# Rusukh static SPA hosting defaults for Apache/Namecheap.
# This file is copied to dist/ by Vite and is not applied to production until cutover.

DirectoryIndex index.html

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Set cache-class flags before the real-file and SPA rules terminate rewriting.
  RewriteRule ^assets/ - [E=RUSUKH_IMMUTABLE:1]
  RewriteRule ^(?:index\.html|manifest\.webmanifest|sw\.js)$ - [E=RUSUKH_HTML:1]

  # Keep real files/directories (including Vite assets) untouched.
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Any client-side route serves index.html and must revalidate like HTML.
  RewriteRule ^ - [E=RUSUKH_HTML:1]

  # React Router routes (login, dashboard, study, admin, etc.).
  RewriteRule ^ index.html [L]
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Cache-Control "public, max-age=31536000, immutable" env=RUSUKH_IMMUTABLE
  Header always set Cache-Control "no-cache, no-store, must-revalidate" env=RUSUKH_HTML
</IfModule>

# HSTS and a final Content-Security-Policy are intentionally configured only after
# the staging/production domains and OAuth/media origins are approved.
