# ===============================================================
# OGA IMMIGRATION - NAMECHEAP SHARED HOSTING APACHE CONFIGURATION
# (.htaccess for static SPA routing, SSL, security & caching)
# ===============================================================

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # 1. Force HTTPS Redirection (Namecheap AutoSSL / SSL Certificate)
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # 2. Do not rewrite existing files or directories
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # 3. Exclude API requests if proxying to Node.js backend
  RewriteCond %{REQUEST_URI} ^/api/ [NC]
  RewriteRule ^ - [L]

  # 4. Route all frontend SPA routes to index.html
  RewriteRule ^ index.html [L]
</IfModule>

# ===============================================================
# SECURITY HEADERS
# ===============================================================
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-XSS-Protection "1; mode=block"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>

# ===============================================================
# GZIP COMPRESSION & BROWSER CACHING
# ===============================================================
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType application/json "access plus 0 seconds"
</IfModule>
