<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Apache does not know these types by default. Without the manifest type the
# browser refuses the install prompt, and the PWA is not installable at all.
<IfModule mod_mime.c>
    AddType application/manifest+json .webmanifest
    AddType application/javascript .js
    AddType image/svg+xml .svg
    AddType font/woff2 .woff2
</IfModule>

<IfModule mod_headers.c>
    # Long-lived caching for build output only. Vite fingerprints these names,
    # so a new deploy produces new URLs and never serves a stale bundle.
    <FilesMatch "\.(css|js|woff2?|png|jpg|jpeg|svg|webp|ico)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>

    # The service worker and the manifest MUST come after the rule above so
    # they win. A cached service worker would pin the app to an old release.
    <FilesMatch "^(sw|offline)\.(js|html)$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Service-Worker-Allowed "/"
    </FilesMatch>

    <FilesMatch "\.webmanifest$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>

    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), payment=(), usb=()"

    # Never leak the PHP version.
    Header always unset X-Powered-By
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/plain application/javascript application/json application/manifest+json image/svg+xml
</IfModule>

# Never expose dotfiles.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
