# =============================================================================
# ReelRate — Apache Configuration
# Domain: https://eliteqash.com (root install)
# =============================================================================

Options -Indexes -MultiViews

# v5.9.9: /dashboard, /admin, … are served directly instead of first redirecting
# to /dashboard/ (saves a round trip on every tap). Real folders still work with a slash.
<IfModule mod_dir.c>
    DirectorySlash Off
</IfModule>
ServerSignature Off

# HTTPS Enforcement
<IfModule mod_rewrite.c>
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Security Headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options     "nosniff"
    Header always set X-Frame-Options            "DENY"
    Header always set X-XSS-Protection           "1; mode=block"
    Header always set Referrer-Policy            "strict-origin-when-cross-origin"
    Header always set Permissions-Policy         "geolocation=(), microphone=(), camera=()"
    # v5.9.9: browsers remember to use HTTPS only (the site already redirects http → https)
    Header always set Strict-Transport-Security  "max-age=15552000" "expr=%{HTTPS} == 'on'"
    Header always unset X-Powered-By
    Header always unset Server
</IfModule>

# Block sensitive files
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

<FilesMatch "\.(env|sql|md|log|sh|gitignore|lock)$">
    Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Block direct access to sensitive directories
    RewriteRule ^(config|includes|database|cron|storage|tools|cgi-bin)(/|$) - [F,L]
    # Uploaded files are never run as code
    RewriteRule ^(uploads|media)/.*\.(php[0-9]?|phtml|phar|pl|py|cgi|sh)$ - [F,L,NC]

    # Let real files (and real folders asked for with a trailing slash) pass through
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule ^ - [L]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteCond %{REQUEST_URI} /$
    RewriteRule ^ - [L]

    # =========================================================================
    # API ROUTES
    # =========================================================================
    # v6.1.0 — installable app + notifications
    # v6.5.0: one address for search engines — www.rateflix.net → rateflix.net
    RewriteCond %{HTTP_HOST} ^www\.rateflix\.net$ [NC]
    RewriteRule ^(.*)$ https://rateflix.net/$1 [R=301,L]
    RewriteRule ^robots\.txt$                    api/seo.php?f=robots               [L]
    RewriteRule ^sitemap\.xml$                   api/seo.php?f=sitemap              [L]
    RewriteRule ^llms\.txt$                      api/seo.php?f=llms                 [L]
    RewriteRule ^manifest\.webmanifest$          api/manifest.php            [L,QSA]
    RewriteRule ^earnings/?$                     account/earnings.php               [L,QSA]
    RewriteRule ^notifications/?$               account/notifications.php   [L,QSA]
    RewriteRule ^api/payment/initiate$          api/payment/lipalink.php    [L,QSA]
    RewriteRule ^api/payment/status$            api/payment/webhook.php     [L,QSA]
    RewriteRule ^api/payment/webhook$           api/payment/webhook.php     [L,QSA]
    RewriteRule ^api/product-download$          api/product-download.php    [L,QSA]
    RewriteRule ^api/branding-logo$             api/branding-logo.php       [L,QSA]
    RewriteRule ^api/media$                     api/media.php               [L,QSA]
    RewriteRule ^api/account/currency$          api/account/currency.php    [L,QSA]
    RewriteRule ^api/tasks/([a-z-]+)$           api/tasks/$1.php            [L,QSA]
    RewriteRule ^api/payment/([a-z-]+)$         api/payment/$1.php          [L,QSA]
    RewriteRule ^api/([a-z-]+)$                 api/$1.php                  [L,QSA]

    # =========================================================================
    # AUTH ROUTES
    # =========================================================================
    RewriteRule ^auth/register$                 auth/register.php           [L,QSA]
    RewriteRule ^auth/login$                    auth/login.php              [L,QSA]
    RewriteRule ^auth/logout$                   auth/logout.php             [L,QSA]
    RewriteRule ^auth/forgot-password$          auth/forgot-password.php    [L,QSA]
    RewriteRule ^auth/activate$                 auth/activate.php           [L,QSA]

    # =========================================================================
    # DASHBOARD
    # =========================================================================
    RewriteRule ^dashboard/?$                   dashboard/index.php         [L,QSA]

    # =========================================================================
    # TEAM
    # =========================================================================

    # =========================================================================
    # TOURNAMENT
    # =========================================================================

    # =========================================================================
    # FINANCIAL
    # =========================================================================
    RewriteRule ^financial/reversal-history$    financial/reversal-history.php   [L,QSA]
    RewriteRule ^financial/withdraw$            financial/withdraw.php           [L,QSA]
    RewriteRule ^financial/withdrawal-history$  financial/withdrawal-history.php [L,QSA]

    # =========================================================================
    # SITE TASKS — Hotel Reviews
    # =========================================================================

