RewriteEngine On
RewriteBase /

# Pass Authorization header through to PHP (Apache strips it by default)
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# Allow media files and avatars
RewriteCond %{REQUEST_URI} ^/user-data/media/
RewriteRule ^user-data/media/(.*)$ user-data/media/$1 [L]

RewriteCond %{REQUEST_URI} ^/user-data/avatars/
RewriteRule ^user-data/avatars/(.*)$ user-data/avatars/$1 [L]

# Security
<Files ~ "(\.htaccess|\.git|config\.php|\.log)$">
    Order Allow,Deny
    Deny from all
</Files>
# Keys, backups, schema, scripts, dev metadata — never served, wherever they are
<FilesMatch "(\.(pem|key|sql|sh|bak|swp|tmp|dist|orig)|code_graph\.json|~)$">
    Require all denied
</FilesMatch>
# Internal folders: server keys, PHP internals, logs, update staging, CLI tools
RewriteRule ^(keys|core|templates|includes|components|logs|cache|bin|migrations)(/|$) - [F,L]
RewriteRule ^user-data/ - [F,L]

# Avatar rewrite rules - route through API to resolve user ID
# Handles all three installation types
# ORDER MATTERS: Path-based first (most specific), then subdomain, then single-user (fallback)

# Path-based: /username/avatar.jpg -> api/avatar.php?user=username
RewriteRule ^([^/]+)/avatar\.jpg$ api/avatar.php?user=$1 [L,QSA]

RewriteRule ^([^/]+)/avatar_thumb\.jpg$ api/avatar.php?user=$1&thumbnail=true [L,QSA]

# Subdomain: user.example.com/avatar.jpg -> api/avatar.php?user=user
# Must come BEFORE single-user so the hostname condition can match
RewriteCond %{HTTP_HOST} ^([^.]+)\.
RewriteRule ^avatar\.jpg$ api/avatar.php?user=%1 [L,QSA]

RewriteCond %{HTTP_HOST} ^([^.]+)\.
RewriteRule ^avatar_thumb\.jpg$ api/avatar.php?user=%1&thumbnail=true [L,QSA]

# Single-user: /avatar.jpg -> api/avatar.php (no username in path)
# Fallback - only reached if no subdomain matched above
RewriteCond %{REQUEST_URI} ^/avatar\.jpg$
RewriteRule ^avatar\.jpg$ api/avatar.php [L,QSA]

RewriteCond %{REQUEST_URI} ^/avatar_thumb\.jpg$
RewriteRule ^avatar_thumb\.jpg$ api/avatar.php?thumbnail=true [L,QSA]

# Media files
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^user-data/(?!media/|avatars/).*$ - [F,L]

# Favicon and icons
RewriteRule ^favicon\.(ico|png)$ assets/images/favicon.$1 [L]
RewriteRule ^android-chrome-(512x512|192x192)-1\.png$ assets/images/android-chrome-$1-1.png [L]
RewriteRule ^apple-touch-icon\.png$ assets/images/apple-touch-icon.png [L]

# Static files
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|pdf|zip)$ - [L]

# Node-based API routes (BEFORE regular API routes)
RewriteRule ^(.+/)?api/federation/(.*)$ api/federation.php [QSA,L]

# Bot gateway (must be before the API catch-all)
RewriteRule ^api/app-gateway(/.*)?$ api/app-gateway.php [L,QSA]

# Standalone API endpoints that intentionally bypass api/index.php.
# List them explicitly. A generic "try api/$1.php first" rule sends
# /api/bookmarks, /api/plugins, /api/messages, /api/friend-groups, /api/media
# straight to their handler files, skipping session start and the CSRF
# gate in api/index.php.
RewriteRule ^api/sidebar-poll$ api/sidebar-poll.php [L,QSA]

# Regular API routes
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^api/(.*)$ api/index.php [L,QSA]

# Admin routes
RewriteRule ^admin/(.*)$ admin/index.php [L,QSA]

# Plugin static files (only real files, not routes like /plugins or /plugins/games)
RewriteCond %{DOCUMENT_ROOT}/plugins/$1/$2 -f
RewriteRule ^plugins/([a-z0-9-]+)/(.+\..+)$ plugins/$1/$2 [L]

# Plugin routes go to index.php
RewriteRule ^plugins(/|$) index.php [L]

# Plugin files revalidate on every load (cheap 304s) so an in-place plugin
# upgrade is picked up immediately instead of mixing cached old JS/CSS with new files.
<IfModule mod_headers.c>
    <If "%{REQUEST_URI} =~ m#^/plugins/[a-z0-9-]+/.+\.[a-z0-9]+$#">
        Header set Cache-Control "no-cache"
    </If>
</IfModule>

# Main app routing
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]
