Options -Indexes
Options -MultiViews

RewriteEngine On

# ── Force HTTPS (uncomment when SSL confirmed) ────────────────────────────────
# RewriteCond %{HTTPS} off
# RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# ── Remove trailing slash ─────────────────────────────────────────────────────
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)/$ /$1 [R=301,L]

# ── Block sensitive directories ───────────────────────────────────────────────
RewriteRule ^(config|core|sql|logs|templates)(/|$) - [F,L]

# ── Block sensitive files by pattern ──────────────────────────────────────────
<FilesMatch "^\.(env|git|htaccess|htpasswd|user\.ini)|(\.(sql|log|bak|backup|swp|old|orig)$)|(^error_log$)|(^composer\.(json|lock)$)|(^package(-lock)?\.json$)">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ── Block direct access to diagnostic/dev files if left behind ────────────────
<FilesMatch "^(check|debug|test|phpinfo|elp-debug|upload-test|process-.*)\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# ── Security headers ──────────────────────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
    # CSP disabled for launch — will re-enable after full audit of inline styles/scripts
    # Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self' mailto: tel:"
    # Hide server signature
    Header unset Server
    Header unset X-Powered-By
</IfModule>

# Hide PHP version
<IfModule mod_php.c>
    php_flag expose_php off
</IfModule>

# ── Static files pass through ─────────────────────────────────────────────────
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# ── Public URL Routes ─────────────────────────────────────────────────────────

# /programs
RewriteRule ^programs/?$                           programs.php [QSA,L]

# /program/slug
RewriteRule ^program/([a-z0-9\-]+)/?$             program.php?slug=$1 [QSA,L]

# /news
RewriteRule ^news/?$                               news.php [QSA,L]

# /news/slug  → article
RewriteRule ^news/([a-z0-9\-]+)/?$                article.php?slug=$1 [QSA,L]

# /article/slug
RewriteRule ^article/([a-z0-9\-]+)/?$             article.php?slug=$1 [QSA,L]

RewriteRule ^staff/([0-9]+)/?$  staff-profile.php?id=$1 [QSA,L]

# /staff
RewriteRule ^staff/?$                              staff.php [QSA,L]

# /gallery
RewriteRule ^gallery/?$                            gallery.php [QSA,L]

# /gallery/album-id
RewriteRule ^gallery/([0-9]+)/?$                   gallery.php?album=$1 [QSA,L]

# /downloads
RewriteRule ^downloads/?$                          downloads.php [QSA,L]

# /contact
RewriteRule ^contact/?$                            contact.php [QSA,L]

# /apply
RewriteRule ^apply/?$                              apply.php [QSA,L]
RewriteRule ^admission/?$                          admission-apply.php [QSA,L]

# /training (landing) + reissue + apply + area drill-down
RewriteRule ^training/?$                           training.php [QSA,L]
RewriteRule ^training/apply/?$                     training-apply.php [QSA,L]
RewriteRule ^training/reissue/?$                   training-reissue.php [QSA,L]
RewriteRule ^training/([a-z0-9\-]+)/?$            training-area.php?slug=$1 [QSA,L]

# /elp (English Language Proficiency)
RewriteRule ^elp/?$                                elp.php [QSA,L]

# /about
RewriteRule ^about/?$                              about.php [QSA,L]

# /page/slug
RewriteRule ^page/([a-z0-9\-]+)/?$                page.php?slug=$1 [QSA,L]

# ── Security Headers ──────────────────────────────────────────────────────────
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options  "nosniff"
    Header always set X-Frame-Options         "SAMEORIGIN"
    Header always set X-XSS-Protection        "1; mode=block"
    Header always set Referrer-Policy         "strict-origin-when-cross-origin"
    Header set Service-Worker-Allowed         "/"

    <Files "sw.js">
        Header set Cache-Control "no-cache, no-store, must-revalidate"
    </Files>
</IfModule>

# ── Compression ───────────────────────────────────────────────────────────────
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css
    AddOutputFilterByType DEFLATE application/javascript application/json
    AddOutputFilterByType DEFLATE image/svg+xml font/woff font/woff2
</IfModule>

# ── Caching ───────────────────────────────────────────────────────────────────
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css                  "access plus 1 year"
    ExpiresByType application/javascript    "access plus 1 year"
    ExpiresByType image/jpeg                "access plus 1 year"
    ExpiresByType image/png                 "access plus 1 year"
    ExpiresByType image/webp                "access plus 1 year"
    ExpiresByType font/woff2                "access plus 1 year"
    ExpiresByType text/html                 "access plus 1 hour"
    ExpiresByType application/manifest+json "access plus 1 day"
</IfModule>

# ── Block PHP execution in uploads ────────────────────────────────────────────
<IfModule mod_rewrite.c>
    RewriteRule ^uploads/.*\.php$ - [F,L]
</IfModule>

# ── Custom error pages ────────────────────────────────────────────────────────
ErrorDocument 404 /404.php
ErrorDocument 403 /404.php

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php82” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php82 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit