# ==================================================================
# ASCENDANT ENTERPRISE — Apache configuration
# Written for a standard cPanel / shared-hosting Apache setup.
# Every block is individually guarded, so a host missing a module
# degrades gracefully instead of throwing a 500.
# ==================================================================

Options -Indexes -MultiViews
DirectoryIndex index.php index.html

# ------------------------------------------------------------------
# 1. CLEAN URLS
# ------------------------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On
  # RewriteBase /            # uncomment and adjust if the site lives in a subfolder

  # --- Force HTTPS (leave commented until your certificate is live) ---
  # RewriteCond %{HTTPS} !=on
  # RewriteCond %{HTTP:X-Forwarded-Proto} !https
  # RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

  # --- Canonical host: send the bare domain to www (or reverse it) ---
  # RewriteCond %{HTTP_HOST} ^ascendantenterprise\.com [NC]
  # RewriteRule ^(.*)$ https://www.ascendantenterprise.com/$1 [R=301,L]

  # --- Strip a trailing slash from non-directories ---
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} ^(.+)/$
  RewriteRule ^ %1 [R=301,L]

  # --- Never expose the .php extension: /about.php -> /about (301) ---
  RewriteCond %{THE_REQUEST} \s/+(.*?)\.php[\s?] [NC]
  RewriteRule ^ /%1 [R=301,L,NE]

  # --- Gemstone pages: /gemstones/ruby -> /gemstones/ruby.php ---
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^gemstones/([a-z0-9-]+)/?$ gemstones/$1.php [L,QSA]

  # --- Everything else: /about -> /about.php ---
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_FILENAME}\.php -f
  RewriteRule ^(.+)$ $1.php [L,QSA]

  # --- Dynamic sitemap ---
  RewriteRule ^sitemap\.xml$ sitemap.php [L]
</IfModule>

# ------------------------------------------------------------------
# 2. PROTECT SENSITIVE PATHS
# ------------------------------------------------------------------

# Config, data, includes and templates are never requested directly.
RedirectMatch 404 ^/(config|includes|templates|data|logs)/.*$

# Dotfiles, backups, SQL dumps, logs, composer manifests, READMEs.
<FilesMatch "(^\.|\.(env|ini|log|sql|sh|bak|old|orig|dist|md|json|lock|yml|yaml)$|^composer\.)">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# Allow the few dot/JSON files that MUST stay public.
<FilesMatch "^(robots\.txt|sitemap\.xml|site\.webmanifest)$">
  <IfModule mod_authz_core.c>
    Require all granted
  </IfModule>
</FilesMatch>

# ------------------------------------------------------------------
# 3. SECURITY HEADERS
# (functions.php also sets these; belt and braces for static files.)
# ------------------------------------------------------------------
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
  # Enable once the whole site is on HTTPS:
  # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header unset X-Powered-By
  Header always unset X-Powered-By
</IfModule>

# ------------------------------------------------------------------
# 4. COMPRESSION
# ------------------------------------------------------------------
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
  AddOutputFilterByType DEFLATE application/javascript application/x-javascript
  AddOutputFilterByType DEFLATE application/json application/xml application/rss+xml
  AddOutputFilterByType DEFLATE image/svg+xml application/vnd.ms-fontobject font/ttf font/otf
</IfModule>

<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/css application/javascript image/svg+xml
</IfModule>

# ------------------------------------------------------------------
# 5. BROWSER CACHING
# Assets are versioned with ?v= from ASSET_VERSION, so long cache
# lifetimes are safe — bump ASSET_VERSION in config.php after a change.
# ------------------------------------------------------------------
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault                          "access plus 1 month"
  ExpiresByType text/html                 "access plus 0 seconds"
  ExpiresByType text/css                  "access plus 1 year"
  ExpiresByType application/javascript    "access plus 1 year"
  ExpiresByType image/webp                "access plus 1 year"
  ExpiresByType image/jpeg                "access plus 1 year"
  ExpiresByType image/png                 "access plus 1 year"
  ExpiresByType image/svg+xml             "access plus 1 year"
  ExpiresByType font/woff2                "access plus 1 year"
  ExpiresByType application/xml           "access plus 1 hour"
</IfModule>

<IfModule mod_headers.c>
  <FilesMatch "\.(css|js|webp|jpg|jpeg|png|svg|woff2)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>
  <FilesMatch "\.(php|html)$">
    Header set Cache-Control "no-cache, must-revalidate"
  </FilesMatch>
</IfModule>

# ------------------------------------------------------------------
# 6. MIME TYPES (older Apache builds miss these)
# ------------------------------------------------------------------
<IfModule mod_mime.c>
  AddType image/webp                 .webp
  AddType image/avif                 .avif
  AddType font/woff2                 .woff2
  AddType application/manifest+json  .webmanifest
  AddCharset UTF-8 .html .css .js .xml .json .php
</IfModule>

# ------------------------------------------------------------------
# 7. UPLOAD LIMITS (ignored on hosts that disallow php_value)
# ------------------------------------------------------------------
<IfModule mod_php.c>
  php_value upload_max_filesize 6M
  php_value post_max_size 8M
  php_flag  display_errors Off
  php_flag  log_errors On
</IfModule>

# ------------------------------------------------------------------
# 8. ERROR PAGES
# ------------------------------------------------------------------
ErrorDocument 404 /404.php
ErrorDocument 403 /404.php
