# VANT CMS — Apache rewrite rules (XAMPP / Hostinger / shared hosting)
DirectoryIndex serve.php index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block direct web access to PHP backend source
  RewriteRule ^backend(/|$) - [F,L]

  # API → PHP (must run before SPA fallback)
  RewriteRule ^api(?:/(.*))?$ api/index.php [L,QSA]

  # Homepage / index.html must go through SEO shell (never raw index.html defaults)
  RewriteRule ^index\.html$ serve.php [L,QSA]
  RewriteRule ^$ serve.php [L,QSA]

  # Serve real files and folders (assets, uploads, etc.) — except index.html
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteCond %{REQUEST_URI} !index\.html$ [NC]
  RewriteRule ^ - [L]

  # SPA fallback — inject SEO meta server-side
  RewriteRule ^ serve.php [L]
</IfModule>

# Block one-time setup utilities if accidentally left on production
<FilesMatch "^(install|create-admin|clear-activity|check)\.php$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
</FilesMatch>

<IfModule mod_mime.c>
  AddType application/javascript .js
  AddType text/css .css
  AddType application/webp .webp
  AddType image/jpeg .jpg .jpeg
  AddType image/png .png
  AddType image/gif .gif
</IfModule>

# API responses must never be cached (stale CMS content)
<IfModule mod_headers.c>
  SetEnvIf Request_URI "/api(/|$)" IS_API
  Header set Cache-Control "no-store, no-cache, must-revalidate" env=IS_API
  Header set Pragma "no-cache" env=IS_API
  Header set Expires "0" env=IS_API

  # SPA shell — always revalidate so deploys are picked up
  <FilesMatch "^index\.html$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>

  # Fingerprinted build assets — safe to cache long-term
  <FilesMatch "\.(js|css|woff2?|png|jpg|jpeg|webp|gif|svg|ico)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
</IfModule>
