RewriteEngine On

# Preserve Authorization header for API bearer tokens
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Front controller: everything not a real file/dir and not a public asset folder → index.php
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond $1 !^(css|js|fonts|images|uploads|attachments)
RewriteRule ^(.+)$ index.php/$1 [L]

# ---- File-level denies ----
<FilesMatch "\.(sql|gz|env|log|md|ini|bak|swp|orig|yml|yaml|toml|lock|sh|ps1|psd|ai)$">
    Require all denied
</FilesMatch>
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
<FilesMatch "(composer\.(json|lock)|package(-lock)?\.json)">
    Require all denied
</FilesMatch>

# ---- Directory denies (defence in depth on top of index.html blockers) ----
RedirectMatch 404 ^/pacific_logistics/config/?.*$
RedirectMatch 404 ^/pacific_logistics/core/?.*$
RedirectMatch 404 ^/pacific_logistics/app/?.*$
RedirectMatch 404 ^/pacific_logistics/db/?.*$
RedirectMatch 404 ^/pacific_logistics/scripts/?.*$
RedirectMatch 404 ^/pacific_logistics/logs/?.*$
RedirectMatch 404 ^/pacific_logistics/backups/?.*$
RedirectMatch 404 ^/pacific_logistics/\.git(/.*)?$

# ---- Security headers ----
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "geolocation=(self), microphone=(), camera=(self)"
    # HSTS: enable when moved to HTTPS on the VPS
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    # CSP: everything self, no CDN (all libs bundled locally). Allow inline styles/scripts for now while we're inlining Vue mount blocks.
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'"
    Header unset X-Powered-By
    Header unset Server
</IfModule>

# ---- Caching (long-lived for assets, none for HTML) ----
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg  "access 1 year"
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/png  "access 1 year"
ExpiresByType image/webp "access 1 year"
ExpiresByType image/svg+xml "access 1 year"
ExpiresByType text/css   "access 1 month"
ExpiresByType application/javascript "access 1 year"
ExpiresByType font/woff  "access 1 year"
ExpiresByType font/woff2 "access 1 year"
ExpiresByType application/font-woff2 "access 1 year"
ExpiresByType text/html  "access 0 seconds"
ExpiresDefault "access 1 month"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE application/javascript
  AddOutputFilterByType DEFLATE application/json
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/javascript
  AddOutputFilterByType DEFLATE text/plain
  AddOutputFilterByType DEFLATE text/xml
  AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# ---- Disable directory listing everywhere ----
Options -Indexes
