# Re-allow access here: the application root above carries "Require all denied".
<IfModule mod_authz_core.c>
    Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
</IfModule>

# Laravel front controller + the SvelteKit SPA built into this folder
# (frontend: `npm run build:laravel`). Real files (/_app/…, /logo.svg) are served
# by Apache directly; everything else goes to index.php, where routes/web.php
# answers non-API paths with index.html.

# `/` goes through Laravel too, so the app shell always gets the same headers.
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Force HTTPS. Behind a TLS-terminating proxy (Cloudflare, a front nginx) Apache
    # sees plain HTTP even for HTTPS visitors; X-Forwarded-Proto tells them apart,
    # so checking both avoids a redirect loop. /.well-known/ stays reachable over
    # HTTP for AutoSSL / Let's Encrypt domain validation.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
    RewriteCond %{REQUEST_URI} !^/\.well-known/
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Flag the content-hashed build output for long caching (see mod_headers below).
    RewriteRule ^_app/immutable/ - [E=SPA_IMMUTABLE:1]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

<IfModule mod_mime.c>
    AddType text/javascript .js .mjs
    AddType image/svg+xml .svg
    AddType image/webp .webp
    AddType font/woff2 .woff2
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>

<IfModule mod_headers.c>
    # /_app/immutable/* file names carry a content hash: a new build means new names.
    Header set Cache-Control "public, max-age=31536000, immutable" env=SPA_IMMUTABLE

    # The shell and the unhashed boot files must be revalidated on every load,
    # otherwise browsers keep running the previous build after a deploy.
    <FilesMatch "^(index\.html|theme-init\.js|version\.json)$">
        Header set Cache-Control "no-cache"
    </FilesMatch>

    # Do not advertise the PHP version (expose_php is often On on shared hosts).
    Header always unset X-Powered-By
    Header unset X-Powered-By

    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set X-Frame-Options "DENY"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

    # Content-Security-Policy. The built index.html also carries a <meta> CSP that
    # SvelteKit writes at build time (kit.csp in the frontend's svelte.config.js):
    #   script-src 'self' 'sha256-<hash of its inline boot script>'
    # That hash changes on every build, so it cannot live here. A browser enforces
    # both policies and a script must pass both: this header admits inline script
    # only so the meta policy can narrow it to that one hashed script; the
    # effective rule is "same-origin files + the build's own boot script".
    # style-src needs 'unsafe-inline': Svelte and the SPA shell set style attributes.
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"

    # Enable once HTTPS works on every subdomain you care about (browsers remember it):
    # Header always set Strict-Transport-Security "max-age=31536000"
</IfModule>
