<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # ------------------------------------------------------------------
    #  Force HTTPS. Comment this block out if the domain has no
    #  certificate yet, otherwise every request will fail to redirect.
    # ------------------------------------------------------------------
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Handle X-XSRF-Token Header
    RewriteCond %{HTTP:x-xsrf-token} .
    RewriteRule .* - [E=HTTP_X_XSRF_TOKEN:%{HTTP:X-XSRF-Token}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# ----------------------------------------------------------------------
#  Never serve anything that is not a public asset. This is a second line
#  of defence: the document root should already be the public/ directory,
#  so these files should not be reachable at all.
# ----------------------------------------------------------------------
<FilesMatch "^\.|\.(env|sql|bak|old|log|ini|conf|sh|lock|json|md)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Uncomment once the site is confirmed to work entirely over HTTPS:
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# ----------------------------------------------------------------------
#  PHP runtime. On cPanel set the PHP version under "MultiPHP Manager"
#  (PHP 8.3 or newer is required) rather than here.
#
#  The directives below are commented out on purpose: php_value fails with
#  a 500 error on PHP-FPM and LiteSpeed hosts, which is most of them.
#  Set these limits in cPanel -> Select PHP Version -> Options instead.
#
#  <IfModule mod_php.c>
#      php_value upload_max_filesize 32M
#      php_value post_max_size 32M
#      php_value max_execution_time 300
#      php_value memory_limit 512M
#  </IfModule>
# ----------------------------------------------------------------------
