# ============================================================
# বইঘর — public web root
# ============================================================
Options -Indexes
DirectoryIndex index.php

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS (comment out if you are still on http during setup)
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

    # ---- Clean URLs matching the spec's URL structure ----
    RewriteRule ^books/?$                books.php                        [L]
    RewriteRule ^book/([^/]+)/?$         book.php?slug=$1                 [L,QSA]
    RewriteRule ^category/([^/]+)/?$     category.php?slug=$1             [L,QSA]
    RewriteRule ^preview/([^/]+)/?$      preview.php?slug=$1              [L,QSA]
    RewriteRule ^reader/([^/]+)/?$       reader.php?slug=$1               [L,QSA]
    RewriteRule ^my-books/?$             my-books.php                     [L]
    RewriteRule ^my-orders/?$            orders.php                       [L]
    RewriteRule ^bookmarks/?$            bookmarks.php                    [L]
    RewriteRule ^profile/?$              profile.php                      [L]
    RewriteRule ^login/?$                login.php                        [L]
    RewriteRule ^register/?$             register.php                     [L]
    RewriteRule ^logout/?$               logout.php                       [L]
    RewriteRule ^checkout/?$             checkout.php                     [L]
    RewriteRule ^payment/success/?$      payment/success.php              [L]
    RewriteRule ^payment/failed/?$       payment/failed.php               [L]

    # Cover images are served through PHP so the storage dir stays outside
    # the web root and nothing can be guessed by walking a directory.
    RewriteRule ^covers/([A-Za-z0-9._-]+)$ cover.php?f=$1                 [L]
</IfModule>

# ---- Never serve a PDF from anywhere under the web root ----
<FilesMatch "\.(pdf|sql|log|md|ini|env)$">
    Require all denied
</FilesMatch>

# ---- Security headers ----
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    # Page images must never be cached to disk by a shared proxy
    <FilesMatch "page-image\.php$">
        Header always set Cache-Control "no-store, no-cache, must-revalidate, private"
    </FilesMatch>
</IfModule>

# ---- Static asset caching ----
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    ExpiresByType image/webp "access plus 30 days"
    ExpiresByType image/png "access plus 30 days"
    ExpiresByType image/jpeg "access plus 30 days"
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>

# ---- Bangla error pages ----
ErrorDocument 403 /403.php
ErrorDocument 404 /404.php
ErrorDocument 500 /500.php
