# SimpliFi — Apache / LiteSpeed rules for the public/ document root (cPanel).
# Laravel front controller + security headers + compression + long caching for hashed assets.

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Never serve dotfiles (.env copies, .git…) except .well-known (SSL validation, assetlinks.json).
    RewriteRule (^|/)\.(?!well-known/) - [F,L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

Options -Indexes

# ---------------------------------------------------------------------------
# Security headers (Laravel responses and static files)
# ---------------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(self), payment=(self)"
    Header always set Cross-Origin-Opener-Policy "same-origin-allow-popups"
    # HSTS only over HTTPS (never on plain-HTTP captive-portal hops).
    Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>

# ---------------------------------------------------------------------------
# MIME types
# ---------------------------------------------------------------------------
<IfModule mod_mime.c>
    AddType application/manifest+json .webmanifest
    AddType application/javascript .js .mjs
    AddType image/svg+xml .svg
    AddType font/woff2 .woff2
    AddType image/webp .webp
</IfModule>

# ---------------------------------------------------------------------------
# Compression
# ---------------------------------------------------------------------------
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/json application/manifest+json
    AddOutputFilterByType DEFLATE application/xml application/rss+xml image/svg+xml
</IfModule>

# ---------------------------------------------------------------------------
# Caching
# ---------------------------------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 0 seconds"
    ExpiresByType image/png "access plus 7 days"
    ExpiresByType image/svg+xml "access plus 7 days"
    ExpiresByType image/webp "access plus 7 days"
    ExpiresByType image/x-icon "access plus 7 days"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

<IfModule mod_headers.c>
    # Vite assets (public/build/assets/name-HASH.ext) have content hashes: cache for a year.
    <FilesMatch "-[A-Za-z0-9_-]{8}\.(js|css|woff2?|png|svg|jpg|webp)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    # The service worker and offline page must always be revalidated.
    <FilesMatch "^(sw\.js|offline\.html)$">
        Header set Cache-Control "no-cache, must-revalidate"
        Header set Service-Worker-Allowed "/"
    </FilesMatch>
</IfModule>
