# ╔══════════════════════════════════════════════════╗
# ║       NEXPROX — MAIN .htaccess (htdocs root)     ║
# ║  Compatible with InfinityFree / Apache shared    ║
# ╚══════════════════════════════════════════════════╝

Options -Indexes
ServerSignature Off

# ── Block direct access to sensitive files ──
<FilesMatch "\.(json|log|env|php)$">
  # Allow PHP to be executed, but block .json, .log, .env
</FilesMatch>

<FilesMatch "\.(json|log|env\.php|env)$">
  Order Deny,Allow
  Deny from all
</FilesMatch>

# Block direct access to config and helpers
<Files "config.php">
  Order Deny,Allow
  Deny from all
</Files>

# Block direct access to helpers (only included via require_once)
<Files "helpers.php">
  Order Deny,Allow
  Deny from all
</Files>

# ── Rewrite Rules ──
RewriteEngine On

# Force HTTPS on InfinityFree (comment out for local dev)
# RewriteCond %{HTTPS} off
# RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Route old Node.js API URLs to PHP equivalents
# /api/login              → /api/login.php
# /api/auth/request-access → /api/request-access.php
# /api/audit              → /api/audit.php
# /api/proxy/check        → /api/proxy-check.php
# /api/ip                 → /api/ip.php
# /api/connect            → /api/connect.php
# /api/disconnect         → /api/disconnect.php

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule ^api/login$                api/login.php              [L,QSA]
RewriteRule ^api/auth/request-access$  api/request-access.php     [L,QSA]
RewriteRule ^api/audit$                api/audit.php               [L,QSA]
RewriteRule ^api/proxy/check$          api/proxy-check.php         [L,QSA]
RewriteRule ^api/ip$                   api/ip.php                  [L,QSA]
RewriteRule ^api/connect$              api/connect.php             [L,QSA]
RewriteRule ^api/disconnect$           api/disconnect.php          [L,QSA]

# Default to index.html for SPA-style routing
RewriteRule ^$ index.html [L]

# ── Security headers (Apache mod_headers) ──
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "no-referrer"
  Header always set Permissions-Policy "geolocation=(), microphone=()"
</IfModule>

# ── GZIP compression ──
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# ── Browser caching ──
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 1 day"
  ExpiresByType application/javascript "access plus 1 day"
  ExpiresByType application/json "access plus 0 seconds"
  ExpiresByType image/png "access plus 7 days"
  ExpiresByType image/jpeg "access plus 7 days"
  ExpiresByType image/gif "access plus 7 days"
  ExpiresByType image/svg+xml "access plus 7 days"
</IfModule>
