xml$ sitemap.php [L]

# Everything else -> index.php
RewriteRule ^ index.php [QSA,L]

# ============================================================
# Security headers
# ============================================================
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set X-XSS-Protection "1; mode=block"
    Header set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), interest-cohort=()"
    Header set Cross-Origin-Opener-Policy "same-origin"
    # HSTS - only enable once you've fully migrated to HTTPS:
    # Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

    # Content Security Policy - allows the CDNs we use; tighten further by self-hosting
    # bootstrap/icons/fonts in production.
    Header set Content-Security-Policy "default-src 'self'; \
        img-src 'self' data: blob: https://drive.google.com https://*.googleusercontent.com https://lh3.googleusercontent.com https:; \
        style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; \
        font-src 'self' https://cdn.jsdelivr.net https://fonts.gstatic.com; \
        script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; \
        connect-src 'self'; \
        frame-ancestors 'self'; \
        base-uri 'self'; \
        form-action 'self'; \
        object-src 'none'"

    # No caching for HTML responses (so app updates show up immediately)
    <FilesMatch "\.(php)$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>

    # Service worker must NOT be cached
    <FilesMatch "^sw\.js$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
    </FilesMatch>
</IfModule>

# ============================================================
# Cache static assets aggressively (cache busting via ?v=N)
# ============================================================
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css                  "access plus 1 month"
    ExpiresByType application/javascript    "access plus 1 month"
    ExpiresByType image/svg+xml             "access plus 1 month"
    ExpiresByType image/png                 "access plus 1 month"
    ExpiresByType image/jpeg                "access plus 1 month"
    ExpiresByType image/webp                "access plus 1 month"
    ExpiresByType image/gif                 "access plus 1 month"
    ExpiresByType font/woff2                "access plus 1 year"
    ExpiresByType application/manifest+json "access plus 1 day"
</IfModule>

# Compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# Block PHP execution in upload dirs (defence in depth — we never need it)
<Directory "uploads">
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar|pht|inc)$">
        Require all denied
    </FilesMatch>
</Directory>
