# ============================================================
# Delino | دلینو - Root web server security (Apache .htaccess)
# No external resources. Sensitive dirs protected via their own .htaccess.
# ============================================================

Options -Indexes
ServerSignature Off

# Block dotfiles / sensitive meta
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Security headers
# NOTE: No X-Frame-Options here: Telegram Web/Desktop loads the Mini App inside an iframe.
# Embedding is controlled by CSP frame-ancestors below (Telegram origins allowed).
# NOTE: 'unsafe-inline' in script-src is required: the Mini App UI binds actions
# through inline onclick="App.*" handlers on server-rendered markup.
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "no-referrer"
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: blob: https:; media-src 'self' blob: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://telegram.org https://sad.adsgram.ai https://adsgram.ai; connect-src 'self' https://api.telegram.org https://*.adsgram.ai https://adsgram.ai wss://*.adsgram.ai; frame-src https://*.adsgram.ai https://adsgram.ai; frame-ancestors 'self' https://web.telegram.org https://*.telegram.org https://telegram.org"
</IfModule>

# ============================================================
# Shared hosting performance: compression + browser caching
# ============================================================

# Compress text-based assets (mod_deflate)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json application/x-javascript application/xml application/x-font-ttf application/x-font-woff application/x-font-woff2 font/woff font/woff2 image/svg+xml
</IfModule>

# Far-future caching for static assets (safe: filenames should change on update)
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css                      "access plus 1 month"
    ExpiresByType application/javascript        "access plus 1 month"
    ExpiresByType application/json              "access plus 0 seconds"
    ExpiresByType image/svg+xml                 "access plus 1 month"
    ExpiresByType image/png                     "access plus 1 month"
    ExpiresByType image/jpeg                    "access plus 1 month"
    ExpiresByType image/gif                     "access plus 1 month"
    ExpiresByType image/webp                    "access plus 1 month"
    ExpiresByType font/woff                     "access plus 1 month"
    ExpiresByType font/woff2                    "access plus 1 month"
    ExpiresByType application/font-woff2        "access plus 1 month"
</IfModule>

# Cache-Control headers mirroring the above
<IfModule mod_headers.c>
    <FilesMatch "\.(css|js|svg|png|jpe?g|gif|webp|woff2?)$">
        Header set Cache-Control "public, max-age=2592000, immutable"
    </FilesMatch>
    # PHP endpoints set their own Cache-Control (api.php → no-store). The blanket
    # no-store rule here overwrote the private-image proxy's short private cache,
    # forcing a re-download of every unlocked image on each sheet open.
    <FilesMatch "\.json$">
        Header set Cache-Control "no-store"
    </FilesMatch>
</IfModule>

# PHP performance (cPanel/LiteSpeed/php-fpm safe subset)
<IfModule mod_php.c>
    php_flag zlib.output_compression On
    php_value max_input_vars 2000
    php_value memory_limit 256M
</IfModule>
<IfModule lsapi_module>
    php_flag zlib.output_compression On
    php_value max_input_vars 2000
    php_value memory_limit 256M
</IfModule>

# Block direct web access to private uploads (served through the API controller)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^uploads/private/ - [F,L]
    RewriteRule ^uploads/cache/ - [F,L]
    # The Mini App authenticates via the "Authorization: tma <initData>" header.
    # CGI/FastCGI (common on shared cPanel hosts) and some reverse proxies DROP
    # that header, which logged everyone out. Re-inject it as
    # REDIRECT_HTTP_AUTHORIZATION so PHP always receives it (getInitData() in
    # app/Support/auth.php reads both names).
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Optional short URLs. The PHP query routes above remain usable on hosts
    # where mod_rewrite is disabled.
    RewriteRule ^api/([A-Za-z0-9_-]+)/?$ api.php?route=$1 [QSA,L]
    RewriteRule ^webhook/?$ webhook.php [L]
    RewriteRule ^(home|search|match|chats|wallet|profile|notifications)/?$ index.php?view=$1 [QSA,L]
</IfModule>
