# ScholarExam - cPanel / Apache configuration
# Powered by cPanel

# ── Node.js Passenger support ─────────────────────────────
# Uncomment the line below if your cPanel uses Passenger for Node.js
# PassengerNodejs /home/USERNAME/.nvm/versions/node/v20.0.0/bin/node

# ── Security headers ──────────────────────────────────────
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ── Gzip compression ──────────────────────────────────────
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
</IfModule>

# ── Cache static assets ───────────────────────────────────
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css                 "access plus 1 year"
  ExpiresByType application/javascript   "access plus 1 year"
  ExpiresByType image/png                "access plus 1 year"
  ExpiresByType image/jpeg               "access plus 1 year"
  ExpiresByType image/gif                "access plus 1 year"
  ExpiresByType image/svg+xml            "access plus 1 year"
  ExpiresByType image/webp               "access plus 1 year"
  ExpiresByType font/woff2               "access plus 1 year"
</IfModule>

# ── Protect sensitive files ───────────────────────────────
<Files "config.json">
  Order Deny,Allow
  Deny from all
</Files>
<Files ".env">
  Order Deny,Allow
  Deny from all
</Files>

# ── Protect install wizard after setup ───────────────────
<Files "install/.installed">
  Order Deny,Allow
  Deny from all
</Files>

# ── SPA routing: serve index.html for unknown paths ───────
# (Only if serving the React app directly via PHP / static hosting)
# If using Node.js, Express handles this automatically.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Don't rewrite existing files/directories
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d

  # Don't rewrite API calls (handled by Node.js)
  RewriteCond %{REQUEST_URI} !^/api/

  # Don't rewrite install wizard
  RewriteCond %{REQUEST_URI} !^/install/

  # Don't rewrite uploads
  RewriteCond %{REQUEST_URI} !^/uploads/

  # Serve React SPA
  RewriteRule ^ /index.html [L]
</IfModule>
