# =============================================================
#  Civitas ERP — Root .htaccess
#  Works for: XAMPP local (http://localhost/Rajpath%20civitas/)
#             and production (https://helixcrm.in/rajpath/)
# =============================================================

# Disable directory browsing
Options -Indexes -MultiViews
ServerSignature Off

# Honor HTTPS / X-Forwarded-Proto if behind a reverse proxy / load balancer
RewriteCond %{HTTP:X-Forwarded-Proto} =https [OR]
RewriteCond %{HTTPS} =on [OR]
RewriteCond %{HTTP:CF-Visitor} '"scheme":"https"' [NC]
RewriteRule ^ - [E=HTTPS:on]

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Subfolder deployments need a RewriteBase.
    # Comment out the next line when serving from web root (e.g. Apache vhost
    # whose DocumentRoot IS this folder).  The local XAMPP path has a space
    # in the folder name so we URL-encode it.
    # RewriteBase /Rajpath%20civitas/
    # RewriteBase /rajpath/

    # ---------------------------------------------------------------
    #  AUTO-FIX: collapse doubled subfolder in the URL.
    #  If the request URL has a doubled subfolder (e.g. /rajpath/rajpath/...)
    #  and the inner one maps to a real file/dir, 301-redirect to the
    #  outer (single-folder) URL.  This handles the "extracted with an
    #  extra wrapping folder" case automatically.
    # ---------------------------------------------------------------
    # The doubled-path pattern matches: /X/X/...
    RewriteCond %{REQUEST_URI} ^/([^/]+)/\1(/.*)?$ [NC]
    RewriteRule ^ /%1%2 [L,R=301,NE]

    # Force HTTPS in production (only if not already secure)
    RewriteCond %{ENV:HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteCond %{HTTP_HOST} ^helixcrm\.in [NC,OR]
    RewriteCond %{HTTP_HOST} ^www\.helixcrm\.in [NC]
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

    # Strip trailing slashes (except real directories)
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Front controller: send everything that isn't a real file/dir to index.php
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

    # Pass Authorization header through to PHP
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

# Fallback when mod_rewrite is unavailable
<IfModule !mod_rewrite.c>
    ErrorDocument 404 index.php
</IfModule>

# =============================================================
#  Security Headers
# =============================================================
<IfModule mod_headers.c>
    # HSTS — uncomment after confirming HTTPS works on production
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

    # Clickjacking / XSS / MIME-type protections
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # Restrict cross-origin (adjust if you load remote scripts)
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Cross-Origin-Resource-Policy "same-origin"
</IfModule>

# =============================================================
#  Compression & Caching
# =============================================================
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE application/xml application/xml+rss
    AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/eot font/otf font/woff font/woff2
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg     "access plus 1 year"
    ExpiresByType image/jpeg    "access plus 1 year"
    ExpiresByType image/png     "access plus 1 year"
    ExpiresByType image/gif     "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/webp    "access plus 1 year"
    ExpiresByType text/css      "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType application/pdf "access plus 1 month"
    ExpiresByType font/woff2    "access plus 1 year"
</IfModule>

# =============================================================
#  Disable access to sensitive files
# =============================================================
<FilesMatch "(^\.env|^\.env\..*|composer\.(json|lock)|package\.json|spark)$">
    Require all denied
</FilesMatch>

# Block access to deployment helper scripts even if uploaded
# (Exception: server-diagnostics-web.php, fix-server.php, and install.php
#  are the browser-accessible diagnostic + fix tools — explicitly allowed
#  so the operator can run them from a browser to debug/fix a broken
#  deployment.  Delete them from the server once the setup is working.)
<FilesMatch "(generate-encryption-key|build-release|server-diagnostics\.php)$">
    Require all denied
</FilesMatch>

<FilesMatch "(server-diagnostics-web|fix-server|install|deploy)\.php$">
    Require all granted
</FilesMatch>