    # =========================================================================
    # SITE TASKS — Chatting
    # =========================================================================

    # =========================================================================
    # SITE TASKS — Others
    # =========================================================================

    # =========================================================================
    # ACCOUNT
    # =========================================================================
    RewriteRule ^tasks/trailers/?$              site-tasks/trailers/index.php      [L,QSA]
    RewriteRule ^tasks/trailers/watch$          site-tasks/trailers/watch.php      [L,QSA]
    RewriteRule ^store/?$                       site-tasks/store.php               [L,QSA]
    RewriteRule ^vip/?$                         account/vip.php                    [L,QSA]
    RewriteRule ^affiliate/?$                   account/affiliate.php              [L,QSA]
    RewriteRule ^guide/?$                       guide.php                          [L,QSA]
    RewriteRule ^partner/?$                     account/affiliate.php              [L,QSA]
    RewriteRule ^account/profile$               account/profile.php         [L,QSA]

    # =========================================================================
    # ADMIN
    # =========================================================================
    RewriteRule ^admin/?$                       admin/index.php                    [L,QSA]
    RewriteRule ^admin/login$                   admin/login.php                    [L,QSA]
    RewriteRule ^admin/users$                   admin/users.php                    [L,QSA]
    RewriteRule ^admin/admins$                  admin/admins.php                   [L,QSA]
    RewriteRule ^admin/earnings$                admin/earnings.php                 [L,QSA]
    RewriteRule ^admin/user-edit$               admin/user-edit.php                [L,QSA]
    RewriteRule ^admin/transactions$            admin/transactions.php             [L,QSA]
    RewriteRule ^admin/payment-log$            admin/payment-log.php       [L,QSA]
    RewriteRule ^admin/withdrawals$             admin/withdrawals.php              [L,QSA]
    RewriteRule ^admin/auto-withdrawals$        admin/auto-withdrawals.php         [L,QSA]
    RewriteRule ^admin/announcements$           admin/announcements.php            [L,QSA]
    RewriteRule ^admin/notifications$           admin/notifications.php            [L,QSA]
    RewriteRule ^admin/analytics$               admin/analytics.php                [L,QSA]
    RewriteRule ^admin/countries$               admin/countries.php                [L,QSA]
    RewriteRule ^admin/payment-settings$        admin/payment-settings.php         [L,QSA]
    RewriteRule ^admin/theme-settings$          admin/theme-settings.php           [L,QSA]
    RewriteRule ^admin/app-settings$            admin/app-settings.php             [L,QSA]
    RewriteRule ^admin/email-settings$          admin/email-settings.php           [L,QSA]
    RewriteRule ^admin/wallets$                 admin/wallets.php                  [L,QSA]
    RewriteRule ^admin/vip$                     admin/vip.php                      [L,QSA]
    RewriteRule ^admin/ads$                     admin/ads.php                      [L,QSA]
    RewriteRule ^admin/earning-rules$           admin/earning-rules.php            [L,QSA]
    RewriteRule ^admin/tasks/trailers$          admin/tasks/trailers.php           [L,QSA]
    RewriteRule ^admin/tasks/trailer-import$    admin/tasks/trailer-import.php     [L,QSA]
    RewriteRule ^admin/tasks/reviews$           admin/tasks/reviews.php            [L,QSA]
    RewriteRule ^admin/tasks/products$          admin/tasks/products.php           [L,QSA]
    RewriteRule ^admin/tasks/task-settings$     admin/tasks/task-settings.php      [L,QSA]

    # =========================================================================
    # ROOT
    # =========================================================================
    RewriteRule ^$                              index.php                   [L,QSA]

</IfModule>

# Cache static assets
<IfModule mod_mime.c>
    AddType image/avif .avif
</IfModule>

# v5.9.9: CSS bundles are named after their content, so browsers may keep them for a year.
<IfModule mod_headers.c>
    <FilesMatch "^b-[0-9a-f]{16}\.css$">
        Header set Cache-Control "public, max-age=31536000, immutable"
    </FilesMatch>
</IfModule>

<IfModule mod_headers.c>
    <Files "sw.js">
        Header set Cache-Control "no-cache"
        Header set Service-Worker-Allowed "/"
    </Files>
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css               "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/jpeg             "access plus 3 months"
    ExpiresByType image/png              "access plus 3 months"
    ExpiresByType image/webp             "access plus 3 months"
    ExpiresByType image/avif             "access plus 3 months"
    ExpiresByType image/svg+xml          "access plus 1 month"
</IfModule>

# Gzip compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json
</IfModule>

# v6.5.0: private areas never appear in search results
<IfModule mod_headers.c>
    <If "%{REQUEST_URI} =~ m#^/(admin|api)(/|$)#">
        Header set X-Robots-Tag "noindex, nofollow"
    </If>
</IfModule>
