# AVE.cms public root

Options -Indexes -MultiViews
DirectoryIndex index.php
AddDefaultCharset UTF-8

# Keep modern static formats portable across minimal Apache installations.
<IfModule mod_mime.c>
	AddType image/avif avif
	AddType image/webp webp
	AddType font/woff2 woff2
	AddType application/manifest+json webmanifest
</IfModule>

<IfModule mod_deflate.c>
	AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript
	AddOutputFilterByType DEFLATE application/javascript application/json application/xml image/svg+xml
</IfModule>

<IfModule mod_expires.c>
	ExpiresActive On
	ExpiresByType text/css "access plus 7 days"
	ExpiresByType application/javascript "access plus 7 days"
	ExpiresByType text/javascript "access plus 7 days"
	ExpiresByType image/avif "access plus 30 days"
	ExpiresByType image/gif "access plus 30 days"
	ExpiresByType image/jpeg "access plus 30 days"
	ExpiresByType image/png "access plus 30 days"
	ExpiresByType image/svg+xml "access plus 30 days"
	ExpiresByType image/webp "access plus 30 days"
	ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

# Source maps, dumps, logs and environment files are never public downloads.
<IfModule mod_authz_core.c>
	<FilesMatch "(^\.|\.(?:bak|backup|dist|ini|log|sql)$)">
		Require all denied
	</FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteBase /

	# Preserve bearer/basic credentials for the native API behind CGI/FastCGI.
	RewriteCond %{HTTP:Authorization} .
	RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

	# AVE.cms uses the host without the legacy www prefix. Respect HTTPS both
	# directly and behind a reverse proxy; TLS itself belongs to the web server.
	RewriteCond %{HTTPS} =on [OR]
	RewriteCond %{HTTP:X-Forwarded-Proto} =https [NC]
	RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
	RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L,NE]

	RewriteCond %{HTTPS} !=on
	RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
	RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
	RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L,NE]

	# The clean installer remains available before the database config exists.
	RewriteRule ^setup/?$ setup/index.php [L,QSA]

	# Internal implementation and runtime data must not be addressed directly.
	RewriteRule ^(?:configs|storage|system|tmp)(?:/|$) - [R=404,L]
	# Module packages expose only static files from their declared asset roots.
	# Manifests, migrations, views, LESS sources and executable code stay private.
	RewriteRule ^modules/[A-Za-z0-9_-]+/(?:(?:app|admin)/)?assets/.+\.(?:css|js|mjs|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|otf|eot|mp4|webm)$ - [L,NC]
	RewriteRule ^modules(?:/|$) - [R=404,L,NC]
	RewriteRule ^setup/(?!index\.php$).*\.php$ - [R=404,L,NC]
	RewriteRule ^PACKAGE-MANIFEST\.json$ - [R=404,L,NC]

	# Expose one canonical public front controller URL.
	RewriteCond %{THE_REQUEST} \s/+index\.php(?:[?\s]) [NC]
	RewriteRule ^index\.php$ / [R=301,L]

	RewriteRule ^index\.php$ - [L]
	RewriteCond %{REQUEST_FILENAME} !-f
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteRule ^ index.php [L,QSA]
</IfModule>