# Rosolo Safaris - LiteSpeed SPA Fallback + Security
# Must be placed at public_html/.htaccess

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /

  # Force HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

  # WWW to non-WWW
  RewriteCond %{HTTP_HOST} ^www.rosolosafaris.co.ke$ [NC]
  RewriteRule ^(.*)$ https://rosolosafaris.co.ke/$1 [R=301,L]

  # Old dead URLs
  RewriteRule ^pages$ /packages [R=301,L]
  RewriteRule ^pages/(.*)$ /packages/$1 [R=301,L]
  RewriteRule ^contactus$ / [R=301,L]

  # API and PHP files — do NOT rewrite
  RewriteRule ^api/ - [L]
  RewriteRule ^admin/ - [L]

  # Real files and directories — do NOT rewrite
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteRule ^ - [L]

  # Everything else -> index.html (SPA fallback)
  RewriteRule ^.*$ index.html [L]
</IfModule>

# Security Headers
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  Header always set X-Frame-Options "DENY"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(self), microphone=(), camera=(), payment=(self)"
  Header always unset X-Powered-By
</IfModule>

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json
</IfModule>

# Cache static assets
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/webp "access plus 1 month"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
</IfModule>
