# Suprematist Gen: Apache / cPanel configuration for a single-page app.
# Vite copies this file into dist/ on every build; upload it together with
# index.html (it is a hidden "dot" file, so enable "Show Hidden Files" in the
# cPanel File Manager to see it).

Options -Indexes
DirectoryIndex index.html

# ─── SPA routing ──────────────────────────────────────────────────────────
# Every URL that is not a real file or folder (e.g. /dashboard, /design/<id>)
# is served by index.html, so refreshing or opening a deep link works.
<IfModule mod_rewrite.c>
  RewriteEngine On
  # If the app lives in a sub-folder (e.g. https://domain.com/suprematist/),
  # change this to: RewriteBase /suprematist/
  RewriteBase /

  # Optional: force HTTPS (uncomment once an SSL certificate is installed,
  # e.g. AutoSSL / Let's Encrypt in cPanel).
  # RewriteCond %{HTTPS} !=on
  # RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  RewriteRule ^index\.html$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  # Missing static files (e.g. an old /assets/*.js after a redeploy) must stay
  # 404 instead of returning HTML, which would break the page with a MIME error.
  RewriteCond %{REQUEST_URI} !\.(js|mjs|css|map|png|jpe?g|gif|webp|svg|ico|woff2?|ttf|otf|json|txt|xml)$ [NC]
  RewriteRule . index.html [L]
</IfModule>

# ─── MIME types ───────────────────────────────────────────────────────────
<IfModule mod_mime.c>
  AddType application/javascript .js .mjs
  AddType text/css .css
  AddType image/webp .webp
  AddType image/svg+xml .svg
  AddType font/woff2 .woff2
  AddType font/woff .woff
  AddType font/ttf .ttf
  AddType font/otf .otf
  AddType application/manifest+json .webmanifest
</IfModule>

# ─── Compression ──────────────────────────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
  AddOutputFilterByType DEFLATE application/javascript application/json
  AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/otf
</IfModule>

# ─── Caching ──────────────────────────────────────────────────────────────
# Files in /assets have a content hash in their name, so they can be cached
# for a year. index.html must always be revalidated so a new deploy is
# picked up immediately.
<IfModule mod_headers.c>
  <FilesMatch "\.(js|mjs|css|woff2?|ttf|otf)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
  <FilesMatch "\.(png|jpe?g|gif|webp|svg|ico)$">
    Header set Cache-Control "public, max-age=604800"
  </FilesMatch>
  <FilesMatch "(^index\.html$|\.html$)">
    Header set Cache-Control "no-cache, no-store, must-revalidate"
    Header set Pragma "no-cache"
    Header set Expires "0"
  </FilesMatch>

  # Basic security headers
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# ─── Protect stray files ──────────────────────────────────────────────────
<FilesMatch "^(\.env.*|.*\.(log|bak|map\.bak|sql))$">
  Require all denied
</FilesMatch>
