# ============================================================
# Restaurant Pro - .htaccess
# Clean URLs, SEO rewrites, performance & security
# ============================================================

<IfModule mod_rewrite.c>
    RewriteEngine On

    # --- SEO file rewrites ---
    RewriteRule ^sitemap\.xml$ sitemap.php [L]
    RewriteRule ^robots\.txt$ robots.php [L]

    # --- Blog clean URLs ---
    # /blog            -> blog.php (index)
    # /blog/my-post    -> blog-post.php?slug=my-post
    RewriteRule ^blog/?$ blog.php [L,QSA]
    RewriteRule ^blog/([^/]+)/?$ blog-post.php?slug=$1 [L,QSA]

    # --- Custom 301/302 redirect manager ---
    # Routes unknown paths through redirect.php which checks the redirects table.
    # (Handled in PHP to keep redirects editable from the dashboard.)
</IfModule>

# --- Custom redirect handler for unmatched URLs ---
ErrorDocument 404 /redirect.php

# --- Default documents ---
DirectoryIndex index.php

# --- Compression (faster load = better SEO) ---
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript
    AddOutputFilterByType DEFLATE application/json application/xml
    AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# --- Browser caching (Core Web Vitals) ---
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType video/mp4 "access plus 1 year"
</IfModule>

# --- Security headers ---
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    <FilesMatch "\.(jpg|jpeg|png|webp|gif|svg|css|js|ico|mp4)$">
        Header set Cache-Control "public, max-age=31536000"
    </FilesMatch>
</IfModule>

# --- Protect sensitive files ---
<FilesMatch "^(config\.php|schema\.php|setup-demo-data\.php)$">
    Require all denied
</FilesMatch>

# --- UTF-8 ---
AddDefaultCharset UTF-8
