# ==============================================================================
# BroTools — cPanel Apache Configuration (.htaccess)
# ==============================================================================

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # 1. Force HTTPS
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # 2. Don't rewrite existing files or directories
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # 3. Exclude /api routes from React SPA rewrite so cPanel / Passenger handles backend API calls
  RewriteCond %{REQUEST_URI} ^/api [NC]
  RewriteRule ^ - [L]

  # 4. Route all client-side paths to index.html for React SPA
  RewriteRule ^ index.html [L]
</IfModule>

# ── MIME Types ────────────────────────────────────────────────────────
<IfModule mod_mime.c>
  AddType image/svg+xml .svg .svgz
  AddType application/manifest+json .webmanifest
  AddType application/xml .xml
  AddType application/json .json
</IfModule>

# ── Security Headers ──────────────────────────────────────────────────
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ── GZIP / Brotli Compression ─────────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
  AddOutputFilterByType DEFLATE application/javascript application/json
  AddOutputFilterByType DEFLATE application/x-javascript application/xml
  AddOutputFilterByType DEFLATE image/svg+xml application/manifest+json
</IfModule>

# ── Browser Caching ───────────────────────────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType application/json "access plus 0 seconds"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
</IfModule>
