Options +FollowSymLinks -Indexes
RewriteEngine On

# Block access to sensitive files and directories
<FilesMatch "^\.env(\..*)?$">
    Require all denied
</FilesMatch>
<FilesMatch "^\.git">
    Require all denied
</FilesMatch>
<FilesMatch "\.(sql|log|bak|old|orig|save|swp|swo)$">
    Require all denied
</FilesMatch>
<FilesMatch "^(composer\.(json|lock)|package(-lock)?\.json|phpunit\.xml|\.editorconfig|\.eslintrc|\.prettierrc)$">
    Require all denied
</FilesMatch>

# Enable gzip compression for API responses (JSON)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

# Disable caching globally (browser/server/CDN/proxy)
<IfModule mod_headers.c>
    Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0, s-maxage=0, proxy-revalidate, private, no-transform"
    Header always set Pragma "no-cache"
    Header always set Expires "0"
    Header always set Surrogate-Control "no-store"
    Header always set CDN-Cache-Control "no-store"
    Header always set X-Accel-Expires "0"
    Header always set X-DNS-Prefetch-Control "off"
    Header always unset Last-Modified
    Header always unset ETag
</IfModule>
FileETag None
<IfModule mod_expires.c>
    ExpiresActive Off
</IfModule>

# Custom error pages - route through SPA for consistent UX
ErrorDocument 404 /drawing/index.php
ErrorDocument 403 /drawing/index.php
ErrorDocument 500 /drawing/index.php

# API Routing
RewriteRule ^api($|/.*) api_entry.php [L,QSA]
RewriteRule ^health/?$ api_entry.php [L,QSA]

RewriteRule ^employees/?$ index.php [L]
RewriteRule ^jobs/?$ index.php [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
