# ==============================================================================
# 1. REWRITE ENGINE & URL ROUTING
# ==============================================================================
<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # # 1. Force https + www
    # RewriteCond %{HTTPS} off [OR]
    # RewriteCond %{HTTP_HOST} !^www\. [NC]
    # RewriteCond %{THE_REQUEST} \s/+(.*?)\s [NC]
    # RewriteRule ^ https://www.APP_DOMAIN/%1 [R=301,L]
    
    # # 2. Serve real files/folders as-is (css, js, images...)
    # RewriteCond %{REQUEST_FILENAME} -f [OR]
    # RewriteCond %{REQUEST_FILENAME} -d
    # RewriteRule ^ - [L]
    
    # # 3. Everything else -> Laravel front controller
    # RewriteRule ^ index.php [L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# Force UTF-8 Encoding globally
<IfModule mod_mime.c>
    AddDefaultCharset UTF-8
</IfModule>

# ==============================================================================
# 2. ACCESS CONTROL & SECURITY RULES
# ==============================================================================

# Block common web shell / malware script filenames (Case-Insensitive)
<FilesMatch "(?i)(shell|cmd|wso|gecko|mini|backdoor|c99|r57)\.php$">
    Require all denied
</FilesMatch>

# Block access to sensitive dotfiles (.env, .git, .htaccess, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# ==============================================================================
# 3. GZIP COMPRESSION (mod_deflate)
# ==============================================================================
<IfModule mod_deflate.c>
    # Compress text, html, javascript, css, xml, json
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE application/ld+json
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE image/x-icon
    AddOutputFilterByType DEFLATE font/opentype
    AddOutputFilterByType DEFLATE font/ttf
    AddOutputFilterByType DEFLATE font/eot
    AddOutputFilterByType DEFLATE font/otf

    # Don't compress already compressed binary media
    SetEnvIfNoCase REQUEST_URI \.(?:gif|jpg|jpeg|png|webp|woff2|mp4)$ no-gzip dont-vary
</IfModule>

# ==============================================================================
# 4. EXPIRES TIMINGS (mod_expires)
# ==============================================================================
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"

    # Web Fonts
    ExpiresByType font/woff2                    "access plus 1 year"
    ExpiresByType font/woff                     "access plus 1 year"
    ExpiresByType application/font-woff2        "access plus 1 year"
    ExpiresByType application/x-font-woff       "access plus 1 year"

    # CSS and JavaScript
    ExpiresByType text/css                      "access plus 1 year"
    ExpiresByType application/javascript        "access plus 1 year"
    ExpiresByType text/javascript               "access plus 1 year"

    # Images & Media
    ExpiresByType image/png                     "access plus 1 year"
    ExpiresByType image/jpeg                    "access plus 1 year"
    ExpiresByType image/gif                     "access plus 1 year"
    ExpiresByType image/svg+xml                 "access plus 1 year"
    ExpiresByType image/webp                    "access plus 1 year"
    ExpiresByType image/x-icon                  "access plus 1 year"
</IfModule>

# ==============================================================================
# 5. HTTP HEADERS & CACHE-CONTROL (mod_headers)
# ==============================================================================
<IfModule mod_headers.c>
    # 1. Public LLM Context & Markdown Files
    <FilesMatch "(?i)\.(txt|md)$">
        Header set Access-Control-Allow-Origin "*"
        Header set Cache-Control "max-age=86400, public"
        Header set Content-Type "text/plain; charset=utf-8"
    </FilesMatch>
    
    # 2. Public JSON Assets & Manifests
    <FilesMatch "(?i)\.json$">
        Header set Access-Control-Allow-Origin "*"
        Header set Cache-Control "max-age=86400, public"
        Header set Content-Type "application/json; charset=utf-8"
    </FilesMatch>

    # 3. Dynamic PDF Documents
    <FilesMatch "(?i)\.pdf$">
        Header set Cache-Control "max-age=2592000, public"
    </FilesMatch>

    # 4. Global Static Assets (Fonts, CSS, JS, Media): 1 Year Immutable Cache
    <FilesMatch "(?i)\.(css|js|woff2|woff|eot|ttf|otf|flv|gif|ico|jpg|jpeg|mp4|mpeg|png|svg|swf|webp)$">
        Header set Cache-Control "max-age=31536000, public, immutable"
    </FilesMatch>

    # 5. Ensure proxies don't serve uncompressed resources to devices that support Gzip
    Header append Vary User-Agent env=!dont-vary
</IfModule>