# Set correct MIME types for JavaScript modules
<IfModule mod_mime.c>
    AddType application/javascript .js
    AddType application/javascript .mjs
</IfModule>

<IfModule mod_headers.c>
    # Enable CORS for fonts
    <FilesMatch "\.(ttf|ttc|otf|eot|woff|woff2|font.css|css)$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>

    # Disable caching for JS modules to prevent stale module cache
    <FilesMatch "\.m?js$">
        Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
        Header set Pragma "no-cache"
        Header set Expires "0"
    </FilesMatch>

    # CSS must never be served stale: pin no-store AND strip Last-Modified/ETag so the browser
    # cannot send If-Modified-Since (Apache was returning 304, locking in the old cached CSS
    # across logout/relogin). The ?v=filemtime URL still changes per edit for proxy/CDN caches.
    <FilesMatch "\.css$">
        Header set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
        Header set Pragma "no-cache"
        Header set Expires "0"
        Header unset Last-Modified
        Header unset ETag
        # Strip incoming conditional headers so Apache can NEVER answer 304 for CSS — every request
        # gets a full 200 with current bytes, overwriting any stale browser entry.
        RequestHeader unset If-Modified-Since
        RequestHeader unset If-None-Match
    </FilesMatch>
    FileETag None
</IfModule>

# Enable gzip compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>
