<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>
    RewriteEngine On
    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]
    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

    # cors
    # Header set Access-Control-Allow-Origin "*"
</IfModule>

#<IfModule mod_headers.c>
#    Header set Access-Control-Allow-Origin "*"
#</IfModule>

# Compress text responses. CSS/JS ship ~5MB uncompressed across the panel.
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript text/javascript
    AddOutputFilterByType DEFLATE application/json application/xml application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml application/vnd.ms-fontobject
    AddOutputFilterByType DEFLATE font/ttf font/otf font/woff font/woff2 application/font-woff
    # Legacy proxies mis-cache negotiated content
    <IfModule mod_headers.c>
        Header append Vary Accept-Encoding
    </IfModule>
</IfModule>

<IfModule mod_brotli.c>
    AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css
    AddOutputFilterByType BROTLI_COMPRESS application/javascript application/x-javascript text/javascript
    AddOutputFilterByType BROTLI_COMPRESS application/json application/xml image/svg+xml
</IfModule>

# Far-future caching for fingerprinted static assets. dynamicAsset() appends an
# mtime ?v= token, so a changed file gets a new URL and this never serves stale
# code. HTML is deliberately excluded — it carries the asset URLs.
<IfModule mod_expires.c>
    ExpiresActive On
    # Deliberately no ExpiresDefault: it would also cache JSON/AJAX responses.
    # Only the fingerprinted types below get an expiry.
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType application/x-javascript "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"

    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"

    ExpiresByType font/ttf "access plus 1 year"
    ExpiresByType font/otf "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType application/vnd.ms-fontobject "access plus 1 year"

    ExpiresByType text/html "access plus 0 seconds"
</IfModule>

<IfModule mod_headers.c>
    # immutable stops browsers revalidating a fingerprinted URL at all
    <FilesMatch "\.(css|js|png|jpe?g|gif|webp|svg|ico|ttf|otf|woff2?|eot)$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
    # Never cache the HTML itself, or a deploy's new asset URLs stay invisible.
    <FilesMatch "\.(php)$">
        Header set Cache-Control "no-cache, private"
    </FilesMatch>
</IfModule>

# Hide a specific file
<Files .env>
    Order allow,deny
    Deny from all
</Files>
