# ====================================================================
# TAMASYA GARDEN HOTEL - PRODUCTION WEB SERVER CONFIGURATION (.HTACCESS)
# Place this file in the root of your public_html or hosting directory
# ====================================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Preserve Bearer authentication on Apache/LiteSpeed/FastCGI shared hosting.
    # Without this, login can succeed but every protected request arrives at PHP
    # without HTTP_AUTHORIZATION and the frontend falls back to stale offline data.
    RewriteCond %{HTTP:Authorization} ^(.+)$
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
    SetEnvIf Authorization "(.+)" HTTP_AUTHORIZATION=$1

    # 1. Force HTTPS Redirection (proxy/Cloudflare aware)
    # Avoid redirect loops when SSL terminates at a reverse proxy.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Block direct access to identity uploads. Files are served only through authenticated API endpoints.
    RewriteRule ^uploads(?:/|$) - [F,L]

    # 2. API Route Redirection: Redirects api/something to api.php?action=something relative to the current directory
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^api/(.*)$ api.php?action=$1 [QSA,L]

    # 3. React Single Page App (SPA) Router Fallback:
    # Ensures reloading pages works without 404 errors by routing non-file/non-api requests to index.html
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} !/api/
    RewriteRule . index.html [L]
</IfModule>

# 3. Prevent browser and server caching for index.html (SPA entry)
# This forces the browser to always load the latest React bundle after you upload changes
<IfModule mod_headers.c>
    <FilesMatch "index\.html$">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
        Header set Pragma "no-cache"
        Header set Expires 0
    </FilesMatch>
</IfModule>

# Enable gzip compression for faster load times on shared hosting
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
</IfModule>

# 4. Security Headers (HTTPS SSL, Clickjacking, MIME, XSS)
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header set Permissions-Policy "camera=(self), microphone=(), geolocation=(self), payment=(), usb=()"
    Header set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'"
</IfModule>

# Block direct browser access to the maintenance/backup cron.
# Run it from hosting cron/CLI instead: php /path/to/maintenance_cron.php
<Files "maintenance_cron.php">
    Require all denied
</Files>
<Files "staging_preflight.php">
    Require all denied
</Files>
<Files "database_maintenance_web.php">
    Require all denied
</Files>

# Block source/configuration artifacts and legacy credential files.
<FilesMatch "^(?:(?:db_credentials(?:\.example)?|tamasya_db_credentials)\.php|\.env(?:\..*)?|database_setup\.sql|package(?:-lock)?\.json|bun\.lock|tsconfig\.json|vite\.config\.ts|server\.ts|dev-with-php\.mjs)$">
    Require all denied
</FilesMatch>

# Prevent directory listings on shared hosting.
Options -Indexes

# RC4.8 database bootstrap internals are server-side only.
<FilesMatch "^(?:database_bootstrap|runtime_crypto|runtime_web_helpers)\.php$">
    Require all denied
</FilesMatch>
<Files ".database_setup_key.php">
    Require all denied
</Files>

# Node sync internals are CLI/include-only and must never be downloaded or run via HTTP.
<FilesMatch "^(node_sync_agent|node_sync_support)\.php$">
    Require all denied
</FilesMatch>
