# === CORS HEADERS ===
<IfModule mod_headers.c>
    SetEnvIf Origin "^(https://felicitysolar\.ng|https://www\.felicitysolar\.ng|http://localhost:3000)$" ORIGIN_OK=$0
    Header always set Access-Control-Allow-Origin "%{ORIGIN_OK}e" env=ORIGIN_OK
    Header always set Access-Control-Allow-Credentials "true"
    Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
    Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
    Header always set Vary "Origin"
</IfModule>

# === SECURITY HEADERS ===
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# === MOD_SECURITY EXCEPTIONS FOR BLOG ENDPOINTS ===
# Blog endpoints need to accept HTML with img tags - PHP validation will sanitize
# SecRuleEngine Off is acceptable here because:
# 1. PHP-level validation is comprehensive (validateBlogContent method)
# 2. Only affects /api/blogs endpoints (other endpoints remain protected)
# 3. Images restricted to Cloudinary only via CSP + PHP validation
# 4. XSS, script injection, dangerous protocols all blocked at PHP level
<IfModule mod_security.c>
    <LocationMatch "^/api/blogs">
        SecRuleEngine Off
    </LocationMatch>
    <LocationMatch "^/api/upload-blog-image">
        SecRuleEngine Off
    </LocationMatch>
</IfModule>

# === CONTENT SECURITY POLICY ===
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; img-src 'self' https://res.cloudinary.com; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self';"
</IfModule>

# === URL REWRITING ===
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Allow direct access to existing files and directories
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d

    # Route everything else to index.php
    RewriteRule ^ index.php [QSA,L]
</IfModule>

# === FILE TYPE RESTRICTIONS ===
<FilesMatch "\.(env|json|lock|log|md)$">
    <IfModule mod_headers.c>
        Header set Content-Type "text/plain"
    </IfModule>
    Deny from all
</FilesMatch>
