<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On
    RewriteBase /

    # Handle Authorization header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Serve sw.js and manifest.json directly — do NOT route through Laravel
    RewriteRule ^sw\.js$ - [L]
    RewriteRule ^manifest\.json$ - [L]
    RewriteRule ^favicon\.ico$ - [L]
    RewriteRule ^icons/ - [L]

    # Remove trailing slashes
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=307]

    # Route everything else through Laravel
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

</IfModule>

Options -Indexes

<IfModule mod_php8.c>
    php_value upload_max_filesize 20M
    php_value post_max_size 20M
    php_value memory_limit 256M
    php_value max_execution_time 300
    php_flag display_errors Off
    php_flag log_errors On
</IfModule>

<FilesMatch "(\.env|\.htpasswd|composer\.json|composer\.lock|package\.json)$">
    Order allow,deny
    Deny from all
</FilesMatch>

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # Required for service worker scope
    Header always set Service-Worker-Allowed "/"
</IfModule>

# Correct MIME type for service worker
<Files "sw.js">
    Header set Content-Type "application/javascript"
    Header set Cache-Control "no-cache, no-store, must-revalidate"
</Files>

# Correct MIME type for manifest
<Files "manifest.json">
    Header set Content-Type "application/manifest+json"
    Header set Cache-Control "no-cache"
</Files>
