# ============================================
# Laravel .htaccess - Progressive Version
# Test each section one by one
# ============================================

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # ============================================
    # 1. BASIC LARAVEL ROUTING (Always needed)
    # ============================================
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

    # ============================================
    # 2. AUTHORIZATION HEADER (Uncomment if needed for API)
    # ============================================
    # RewriteCond %{HTTP:Authorization} .
    # RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # ============================================
    # 3. TRAILING SLASH REMOVAL (Uncomment for SEO)
    # ============================================
    # RewriteCond %{REQUEST_FILENAME} !-d
    # RewriteCond %{REQUEST_URI} (.+)/$
    # RewriteRule ^ %1 [L,R=301]

    # ============================================
    # 4. FORCE HTTPS (Uncomment when SSL is ready)
    # ============================================
    # RewriteCond %{HTTPS} off
    # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # ============================================
    # 5. FORCE NON-WWW (Uncomment if needed)
    # ============================================
    # RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
    # RewriteRule ^(.*)$ https://%1/$1 [R=301,L]
</IfModule>

# ============================================
# SECURITY & PERFORMANCE
# ============================================

# Disable directory browsing
Options -Indexes

# UTF-8 Encoding
AddDefaultCharset UTF-8

# Protect sensitive files
<Files .env>
    Order allow,deny
    Deny from all
</Files>

# ============================================
# CACHING (Uncomment if mod_expires is available)
# ============================================
# <IfModule mod_expires.c>
#     ExpiresActive On
#     ExpiresByType image/jpeg "access plus 1 year"
#     ExpiresByType image/png "access plus 1 year"
#     ExpiresByType image/gif "access plus 1 year"
#     ExpiresByType image/webp "access plus 1 year"
#     ExpiresByType text/css "access plus 1 month"
#     ExpiresByType text/javascript "access plus 1 month"
#     ExpiresByType application/javascript "access plus 1 month"
# </IfModule>

# ============================================
# GZIP COMPRESSION (Uncomment if mod_deflate is available)
# ============================================
# <IfModule mod_deflate.c>
#     AddOutputFilterByType DEFLATE text/plain
#     AddOutputFilterByType DEFLATE text/html
#     AddOutputFilterByType DEFLATE text/css
#     AddOutputFilterByType DEFLATE text/javascript
#     AddOutputFilterByType DEFLATE application/javascript
#     AddOutputFilterByType DEFLATE application/json
# </IfModule>

# ============================================
# SECURITY HEADERS (Uncomment if mod_headers is available)
# ============================================
# <IfModule mod_headers.c>
#     Header always set X-Frame-Options "SAMEORIGIN"
#     Header always set X-XSS-Protection "1; mode=block"
#     Header always set X-Content-Type-Options "nosniff"
#     Header unset X-Powered-By
# </IfModule>