# Enable rewrite engine
RewriteEngine On

# ============================================
# CORS HEADERS FOR API ACCESS - REMOVED (handled by nginx)
# ============================================
# Delete or comment out these lines:
# SetEnvIf Origin "^https://(client|delivery)\.crookjunk\.in$" ALLOWED_ORIGIN=$0
# Header set Access-Control-Allow-Origin "%{ALLOWED_ORIGIN}e" env=ALLOWED_ORIGIN
# Header set Access-Control-Allow-Methods "GET, POST, OPTIONS" "env=ALLOWED_ORIGIN"
# Header set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With" "env=ALLOWED_ORIGIN"
# Header set Access-Control-Allow-Credentials "true" "env=ALLOWED_ORIGIN"
# 
# # Handle preflight OPTIONS requests for API
# RewriteCond %{REQUEST_METHOD} OPTIONS
# RewriteRule ^uapi/(.*)$ - [R=200,L]

# ============================================
# SECURITY HEADERS & CONTENT SECURITY POLICY
# ============================================

# Security Headers - Keep these
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# SIMPLE Content Security Policy - Single line version
# this is for razorpay test
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://checkout.razorpay.com https://cdn.razorpay.com https://code.jquery.com https://js.stripe.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src 'self' data: https: http:; font-src 'self' data: https://fonts.gstatic.com; frame-src 'self' https://checkout.razorpay.com https://api.razorpay.com; connect-src 'self' https://checkout.razorpay.com https://api.razorpay.com https://lumberjack.razorpay.com https://cdn.jsdelivr.net;"
# ============================================
# HTTPS REDIRECTION (UNCOMMENT WHEN READY)
# ============================================

# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ============================================
# FILE ACCESS RESTRICTIONS
# ============================================

# Prevent access to sensitive files
<Files "*.log">
    Require all denied
</Files>

<Files "*.sql">
    Require all denied
</Files>

<Files "*.bak">
    Require all denied
</Files>

<Files "*.backup">
    Require all denied
</Files>

<Files "migrate_passwords.php">
    Require all denied
</Files>

<Files "security_config.php">
    Require all denied
</Files>

# Block access to error logs
<Files "error_log">
    Require all denied
</Files>

# Block access to configuration files
<FilesMatch "^(milkprams|config|database|db|\.ht)\.(php|ini|conf|passwd)$">
    Require all denied
</FilesMatch>

# ============================================
# DIRECTORY PROTECTIONS
# ============================================

# Prevent directory listing
Options -Indexes

# Set default index file
DirectoryIndex index.php index.html

# Block access to hidden files (starting with .)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# ============================================
# URL REWRITING & ACCESS RULES
# ============================================

# Block access to backup and source files
RewriteRule \.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist|old|orig|save|swo|htm|html|shtml|bkp|dat|sql|tar|gz|tgz|zip|rar|7z|cgi|pl|py|jsp|asp)$ - [F,L]

# Block access to sensitive directories
RewriteRule ^(include|config|backup|logs|temp|tmp|vendor|node_modules)/ - [F,L]

# Prevent access to PHP files in upload directories
RewriteRule ^(product|banner|category|subcategory|city|collection|coupon|setting)/.*\.php$ - [F,L]

# Allow only specific file types in upload directories
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^product/.+\.(php|php3|php4|php5|phtml|pl|py|jsp|asp|sh|cgi)$ - [F,L]

# Allow image files in product directory
RewriteRule ^product/.+\.(jpg|jpeg|png|gif|webp|svg|bmp|ico)$ - [L]

# Allow access to API endpoints and payment gateways
RewriteRule ^rapi/.+\.php$ - [L]
RewriteRule ^rapi/$ - [L]
RewriteRule ^rapi$ - [L]
RewriteRule ^stripe/.+\.php$ - [L]
RewriteRule ^paypal/.+\.php$ - [L]
RewriteRule ^payment/razorpay/.+\.php$ - [L]
RewriteRule ^payment/razorpay/$ - [L]

# ============================================
# PERFORMANCE OPTIMIZATIONS
# ============================================

# Set default character set
AddDefaultCharset UTF-8

# Enable compression
<IfModule mod_deflate.c>
    # Compress HTML, CSS, JavaScript, Text, XML and fonts
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE application/x-font-ttf
    AddOutputFilterByType DEFLATE application/x-font-opentype
    AddOutputFilterByType DEFLATE font/opentype
    AddOutputFilterByType DEFLATE font/otf
    AddOutputFilterByType DEFLATE font/ttf
</IfModule>

# ============================================
# ERROR PAGES
# ============================================

# ErrorDocument 400 /error/400.html
# ErrorDocument 401 /error/401.html
# ErrorDocument 403 /error/403.html
# ErrorDocument 404 /error/404.html
# ErrorDocument 500 /error/500.html

# ============================================
# PHP SETTINGS (if applicable)
# ============================================

# Force PHP execution
AddHandler application/x-httpd-php .php

# ============================================
# FALLBACK ROUTING FOR FRONT CONTROLLER
# ============================================

# If the requested file is not a real file, route to index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [QSA,L]