<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # ---- Flat web-root layout additions ----
    # The project root IS the document root (cPanel-style), so the framework
    # directories sit next to the front controller and must be blocked by hand.

    # Force HTTPS in production only.
    #
    # Development hosts are exempt, or http://localhost/school-website/ would
    # redirect into a TLS endpoint XAMPP is not serving. Private LAN addresses
    # (RFC 1918) are exempt for the same reason and one more: testing the site
    # on a real phone means reaching this machine at 192.168.x.x, and forcing
    # that to HTTPS lands the phone on XAMPP's self-signed certificate and a
    # full-page security warning.
    #
    # A private address is by definition not a public production host, so
    # nothing here weakens the live site.
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP_HOST} !^localhost [NC]
    RewriteCond %{HTTP_HOST} !^127\.0\.0\.1 [NC]
    RewriteCond %{HTTP_HOST} !^192\.168\. [NC]
    RewriteCond %{HTTP_HOST} !^10\. [NC]
    RewriteCond %{HTTP_HOST} !^172\.(1[6-9]|2[0-9]|3[01])\. [NC]
    RewriteCond %{HTTP_HOST} !\.(test|local|localhost)$ [NC]
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Block direct access to sensitive files
    RewriteRule ^\.env - [F,L]
    RewriteRule ^(composer\.(json|lock)|artisan|package(-lock)?\.json|vite\.config\.js|phpunit\.xml|sync-build\.mjs)$ - [F,L]

    # Block direct access to framework folders (never served to browsers)
    RewriteRule ^(app|bootstrap|config|database|resources|routes|tests|node_modules)(/|$) - [F,L]
    RewriteRule ^storage/(framework|logs|app/private)(/|$) - [F,L]
    RewriteRule ^vendor/(?!tinymce/) - [F,L]

    # Design-reference screenshots are working material, not public assets.
    RewriteRule ^(sample-hotel-webpages|sample-webpages|sample-images)(/|$) - [F,L]

    # Serve uploaded files: /storage/... -> storage/app/public/...
    # Replaces `artisan storage:link`, which needs symlink rights this layout
    # (and most shared hosting) does not reliably have.
    RewriteRule ^storage/(?!app/public/)(.*)$ storage/app/public/$1 [L]

    # ---- End flat web-root additions ----

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# ---------------------------------------------------------------------------
# Compression.
#
# The public stylesheet is over half a megabyte and render-blocking, and none
# of it was being compressed. Text compresses by roughly 80%, so this is the
# single largest saving available anywhere on the site and it costs nothing.
#
# Images, fonts and video are deliberately absent: they are already compressed,
# and running them through DEFLATE spends CPU to make them very slightly
# larger.
# ---------------------------------------------------------------------------
<IfModule mod_deflate.c>
    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
        AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript
        AddOutputFilterByType DEFLATE application/json application/ld+json
        AddOutputFilterByType DEFLATE application/xml application/rss+xml image/svg+xml
        AddOutputFilterByType DEFLATE application/manifest+json
    </IfModule>
</IfModule>

# ---------------------------------------------------------------------------
# Caching.
#
# Built assets carry a content hash in their filename (app-Bm4Yui5D.css), so a
# changed file is a different URL and can be cached for a year without any risk
# of serving a stale one.
#
# Uploads have no hash, so a month: long enough to matter, short enough that
# replacing a photograph under the same name is not permanent.
#
# HTML is never cached. It is the document that names the current asset URLs,
# and a stale copy would point at files that no longer exist.
# ---------------------------------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"

    ExpiresByType text/html "access plus 0 seconds"
    ExpiresByType application/json "access plus 0 seconds"
    ExpiresByType application/ld+json "access plus 0 seconds"

    ExpiresByType text/css "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"

    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 month"

    # The service worker must be revalidated every time, or a bad one is
    # cached and the site cannot be updated for its users.
    ExpiresByType application/manifest+json "access plus 0 seconds"
</IfModule>

<IfModule mod_headers.c>
    # Hashed build output is immutable by construction.
    <FilesMatch "\.(css|js|woff2?)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>

    <FilesMatch "(service-worker\.js|manifest\.webmanifest)$">
        Header set Cache-Control "no-cache, must-revalidate"
    </FilesMatch>
</IfModule>

# ---------------------------------------------------------------------------
# PRODUCTION (cPanel) ONLY - do not enable on XAMPP.
# cPanel writes this block itself to pin the PHP version. Locally it would
# hand .php files to a handler Apache does not have, and the browser would
# download the source instead of executing it.
#
# <IfModule mime_module>
#   AddHandler application/x-httpd-ea-php83 .php .php8 .phtml
# </IfModule>
# ---------------------------------------------------------------------------
