#RewriteOptions inherit

# Disable directory listing
Options -Indexes

# Block access to .env and other dotfiles
<FilesMatch "^\.">
    Order allow,deny
    Deny from all
</FilesMatch>

# Allow .htaccess itself to be processed by Apache
<Files ".htaccess">
    Order allow,deny
    Allow from all
</Files>

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block access to sensitive directories (DocumentRoot is project root)
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|tests|vendor)(/|$) - [F,L]
    RewriteRule ^(artisan|composer\.(json|lock)|package\.json|phpunit\.xml|webpack\.mix\.js)$ - [F,L]

    # Redirect bare root to /en (force HTTPS + www + /en in one hop)
    RewriteCond %{HTTPS} off [OR]
    RewriteCond %{HTTP_HOST} !^www\. [NC]
    RewriteRule ^$ https://www.gulfdrug.com/en [R=301,L]

    # Redirect root on canonical domain to /en
    RewriteRule ^$ https://www.gulfdrug.com/en [R=301,L]

    # Force HTTPS + www for all other paths in one hop
    RewriteCond %{HTTPS} off [OR]
    RewriteCond %{HTTP_HOST} !^www\. [NC]
    RewriteRule ^(.*)$ https://www.gulfdrug.com/$1 [R=301,L,NE]

    # Laravel front controller fallback
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>



# Enable Compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
    AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript
    AddOutputFilterByType DEFLATE application/json application/vnd.ms-fontobject
    AddOutputFilterByType DEFLATE application/x-font-ttf font/opentype
    AddOutputFilterByType DEFLATE image/svg+xml image/x-icon
</IfModule>

# GZIP Compression
<IfModule mod_gzip.c>
    mod_gzip_on Yes
    mod_gzip_dechunk Yes
    mod_gzip_item_include file .(html?|txt|css|js|php|pl)$
    mod_gzip_item_include handler ^cgi-script$
    mod_gzip_item_include mime ^text/.*
    mod_gzip_item_include mime ^application/x-javascript.*
    mod_gzip_item_exclude mime ^image/.*
    mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</IfModule>

# Leverage Browser Caching
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType text/html "access plus 1 month"
    ExpiresByType application/pdf "access plus 1 month"
    ExpiresByType text/x-javascript "access plus 1 month"
    ExpiresByType application/x-shockwave-flash "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresDefault "access plus 1 month"
</IfModule>

# Security Headers
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# Cache Control
<IfModule mod_headers.c>
    <FilesMatch "\.(ico|flv|jpg|jpeg|png|gif|css|swf)$">
        Header set Cache-Control "max-age=2678400, public"
    </FilesMatch>
    # <FilesMatch "\.(html|htm)$">
    #     Header set Cache-Control "max-age=7200, private, must-revalidate"
    # </FilesMatch>
    <FilesMatch "\.(pdf)$">
        Header set Cache-Control "max-age=86400, public"
    </FilesMatch>
    <FilesMatch "\.(js)$">
        Header set Cache-Control "max-age=2678400, private"
    </FilesMatch>
</IfModule>