# Apache / cPanel / LiteSpeed Rewrite Rules
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Prevent static asset requests (CSS, JS, images, fonts) from EVER rewriting to index.php
    RewriteCond %{REQUEST_URI} \.(css|js|png|jpg|jpeg|gif|svg|ico|webp|woff|woff2|ttf|eot|mp4|webm|zip|json)$ [NC]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ - [R=404,L]

    # Serve existing files and directories directly without rewriting
    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]

    # Clean URL support: e.g. /courses -> /courses.php, /login -> /login.php
    RewriteCond %{REQUEST_FILENAME}.php -f
    RewriteRule ^([a-zA-Z0-9_-]+)$ $1.php [L,QSA]

    # Virtual URL fallback (only for non-static requests)
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} !\.(css|js|png|jpg|jpeg|gif|svg|ico|webp|woff|woff2|ttf|eot|mp4|webm|zip|json)$ [NC]
    RewriteRule ^ index.php [L,QSA]
</IfModule>

# Security: Protect sensitive files and directories
<FilesMatch "^\.(env|git|sqlite)|database\.sql$">
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
</FilesMatch>

# Enable proper MIME types (prevents "Refused to apply style because MIME type text/html is not supported")
<IfModule mod_mime.c>
    AddType text/css .css
    AddType application/javascript .js
    AddType image/svg+xml .svg
    AddType font/woff2 .woff2
    AddType font/woff .woff
    AddType font/ttf .ttf
    AddType application/json .json
</IfModule>

# Browser Caching & CORS Headers
<IfModule mod_headers.c>
    <FilesMatch "\.(css|js)$">
        Header set Cache-Control "public, max-age=86400"
    </FilesMatch>
    <FilesMatch "\.(svg|png|jpg|jpeg|gif|ico|webp|woff|woff2|ttf)$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
</IfModule>

