# Moxie Digital - ULTROX AGEM V1 hardened web delivery
<IfModule mod_mime.c>
  AddType application/javascript .js .mjs
  AddType text/css .css
  AddType application/json .json
</IfModule>
<IfModule mod_negotiation.c>
  Options -Indexes -MultiViews
</IfModule>
DirectoryIndex index.php
RewriteEngine On

# Always route the site root through PHP so the protected-session bootstrap runs.
RewriteRule ^$ index.php [L]

# Canonical HTTPS/host. Localhost remains available for testing.
RewriteCond %{HTTP_HOST} !^(localhost|127\.0\.0\.1)(:\d+)?$ [NC]
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{HTTP_HOST} !^moxiedigital\.in$ [NC]
RewriteRule ^ https://moxiedigital.in%{REQUEST_URI} [L,R=301,NE]

# Never expose security vault, databases, configuration or source-support files.
RewriteRule ^(?:private|data)(?:/|$) - [F,L,NC]
<FilesMatch "(^\.|package(-lock)?\.json$|.*\.(ts|tsx|map|env|log|bak|sql|ini)$|^index\.html$|^clone-guard\.js$)">
  Require all denied
</FilesMatch>

# Encrypted frontend vault gateway. Raw JS/CSS/images do not exist publicly.
RewriteRule ^(styles\.v45\.css)$ secure-asset.php?p=$1 [L,QSA,NC]
RewriteRule ^(moxie-(?:logo|favicon)\.png)$ secure-asset.php?p=$1 [L,QSA,NC]
RewriteRule ^(app/.*\.js)$ secure-asset.php?p=$1 [L,QSA,NC]
RewriteRule ^(images/.*\.(?:png|jpe?g|webp|gif))$ secure-asset.php?p=$1 [L,QSA,NC]
RewriteRule ^(uploads/(?:site-images|avatars)/.*\.(?:png|jpe?g|webp|gif))$ secure-asset.php?p=$1 [L,QSA,NC]

RewriteRule ^secure-asset\.php$ - [L]
# Runtime site images must be served by the protected media gateway before the generic API router.
RewriteRule ^api/media/site-images/([^/]+)$ secure-asset.php?p=uploads/site-images/$1 [L,QSA,B,NC]
RewriteRule ^api/index\.php$ - [L]
RewriteRule ^api/?$ api/index.php [L,QSA]
RewriteRule ^api/(.*)$ api/index.php?route=$1 [L,QSA]

RewriteRule ^account\.v(?:43|44)\.php$ user-profile.php?ui=v51 [L,R=302,QSA]
RewriteRule ^customer-account/?$ user-profile.php?ui=v51 [L,R=302,QSA]
RewriteRule ^account/?$ account.php [L,QSA]
RewriteRule ^profile/?$ user-profile.php [L,QSA]
RewriteRule ^user-profile/?$ user-profile.php [L,QSA]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^ index.php [L]

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "DENY"
  Header always set Referrer-Policy "no-referrer"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(self)"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Resource-Policy "same-origin"
  Header always set X-Permitted-Cross-Domain-Policies "none"
  Header always set X-Download-Options "noopen"
  Header always set X-ULTROX-AGEM-V1 "active"
  Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
  Header always set Pragma "no-cache"
  Header always set Expires "0"
  # External origins used by current app + checkout. Keep tight rather than wildcarding.
  Header always set Content-Security-Policy "default-src 'self'; base-uri https://moxiedigital.in/; object-src 'none'; frame-ancestors 'none'; form-action 'self' https://checkout.razorpay.com; script-src 'self' 'unsafe-inline' https://esm.sh https://cdn.jsdelivr.net https://cdn.tailwindcss.com https://checkout.razorpay.com https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src 'self' data: blob: https://images.unsplash.com https://quickchart.io; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://esm.sh https://generativelanguage.googleapis.com https://*.googleapis.com https://*.firebaseio.com https://*.firebasedatabase.app https://lottie.host https://api.razorpay.com; frame-src https://api.razorpay.com https://checkout.razorpay.com https://accounts.google.com; worker-src 'self' blob:; media-src 'self' blob:"
</IfModule>

<IfModule mod_php.c>
  php_value upload_max_filesize 300M
  php_value post_max_size 310M
  php_value memory_limit 256M
  php_flag expose_php Off
  php_flag display_errors Off
</IfModule>
<IfModule mod_php7.c>
  php_value upload_max_filesize 300M
  php_value post_max_size 310M
  php_value memory_limit 256M
</IfModule>

# Compress only text assets/API responses. Binary installers/archives are intentionally excluded.
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json image/svg+xml
</IfModule>
<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/css application/javascript application/json image/svg+xml
</IfModule>
