RewriteEngine On
RewriteRule ^sitemap\.xml$ sitemap.php [L]

<IfModule mod_rewrite.c>
    RewriteEngine On

    # --- STEP 1: HTTP+www → https://non-www (single hop, handles both issues at once) ---
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

    # --- STEP 2: HTTPS+www → https://non-www ---
    RewriteCond %{HTTPS} on
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

    # --- STEP 3: HTTP+non-www → https://non-www ---
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

    # --- PHP-served pages: direct to their PHP handlers ---
    RewriteRule ^invoice/([A-Za-z0-9\-]+)$ invoice/index.php?order_id=$1 [L,QSA]

    # --- Static assets & physical folders: let Apache serve them directly ---
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Exclude api, admin, tracking, review, invoice directories from SPA fallback
    RewriteRule ^(api|admin|invoice|tracking|review)(/|$) - [L]

    # Exclude /api/ segment anywhere in the URI
    RewriteRule (^|/)api/ - [L]

    # --- 301 Redirect: strip .html extension for clean URLs ---
    RewriteCond %{THE_REQUEST} \s/[^\?\s]+/produk/([^\.?\s]+)\.html[\s?] [NC]
    RewriteRule ^produk/([^\.]+)\.html$ produk/$1 [R=301,L,NC]

    RewriteCond %{THE_REQUEST} \s/[^\?\s]+/([^/\.?\s]+)\.html[\s?] [NC]
    RewriteRule ^([^/]+)\.html$ $1 [R=301,L,NC]

    # --- SPA fallback: all non-physical-file, non-directory requests -> index.php ---
    RewriteRule ^ index.php [L]

</IfModule>

# --- Security Headers ---
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    # HSTS - aktifkan setelah dikonfirmasi semua redirect berjalan benar:
    # Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

# --- Block access to sensitive files ---
<FilesMatch "\.(env|git|log|sql|bak|bak_.*|backup|sh|bat|ts|tsx|zip)$">
RedirectMatch 403 (^|/)src(/|$)
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# --- Block scratch files from public access ---
<FilesMatch "^scratch_">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# --- Disable directory listing ---
Options -Indexes

# --- Gzip / Deflate Compression ---
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json application/xml application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# --- Browser Caching (Expires Headers) ---
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"

    ExpiresByType image/jpg            "access plus 1 year"
    ExpiresByType image/jpeg           "access plus 1 year"
    ExpiresByType image/gif            "access plus 1 year"
    ExpiresByType image/png            "access plus 1 year"
    ExpiresByType image/webp           "access plus 1 year"
    ExpiresByType image/svg+xml        "access plus 1 year"
    ExpiresByType image/x-icon         "access plus 1 year"
    ExpiresByType font/ttf             "access plus 1 year"
    ExpiresByType font/otf             "access plus 1 year"
    ExpiresByType font/woff            "access plus 1 year"
    ExpiresByType font/woff2           "access plus 1 year"
    ExpiresByType application/font-woff "access plus 1 year"
    ExpiresByType text/css             "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType text/javascript      "access plus 1 year"
</IfModule>

# --- Cache-Control Headers ---
<IfModule mod_headers.c>

    <FilesMatch "\.(js|css|woff|woff2|ttf|otf|eot)$">
        Header always set Cache-Control "public, max-age=31536000, immutable"
        Header always set Vary "Accept-Encoding"
    </FilesMatch>

    <FilesMatch "\.(ico|jpe?g|jpg|png|gif|webp|svg)$">
        Header always set Cache-Control "public, max-age=31536000"
        Header always set Vary "Accept-Encoding"
    </FilesMatch>

</IfModule>