Options +FollowSymLinks -Indexes
RewriteEngine On

# Block access to sensitive files and directories
<FilesMatch "^\.env(\..*)?$">
    Require all denied
</FilesMatch>
<FilesMatch "^\.git">
    Require all denied
</FilesMatch>
<FilesMatch "\.(sql|log|bak|old|orig|save|swp|swo)$">
    Require all denied
</FilesMatch>
<FilesMatch "^(composer\.(json|lock)|package(-lock)?\.json|phpunit\.xml|\.editorconfig|\.eslintrc|\.prettierrc)$">
    Require all denied
</FilesMatch>

# Enable gzip compression for API responses (JSON)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

# Disable caching globally (browser/server/CDN/proxy)
<IfModule mod_headers.c>
    Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0, s-maxage=0, proxy-revalidate, private, no-transform"
    Header always set Pragma "no-cache"
    Header always set Expires "0"
    Header always set Surrogate-Control "no-store"
    Header always set CDN-Cache-Control "no-store"
    Header always set X-Accel-Expires "0"
    Header always set X-DNS-Prefetch-Control "off"
    Header always unset Last-Modified
    Header always unset ETag
    # ponytail: collapse the duplicate X-Frame-Options. Apache's global
    # httpd-security.conf does `Header always append X-Frame-Options DENY`,
    # and the app sets SAMEORIGIN → conflicting "DENY, SAMEORIGIN" makes the
    # browser fall back to DENY, blocking the same-origin file-preview iframe
    # ("localhost refused to connect"). Unset every instance, then emit one
    # SAMEORIGIN (the app's intended policy; CSP frame-src 'self' still gates it).
    Header always unset X-Frame-Options
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>
FileETag None
<IfModule mod_expires.c>
    ExpiresActive Off
</IfModule>

# Phase 1 perf: cache versioned static assets so browsers reuse 150+ ESM modules
# instead of re-fetching per page load (global no-store above steals Apache threads
# for static delivery under load). The asset version map (src/index.php mtime+size)
# busts on change. Cache-Control below is later in config, so it overrides no-store
# for matched files. HTML + API responses stay no-store. ponytail: max-age=1h knob.
<IfModule mod_headers.c>
    <FilesMatch "\.(js|mjs|css|woff2?|ttf|eot|otf|svg|png|jpe?g|gif|webp|ico|wasm)$">
        Header set Cache-Control "public, max-age=3600, must-revalidate"
    </FilesMatch>
</IfModule>

# Custom error pages - route through SPA for consistent UX
ErrorDocument 404 /drawing/index.php
ErrorDocument 403 /drawing/index.php
ErrorDocument 500 /drawing/index.php

# API Routing
RewriteRule ^api($|/.*) api_entry.php [L,QSA]
RewriteRule ^health($|/.*) api_entry.php [L,QSA]
RewriteRule ^admin/(qa|integrity)/report$ api_entry.php [L,QSA]

RewriteRule ^employees/?$ index.php [L]
RewriteRule ^jobs/?$ index.php [L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]
